libavcodec/wmaprodec.c:1147: error: Integer Overflow L2
  ([1, +oo] - 2):unsigned32 by call to `bitstream_read`.

libavcodec/wmaprodec.c:1147:31: Call
1145.     if (bitstream_read_bit(&s->bc)) {
1146.         int num_fill_bits;
1147.         if (!(num_fill_bits = bitstream_read(&s->bc, 2))) {
                                    ^
1148.             int len       = bitstream_read(&s->bc, 4);
1149.             num_fill_bits = bitstream_read(&s->bc, len) + 1;

libavcodec/bitstream.h:183:1: Parameter `n`
  181. 
  182. /* Return n bits from the buffer. n has to be in the 0-32 range. */
  183. static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)
       ^
  184. {
  185.     if (!n)

libavcodec/bitstream.h:194:12: Call
  192.     }
  193. 
  194.     return get_val(bc, n);
                  ^
  195. }
  196. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([1, +oo] - 2):unsigned32 by call to `bitstream_read` 
    137.     bc->bits <<= n;
    138. #endif
    139.     bc->bits_left -= n;
             ^
    140. 
    141.     return ret;

static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);
    bc->bits >>= n;
#else
    uint64_t ret = bc->bits >> (64 - n);
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
    return ret;
}
['static int decode_subframe(WMAProDecodeCtx *s)\n{\n    int offset = s->samples_per_frame;\n    int subframe_len = s->samples_per_frame;\n    int i;\n    int total_samples   = s->samples_per_frame * s->avctx->channels;\n    int transmit_coeffs = 0;\n    int cur_subwoofer_cutoff;\n    s->subframe_offset = bitstream_tell(&s->bc);\n    for (i = 0; i < s->avctx->channels; i++) {\n        s->channel[i].grouped = 0;\n        if (offset > s->channel[i].decoded_samples) {\n            offset = s->channel[i].decoded_samples;\n            subframe_len =\n                s->channel[i].subframe_len[s->channel[i].cur_subframe];\n        }\n    }\n    ff_dlog(s->avctx,\n            "processing subframe with offset %i len %i\\n", offset, subframe_len);\n    s->channels_for_cur_subframe = 0;\n    for (i = 0; i < s->avctx->channels; i++) {\n        const int cur_subframe = s->channel[i].cur_subframe;\n        total_samples -= s->channel[i].decoded_samples;\n        if (offset == s->channel[i].decoded_samples &&\n            subframe_len == s->channel[i].subframe_len[cur_subframe]) {\n            total_samples -= s->channel[i].subframe_len[cur_subframe];\n            s->channel[i].decoded_samples +=\n                s->channel[i].subframe_len[cur_subframe];\n            s->channel_indexes_for_cur_subframe[s->channels_for_cur_subframe] = i;\n            ++s->channels_for_cur_subframe;\n        }\n    }\n    if (!total_samples)\n        s->parsed_all_subframes = 1;\n    ff_dlog(s->avctx, "subframe is part of %i channels\\n",\n            s->channels_for_cur_subframe);\n    s->table_idx         = av_log2(s->samples_per_frame/subframe_len);\n    s->num_bands         = s->num_sfb[s->table_idx];\n    s->cur_sfb_offsets   = s->sfb_offsets[s->table_idx];\n    cur_subwoofer_cutoff = s->subwoofer_cutoffs[s->table_idx];\n    offset += s->samples_per_frame >> 1;\n    for (i = 0; i < s->channels_for_cur_subframe; i++) {\n        int c = s->channel_indexes_for_cur_subframe[i];\n        s->channel[c].coeffs = &s->channel[c].out[offset];\n    }\n    s->subframe_len = subframe_len;\n    s->esc_len = av_log2(s->subframe_len - 1) + 1;\n    if (bitstream_read_bit(&s->bc)) {\n        int num_fill_bits;\n        if (!(num_fill_bits = bitstream_read(&s->bc, 2))) {\n            int len       = bitstream_read(&s->bc, 4);\n            num_fill_bits = bitstream_read(&s->bc, len) + 1;\n        }\n        if (num_fill_bits >= 0) {\n            if (bitstream_tell(&s->bc) + num_fill_bits > s->num_saved_bits) {\n                av_log(s->avctx, AV_LOG_ERROR, "invalid number of fill bits\\n");\n                return AVERROR_INVALIDDATA;\n            }\n            bitstream_skip(&s->bc, num_fill_bits);\n        }\n    }\n    if (bitstream_read_bit(&s->bc)) {\n        avpriv_request_sample(s->avctx, "Reserved bit");\n        return AVERROR_PATCHWELCOME;\n    }\n    if (decode_channel_transform(s) < 0)\n        return AVERROR_INVALIDDATA;\n    for (i = 0; i < s->channels_for_cur_subframe; i++) {\n        int c = s->channel_indexes_for_cur_subframe[i];\n        if ((s->channel[c].transmit_coefs = bitstream_read_bit(&s->bc)))\n            transmit_coeffs = 1;\n    }\n    if (transmit_coeffs) {\n        int step;\n        int quant_step = 90 * s->bits_per_sample >> 4;\n        if ((s->transmit_num_vec_coeffs = bitstream_read_bit(&s->bc))) {\n            int num_bits = av_log2((s->subframe_len + 3)/4) + 1;\n            for (i = 0; i < s->channels_for_cur_subframe; i++) {\n                int c = s->channel_indexes_for_cur_subframe[i];\n                int num_vec_coeffs = bitstream_read(&s->bc, num_bits) << 2;\n                if (num_vec_coeffs + offset > FF_ARRAY_ELEMS(s->channel[c].out)) {\n                    av_log(s->avctx, AV_LOG_ERROR, "num_vec_coeffs %d is too large\\n", num_vec_coeffs);\n                    return AVERROR_INVALIDDATA;\n                }\n                s->channel[c].num_vec_coeffs = num_vec_coeffs;\n            }\n        } else {\n            for (i = 0; i < s->channels_for_cur_subframe; i++) {\n                int c = s->channel_indexes_for_cur_subframe[i];\n                s->channel[c].num_vec_coeffs = s->subframe_len;\n            }\n        }\n        step = bitstream_read_signed(&s->bc, 6);\n        quant_step += step;\n        if (step == -32 || step == 31) {\n            const int sign = (step == 31) - 1;\n            int quant = 0;\n            while (bitstream_tell(&s->bc) + 5 < s->num_saved_bits &&\n                   (step = bitstream_read(&s->bc, 5)) == 31) {\n                quant += 31;\n            }\n            quant_step += ((quant + step) ^ sign) - sign;\n        }\n        if (quant_step < 0) {\n            av_log(s->avctx, AV_LOG_DEBUG, "negative quant step\\n");\n        }\n        if (s->channels_for_cur_subframe == 1) {\n            s->channel[s->channel_indexes_for_cur_subframe[0]].quant_step = quant_step;\n        } else {\n            int modifier_len = bitstream_read(&s->bc, 3);\n            for (i = 0; i < s->channels_for_cur_subframe; i++) {\n                int c = s->channel_indexes_for_cur_subframe[i];\n                s->channel[c].quant_step = quant_step;\n                if (bitstream_read_bit(&s->bc)) {\n                    if (modifier_len) {\n                        s->channel[c].quant_step += bitstream_read(&s->bc, modifier_len) + 1;\n                    } else\n                        ++s->channel[c].quant_step;\n                }\n            }\n        }\n        if (decode_scale_factors(s) < 0)\n            return AVERROR_INVALIDDATA;\n    }\n    ff_dlog(s->avctx, "BITSTREAM: subframe header length was %i\\n",\n            bitstream_tell(&s->bc) - s->subframe_offset);\n    for (i = 0; i < s->channels_for_cur_subframe; i++) {\n        int c = s->channel_indexes_for_cur_subframe[i];\n        if (s->channel[c].transmit_coefs &&\n            bitstream_tell(&s->bc) < s->num_saved_bits) {\n            decode_coeffs(s, c);\n        } else\n            memset(s->channel[c].coeffs, 0,\n                   sizeof(*s->channel[c].coeffs) * subframe_len);\n    }\n    ff_dlog(s->avctx, "BITSTREAM: subframe length was %i\\n",\n            bitstream_tell(&s->bc) - s->subframe_offset);\n    if (transmit_coeffs) {\n        FFTContext *mdct = &s->mdct_ctx[av_log2(subframe_len) - WMAPRO_BLOCK_MIN_BITS];\n        inverse_channel_transform(s);\n        for (i = 0; i < s->channels_for_cur_subframe; i++) {\n            int c = s->channel_indexes_for_cur_subframe[i];\n            const int* sf = s->channel[c].scale_factors;\n            int b;\n            if (c == s->lfe_channel)\n                memset(&s->tmp[cur_subwoofer_cutoff], 0, sizeof(*s->tmp) *\n                       (subframe_len - cur_subwoofer_cutoff));\n            for (b = 0; b < s->num_bands; b++) {\n                const int end = FFMIN(s->cur_sfb_offsets[b+1], s->subframe_len);\n                const int exp = s->channel[c].quant_step -\n                            (s->channel[c].max_scale_factor - *sf++) *\n                            s->channel[c].scale_factor_step;\n                const float quant = pow(10.0, exp / 20.0);\n                int start = s->cur_sfb_offsets[b];\n                s->fdsp.vector_fmul_scalar(s->tmp + start,\n                                           s->channel[c].coeffs + start,\n                                           quant, end - start);\n            }\n            mdct->imdct_half(mdct, s->channel[c].coeffs, s->tmp);\n        }\n    }\n    wmapro_window(s);\n    for (i = 0; i < s->channels_for_cur_subframe; i++) {\n        int c = s->channel_indexes_for_cur_subframe[i];\n        if (s->channel[c].cur_subframe >= s->channel[c].num_subframes) {\n            av_log(s->avctx, AV_LOG_ERROR, "broken subframe\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        ++s->channel[c].cur_subframe;\n    }\n    return 0;\n}', 'static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)\n{\n    if (!n)\n        return 0;\n    if (n > bc->bits_left) {\n        refill_32(bc);\n        if (bc->bits_left < 32)\n            bc->bits_left = n;\n    }\n    return get_val(bc, n);\n}', 'static inline uint64_t get_val(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);\n    bc->bits >>= n;\n#else\n    uint64_t ret = bc->bits >> (64 - n);\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n    return ret;\n}']