libavformat/rtpdec_h261.c:126: error: Integer Overflow L2
  ([1, +oo] - [1, 8-min(0, `rtp_h261_ctx->endbyte_bits`)]):unsigned32 by call to `bitstream_read`.

libavformat/rtpdec_h261.c:47:1: Parameter `rtp_h261_ctx->endbyte_bits`
45. }
46. 
47. static int h261_handle_packet(AVFormatContext *ctx, PayloadContext *rtp_h261_ctx,
    ^
48.                               AVStream *st, AVPacket *pkt, uint32_t *timestamp,
49.                               const uint8_t *buf, int len, uint16_t seq,

libavformat/rtpdec_h261.c:126:42: Call
124.             bitstream_skip(&bc, sbit);
125.             if (rtp_h261_ctx->endbyte_bits) {
126.                 rtp_h261_ctx->endbyte |= bitstream_read(&bc, 8 - rtp_h261_ctx->endbyte_bits);
                                              ^
127.                 avio_w8(rtp_h261_ctx->buf, rtp_h261_ctx->endbyte);
128.             }

libavcodec/bitstream.h:183:1: Parameter `n`
  181. 
  182. /* Return n bits from the buffer. n has to be in the 0-32 range. */
  183. static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)
       ^
  184. {
  185.     if (!n)

libavcodec/bitstream.h:194:12: Call
  192.     }
  193. 
  194.     return get_val(bc, n);
                  ^
  195. }
  196. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([1, +oo] - [1, 8-min(0, rtp_h261_ctx->endbyte_bits)]):unsigned32 by call to `bitstream_read` 
    137.     bc->bits <<= n;
    138. #endif
    139.     bc->bits_left -= n;
             ^
    140. 
    141.     return ret;

static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);
    bc->bits >>= n;
#else
    uint64_t ret = bc->bits >> (64 - n);
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
    return ret;
}
['static int h261_handle_packet(AVFormatContext *ctx, PayloadContext *rtp_h261_ctx,\n                              AVStream *st, AVPacket *pkt, uint32_t *timestamp,\n                              const uint8_t *buf, int len, uint16_t seq,\n                              int flags)\n{\n    int sbit, ebit, gobn, mbap, quant;\n    int res;\n    if (rtp_h261_ctx->buf && rtp_h261_ctx->timestamp != *timestamp) {\n        ffio_free_dyn_buf(&rtp_h261_ctx->buf);\n        rtp_h261_ctx->endbyte_bits = 0;\n    }\n    if (len < RTP_H261_PAYLOAD_HEADER_SIZE + 1) {\n        av_log(ctx, AV_LOG_ERROR, "Too short RTP/H.261 packet, got %d bytes\\n", len);\n        return AVERROR_INVALIDDATA;\n    }\n    sbit  =  (buf[0] >> 5) & 0x07;\n    ebit  =  (buf[0] >> 2) & 0x07;\n    gobn  =  (buf[1] >> 4) & 0x0f;\n    mbap  = ((buf[1] << 1) & 0x1e) | ((buf[2] >> 7) & 0x01);\n    quant =  (buf[2] >> 2) & 0x1f;\n    buf += RTP_H261_PAYLOAD_HEADER_SIZE;\n    len -= RTP_H261_PAYLOAD_HEADER_SIZE;\n    if (!rtp_h261_ctx->buf) {\n        if (!gobn && !sbit && !mbap && !quant) {\n            res = avio_open_dyn_buf(&rtp_h261_ctx->buf);\n            if (res < 0)\n                return res;\n            rtp_h261_ctx->timestamp = *timestamp;\n        } else {\n            return AVERROR(EAGAIN);\n        }\n    }\n    if (rtp_h261_ctx->endbyte_bits || sbit) {\n        if (rtp_h261_ctx->endbyte_bits == sbit) {\n            rtp_h261_ctx->endbyte     |= buf[0] & (0xff >> sbit);\n            rtp_h261_ctx->endbyte_bits = 0;\n            buf++;\n            len--;\n            avio_w8(rtp_h261_ctx->buf, rtp_h261_ctx->endbyte);\n        } else {\n            BitstreamContext bc;\n            bitstream_init(&bc, buf, len * 8 - ebit);\n            bitstream_skip(&bc, sbit);\n            if (rtp_h261_ctx->endbyte_bits) {\n                rtp_h261_ctx->endbyte |= bitstream_read(&bc, 8 - rtp_h261_ctx->endbyte_bits);\n                avio_w8(rtp_h261_ctx->buf, rtp_h261_ctx->endbyte);\n            }\n            while (bitstream_bits_left(&bc) >= 8)\n                avio_w8(rtp_h261_ctx->buf, bitstream_read(&bc, 8));\n            rtp_h261_ctx->endbyte_bits = bitstream_bits_left(&bc);\n            if (rtp_h261_ctx->endbyte_bits)\n                rtp_h261_ctx->endbyte = bitstream_read(&bc, rtp_h261_ctx->endbyte_bits) <<\n                                        (8 - rtp_h261_ctx->endbyte_bits);\n            ebit = 0;\n            len  = 0;\n        }\n    }\n    if (ebit) {\n        if (len > 0)\n            avio_write(rtp_h261_ctx->buf, buf, len - 1);\n        rtp_h261_ctx->endbyte_bits = 8 - ebit;\n        rtp_h261_ctx->endbyte      = buf[len - 1] & (0xff << ebit);\n    } else {\n        avio_write(rtp_h261_ctx->buf, buf, len);\n    }\n    if (!(flags & RTP_FLAG_MARKER))\n        return AVERROR(EAGAIN);\n    if (rtp_h261_ctx->endbyte_bits)\n        avio_w8(rtp_h261_ctx->buf, rtp_h261_ctx->endbyte);\n    rtp_h261_ctx->endbyte_bits = 0;\n    res = ff_rtp_finalize_packet(pkt, &rtp_h261_ctx->buf, st->index);\n    if (res < 0)\n        return res;\n    return 0;\n}', 'static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)\n{\n    if (!n)\n        return 0;\n    if (n > bc->bits_left) {\n        refill_32(bc);\n        if (bc->bits_left < 32)\n            bc->bits_left = n;\n    }\n    return get_val(bc, n);\n}', 'static inline uint64_t get_val(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);\n    bc->bits >>= n;\n#else\n    uint64_t ret = bc->bits >> (64 - n);\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n    return ret;\n}']