libavformat/avidec.c:1138: error: Integer Overflow L2
  ([0, 255] - 48):unsigned32.

libavformat/avidec.c:1126:15: <LHS trace>
1124.     /* Read the entries and sort them in each stream component. */
1125.     for(i = 0; i < nb_index_entries; i++) {
1126.         tag = avio_rl32(pb);
                    ^
1127.         flags = avio_rl32(pb);
1128.         pos = avio_rl32(pb);

libavformat/avidec.c:1126:15: Call
1124.     /* Read the entries and sort them in each stream component. */
1125.     for(i = 0; i < nb_index_entries; i++) {
1126.         tag = avio_rl32(pb);
                    ^
1127.         flags = avio_rl32(pb);
1128.         pos = avio_rl32(pb);

libavformat/aviobuf.c:625:11: Call
  623. {
  624.     unsigned int val;
  625.     val = avio_rl16(s);
                 ^
  626.     val |= avio_rl16(s) << 16;
  627.     return val;

libavformat/aviobuf.c:609:11: Call
    607. {
    608.     unsigned int val;
    609.     val = avio_r8(s);
                   ^
    610.     val |= avio_r8(s) << 8;
    611.     return val;

libavformat/aviobuf.c:524:5: Assignment
      522.     if (s->buf_ptr < s->buf_end)
      523.         return *s->buf_ptr++;
      524.     return 0;
               ^
      525. }
      526. 

libavformat/aviobuf.c:609:5: Assignment
    607. {
    608.     unsigned int val;
    609.     val = avio_r8(s);
             ^
    610.     val |= avio_r8(s) << 8;
    611.     return val;

libavformat/aviobuf.c:610:5: Assignment
    608.     unsigned int val;
    609.     val = avio_r8(s);
    610.     val |= avio_r8(s) << 8;
             ^
    611.     return val;
    612. }

libavformat/aviobuf.c:611:5: Assignment
    609.     val = avio_r8(s);
    610.     val |= avio_r8(s) << 8;
    611.     return val;
             ^
    612. }
    613. 

libavformat/aviobuf.c:625:5: Assignment
  623. {
  624.     unsigned int val;
  625.     val = avio_rl16(s);
           ^
  626.     val |= avio_rl16(s) << 16;
  627.     return val;

libavformat/aviobuf.c:626:5: Assignment
  624.     unsigned int val;
  625.     val = avio_rl16(s);
  626.     val |= avio_rl16(s) << 16;
           ^
  627.     return val;
  628. }

libavformat/aviobuf.c:627:5: Assignment
  625.     val = avio_rl16(s);
  626.     val |= avio_rl16(s) << 16;
  627.     return val;
           ^
  628. }
  629. 

libavformat/avidec.c:1126:9: Assignment
1124.     /* Read the entries and sort them in each stream component. */
1125.     for(i = 0; i < nb_index_entries; i++) {
1126.         tag = avio_rl32(pb);
              ^
1127.         flags = avio_rl32(pb);
1128.         pos = avio_rl32(pb);

libavformat/avidec.c:1138:9: Binary operation: ([0, 255] - 48):unsigned32
1136.         pos += avi->movi_list;
1137. 
1138.         index = ((tag & 0xff) - '0') * 10;
              ^
1139.         index += ((tag >> 8) & 0xff) - '0';
1140.         if (index >= s->nb_streams)

static int avi_read_idx1(AVFormatContext *s, int size)
{
    AVIContext *avi = s->priv_data;
    AVIOContext *pb = s->pb;
    int nb_index_entries, i;
    AVStream *st;
    AVIStream *ast;
    unsigned int index, tag, flags, pos, len;
    unsigned last_pos= -1;
    nb_index_entries = size / 16;
    if (nb_index_entries <= 0)
        return -1;
    for(i = 0; i < nb_index_entries; i++) {
        tag = avio_rl32(pb);
        flags = avio_rl32(pb);
        pos = avio_rl32(pb);
        len = avio_rl32(pb);
#if defined(DEBUG_SEEK)
        av_log(s, AV_LOG_DEBUG, "%d: tag=0x%x flags=0x%x pos=0x%x len=%d/",
               i, tag, flags, pos, len);
#endif
        if(i==0 && pos > avi->movi_list)
            avi->movi_list= 0;
        pos += avi->movi_list;
        index = ((tag & 0xff) - '0') * 10;
        index += ((tag >> 8) & 0xff) - '0';
        if (index >= s->nb_streams)
            continue;
        st = s->streams[index];
        ast = st->priv_data;
#if defined(DEBUG_SEEK)
        av_log(s, AV_LOG_DEBUG, "%d cum_len=%"PRId64"\n", len, ast->cum_len);
#endif
        if(url_feof(pb))
            return -1;
        if(last_pos == pos)
            avi->non_interleaved= 1;
        else if(len || !ast->sample_size)
            av_add_index_entry(st, pos, ast->cum_len, len, 0, (flags&AVIIF_INDEX) ? AVINDEX_KEYFRAME : 0);
        ast->cum_len += get_duration(ast, len);
        last_pos= pos;
    }
    return 0;
}
['static int avi_read_idx1(AVFormatContext *s, int size)\n{\n    AVIContext *avi = s->priv_data;\n    AVIOContext *pb = s->pb;\n    int nb_index_entries, i;\n    AVStream *st;\n    AVIStream *ast;\n    unsigned int index, tag, flags, pos, len;\n    unsigned last_pos= -1;\n    nb_index_entries = size / 16;\n    if (nb_index_entries <= 0)\n        return -1;\n    for(i = 0; i < nb_index_entries; i++) {\n        tag = avio_rl32(pb);\n        flags = avio_rl32(pb);\n        pos = avio_rl32(pb);\n        len = avio_rl32(pb);\n#if defined(DEBUG_SEEK)\n        av_log(s, AV_LOG_DEBUG, "%d: tag=0x%x flags=0x%x pos=0x%x len=%d/",\n               i, tag, flags, pos, len);\n#endif\n        if(i==0 && pos > avi->movi_list)\n            avi->movi_list= 0;\n        pos += avi->movi_list;\n        index = ((tag & 0xff) - \'0\') * 10;\n        index += ((tag >> 8) & 0xff) - \'0\';\n        if (index >= s->nb_streams)\n            continue;\n        st = s->streams[index];\n        ast = st->priv_data;\n#if defined(DEBUG_SEEK)\n        av_log(s, AV_LOG_DEBUG, "%d cum_len=%"PRId64"\\n", len, ast->cum_len);\n#endif\n        if(url_feof(pb))\n            return -1;\n        if(last_pos == pos)\n            avi->non_interleaved= 1;\n        else if(len || !ast->sample_size)\n            av_add_index_entry(st, pos, ast->cum_len, len, 0, (flags&AVIIF_INDEX) ? AVINDEX_KEYFRAME : 0);\n        ast->cum_len += get_duration(ast, len);\n        last_pos= pos;\n    }\n    return 0;\n}', 'unsigned int avio_rl32(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_rl16(s);\n    val |= avio_rl16(s) << 16;\n    return val;\n}', 'unsigned int avio_rl16(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_r8(s);\n    val |= avio_r8(s) << 8;\n    return val;\n}', 'int avio_r8(AVIOContext *s)\n{\n    if (s->buf_ptr >= s->buf_end)\n        fill_buffer(s);\n    if (s->buf_ptr < s->buf_end)\n        return *s->buf_ptr++;\n    return 0;\n}']