libavcodec/4xm.c:890: error: Integer Overflow L2
  ([min(8, `*avpkt->data`), +oo] - [-oo, 134217748]):unsigned32 by call to `decode_p_frame`.

libavcodec/4xm.c:787:1: Parameter `*avpkt->data`
785. }
786. 
787. static int decode_frame(AVCodecContext *avctx, void *data,
     ^
788.                         int *got_frame, AVPacket *avpkt)
789. {

libavcodec/4xm.c:852:9: Assignment
850. 
851.         memcpy(cfrm->data + cfrm->size, buf + 20, data_size);
852.         cfrm->size += data_size;
             ^
853. 
854.         if (cfrm->size >= whole_size) {

libavcodec/4xm.c:856:13: Assignment
854.         if (cfrm->size >= whole_size) {
855.             buf        = cfrm->data;
856.             frame_size = cfrm->size;
                 ^
857. 
858.             if (id != avctx->frame_number)

libavcodec/4xm.c:890:20: Call
888.     } else if (frame_4cc == AV_RL32("pfrm") || frame_4cc == AV_RL32("pfr2")) {
889.         picture->pict_type = AV_PICTURE_TYPE_P;
890.         if ((ret = decode_p_frame(f, buf, frame_size)) < 0)
                        ^
891.             return ret;
892.     } else if (frame_4cc == AV_RL32("snd_")) {

libavcodec/4xm.c:400:1: <LHS trace>
398. }
399. 
400. static int decode_p_frame(FourXContext *f, const uint8_t *buf, int length)
     ^
401. {
402.     int x, y;

libavcodec/4xm.c:400:1: Parameter `length`
  398. }
  399. 
  400. static int decode_p_frame(FourXContext *f, const uint8_t *buf, int length)
       ^
  401. {
  402.     int x, y;

libavcodec/4xm.c:416:9: <RHS trace>
414.         if (length < 20)
415.             return AVERROR_INVALIDDATA;
416.         extra           = 20;
             ^
417.         bitstream_size  = AV_RL32(buf + 8);
418.         wordstream_size = AV_RL32(buf + 12);

libavcodec/4xm.c:416:9: Assignment
  414.         if (length < 20)
  415.             return AVERROR_INVALIDDATA;
  416.         extra           = 20;
               ^
  417.         bitstream_size  = AV_RL32(buf + 8);
  418.         wordstream_size = AV_RL32(buf + 12);

libavcodec/4xm.c:448:5: Assignment
  446. 
  447.     wordstream_offset = extra + bitstream_size;
  448.     bytestream_offset = extra + bitstream_size + wordstream_size;
           ^
  449.     bytestream2_init(&f->g2, buf + wordstream_offset,
  450.                      length - wordstream_offset);

libavcodec/4xm.c:451:5: Binary operation: ([min(8, *avpkt->data), +oo] - [-oo, 134217748]):unsigned32 by call to `decode_p_frame` 
  449.     bytestream2_init(&f->g2, buf + wordstream_offset,
  450.                      length - wordstream_offset);
  451.     bytestream2_init(&f->g, buf + bytestream_offset,
           ^
  452.                      length - bytestream_offset);
  453. 

static int decode_p_frame(FourXContext *f, const uint8_t *buf, int length)
{
    int x, y;
    const int width  = f->avctx->width;
    const int height = f->avctx->height;
    uint16_t *dst    = f->frame_buffer;
    uint16_t *src;
    unsigned int bitstream_size, bytestream_size, wordstream_size, extra,
                 bytestream_offset, wordstream_offset;
    int ret;
    src = f->last_frame_buffer;
    if (f->version > 1) {
        if (length < 20)
            return AVERROR_INVALIDDATA;
        extra           = 20;
        bitstream_size  = AV_RL32(buf + 8);
        wordstream_size = AV_RL32(buf + 12);
        bytestream_size = AV_RL32(buf + 16);
    } else {
        extra           = 0;
        bitstream_size  = AV_RL16(buf - 4);
        wordstream_size = AV_RL16(buf - 2);
        bytestream_size = FFMAX(length - bitstream_size - wordstream_size, 0);
    }
    if (bitstream_size + bytestream_size + wordstream_size + extra != length
        || bitstream_size  > (1 << 26)
        || bytestream_size > (1 << 26)
        || wordstream_size > (1 << 26)) {
        av_log(f->avctx, AV_LOG_ERROR, "lengths %d %d %d %d\n",
               bitstream_size, bytestream_size, wordstream_size,
               bitstream_size + bytestream_size + wordstream_size - length);
        return AVERROR_INVALIDDATA;
    }
    av_fast_malloc(&f->bitstream_buffer, &f->bitstream_buffer_size,
                   bitstream_size + FF_INPUT_BUFFER_PADDING_SIZE);
    if (!f->bitstream_buffer)
        return AVERROR(ENOMEM);
    f->dsp.bswap_buf(f->bitstream_buffer, (const uint32_t*)(buf + extra),
                     bitstream_size / 4);
    memset((uint8_t*)f->bitstream_buffer + bitstream_size,
           0, FF_INPUT_BUFFER_PADDING_SIZE);
    init_get_bits(&f->gb, f->bitstream_buffer, 8 * bitstream_size);
    wordstream_offset = extra + bitstream_size;
    bytestream_offset = extra + bitstream_size + wordstream_size;
    bytestream2_init(&f->g2, buf + wordstream_offset,
                     length - wordstream_offset);
    bytestream2_init(&f->g, buf + bytestream_offset,
                     length - bytestream_offset);
    init_mv(f, width * 2);
    for (y = 0; y < height; y += 8) {
        for (x = 0; x < width; x += 8)
            if ((ret = decode_p_block(f, dst + x, src + x, 3, 3, width)) < 0)
                return ret;
        src += 8 * width;
        dst += 8 * width;
    }
    return 0;
}
['static int decode_frame(AVCodecContext *avctx, void *data,\n                        int *got_frame, AVPacket *avpkt)\n{\n    const uint8_t *buf    = avpkt->data;\n    int buf_size          = avpkt->size;\n    FourXContext *const f = avctx->priv_data;\n    AVFrame *picture      = data;\n    int i, frame_4cc, frame_size, ret;\n    if (buf_size < 20)\n        return AVERROR_INVALIDDATA;\n    if (avctx->width % 16 || avctx->height % 16) {\n        av_log(avctx, AV_LOG_ERROR,\n               "Dimensions non-multiple of 16 are invalid.\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (buf_size < AV_RL32(buf + 4) + 8) {\n        av_log(f->avctx, AV_LOG_ERROR, "size mismatch %d %d\\n",\n               buf_size, AV_RL32(buf + 4));\n        return AVERROR_INVALIDDATA;\n    }\n    frame_4cc = AV_RL32(buf);\n    if (frame_4cc == AV_RL32("cfrm")) {\n        int free_index       = -1;\n        int id, whole_size;\n        const int data_size  = buf_size - 20;\n        CFrameBuffer *cfrm;\n        if (data_size < 0)\n            return AVERROR_INVALIDDATA;\n        id         = AV_RL32(buf + 12);\n        whole_size = AV_RL32(buf + 16);\n        for (i = 0; i < CFRAME_BUFFER_COUNT; i++)\n            if (f->cfrm[i].id && f->cfrm[i].id < avctx->frame_number)\n                av_log(f->avctx, AV_LOG_ERROR, "lost c frame %d\\n",\n                       f->cfrm[i].id);\n        for (i = 0; i < CFRAME_BUFFER_COUNT; i++) {\n            if (f->cfrm[i].id == id)\n                break;\n            if (f->cfrm[i].size == 0)\n                free_index = i;\n        }\n        if (i >= CFRAME_BUFFER_COUNT) {\n            i             = free_index;\n            f->cfrm[i].id = id;\n        }\n        cfrm = &f->cfrm[i];\n        cfrm->data = av_fast_realloc(cfrm->data, &cfrm->allocated_size,\n                                     cfrm->size + data_size + FF_INPUT_BUFFER_PADDING_SIZE);\n        if (!cfrm->data) {\n            av_log(f->avctx, AV_LOG_ERROR, "realloc failure");\n            return AVERROR(ENOMEM);\n        }\n        memcpy(cfrm->data + cfrm->size, buf + 20, data_size);\n        cfrm->size += data_size;\n        if (cfrm->size >= whole_size) {\n            buf        = cfrm->data;\n            frame_size = cfrm->size;\n            if (id != avctx->frame_number)\n                av_log(f->avctx, AV_LOG_ERROR, "cframe id mismatch %d %d\\n",\n                       id, avctx->frame_number);\n            if (f->version <= 1)\n                return AVERROR_INVALIDDATA;\n            cfrm->size = cfrm->id = 0;\n            frame_4cc  = AV_RL32("pfrm");\n        } else\n            return buf_size;\n    } else {\n        buf        = buf      + 12;\n        frame_size = buf_size - 12;\n    }\n    if ((ret = ff_get_buffer(avctx, picture, 0)) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return ret;\n    }\n    if (frame_4cc == AV_RL32("ifr2")) {\n        picture->pict_type = AV_PICTURE_TYPE_I;\n        if ((ret = decode_i2_frame(f, buf - 4, frame_size + 4)) < 0)\n            return ret;\n    } else if (frame_4cc == AV_RL32("ifrm")) {\n        picture->pict_type = AV_PICTURE_TYPE_I;\n        if ((ret = decode_i_frame(f, buf, frame_size)) < 0)\n            return ret;\n    } else if (frame_4cc == AV_RL32("pfrm") || frame_4cc == AV_RL32("pfr2")) {\n        picture->pict_type = AV_PICTURE_TYPE_P;\n        if ((ret = decode_p_frame(f, buf, frame_size)) < 0)\n            return ret;\n    } else if (frame_4cc == AV_RL32("snd_")) {\n        av_log(avctx, AV_LOG_ERROR, "ignoring snd_ chunk length:%d\\n",\n               buf_size);\n    } else {\n        av_log(avctx, AV_LOG_ERROR, "ignoring unknown chunk length:%d\\n",\n               buf_size);\n    }\n    picture->key_frame = picture->pict_type == AV_PICTURE_TYPE_I;\n    av_image_copy_plane(picture->data[0], picture->linesize[0],\n                        (const uint8_t*)f->frame_buffer,  avctx->width * 2,\n                        avctx->width * 2, avctx->height);\n    FFSWAP(uint16_t *, f->frame_buffer, f->last_frame_buffer);\n    *got_frame = 1;\n    emms_c();\n    return buf_size;\n}', 'static int decode_p_frame(FourXContext *f, const uint8_t *buf, int length)\n{\n    int x, y;\n    const int width  = f->avctx->width;\n    const int height = f->avctx->height;\n    uint16_t *dst    = f->frame_buffer;\n    uint16_t *src;\n    unsigned int bitstream_size, bytestream_size, wordstream_size, extra,\n                 bytestream_offset, wordstream_offset;\n    int ret;\n    src = f->last_frame_buffer;\n    if (f->version > 1) {\n        if (length < 20)\n            return AVERROR_INVALIDDATA;\n        extra           = 20;\n        bitstream_size  = AV_RL32(buf + 8);\n        wordstream_size = AV_RL32(buf + 12);\n        bytestream_size = AV_RL32(buf + 16);\n    } else {\n        extra           = 0;\n        bitstream_size  = AV_RL16(buf - 4);\n        wordstream_size = AV_RL16(buf - 2);\n        bytestream_size = FFMAX(length - bitstream_size - wordstream_size, 0);\n    }\n    if (bitstream_size + bytestream_size + wordstream_size + extra != length\n        || bitstream_size  > (1 << 26)\n        || bytestream_size > (1 << 26)\n        || wordstream_size > (1 << 26)) {\n        av_log(f->avctx, AV_LOG_ERROR, "lengths %d %d %d %d\\n",\n               bitstream_size, bytestream_size, wordstream_size,\n               bitstream_size + bytestream_size + wordstream_size - length);\n        return AVERROR_INVALIDDATA;\n    }\n    av_fast_malloc(&f->bitstream_buffer, &f->bitstream_buffer_size,\n                   bitstream_size + FF_INPUT_BUFFER_PADDING_SIZE);\n    if (!f->bitstream_buffer)\n        return AVERROR(ENOMEM);\n    f->dsp.bswap_buf(f->bitstream_buffer, (const uint32_t*)(buf + extra),\n                     bitstream_size / 4);\n    memset((uint8_t*)f->bitstream_buffer + bitstream_size,\n           0, FF_INPUT_BUFFER_PADDING_SIZE);\n    init_get_bits(&f->gb, f->bitstream_buffer, 8 * bitstream_size);\n    wordstream_offset = extra + bitstream_size;\n    bytestream_offset = extra + bitstream_size + wordstream_size;\n    bytestream2_init(&f->g2, buf + wordstream_offset,\n                     length - wordstream_offset);\n    bytestream2_init(&f->g, buf + bytestream_offset,\n                     length - bytestream_offset);\n    init_mv(f, width * 2);\n    for (y = 0; y < height; y += 8) {\n        for (x = 0; x < width; x += 8)\n            if ((ret = decode_p_block(f, dst + x, src + x, 3, 3, width)) < 0)\n                return ret;\n        src += 8 * width;\n        dst += 8 * width;\n    }\n    return 0;\n}']