libavcodec/metasound.c:181: error: Integer Overflow L2
  ([1, +oo] - 4):unsigned32 by call to `bitstream_read`.

libavcodec/metasound.c:181:29: Call
179.         bits = tctx->bits + tctx->cur_frame;
180. 
181.         bits->window_type = bitstream_read(&bc, TWINVQ_WINDOW_TYPE_BITS);
                                 ^
182. 
183.         if (bits->window_type > 8) {

libavcodec/bitstream.h:183:1: Parameter `n`
  181. 
  182. /* Return n bits from the buffer. n has to be in the 0-32 range. */
  183. static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)
       ^
  184. {
  185.     if (!n)

libavcodec/bitstream.h:194:12: Call
  192.     }
  193. 
  194.     return get_val(bc, n);
                  ^
  195. }
  196. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([1, +oo] - 4):unsigned32 by call to `bitstream_read` 
    137.     bc->bits <<= n;
    138. #endif
    139.     bc->bits_left -= n;
             ^
    140. 
    141.     return ret;

static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);
    bc->bits >>= n;
#else
    uint64_t ret = bc->bits >> (64 - n);
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
    return ret;
}
['static int metasound_read_bitstream(AVCodecContext *avctx, TwinVQContext *tctx,\n                                    const uint8_t *buf, int buf_size)\n{\n    TwinVQFrameData     *bits;\n    const TwinVQModeTab *mtab = tctx->mtab;\n    int channels              = tctx->avctx->channels;\n    int sub;\n    BitstreamContext bc;\n    int i, j, k;\n    bitstream_init(&bc, buf, buf_size * 8);\n    for (tctx->cur_frame = 0; tctx->cur_frame < tctx->frames_per_packet;\n         tctx->cur_frame++) {\n        bits = tctx->bits + tctx->cur_frame;\n        bits->window_type = bitstream_read(&bc, TWINVQ_WINDOW_TYPE_BITS);\n        if (bits->window_type > 8) {\n            av_log(avctx, AV_LOG_ERROR, "Invalid window type, broken sample?\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        bits->ftype = ff_twinvq_wtype_to_ftype_table[tctx->bits[tctx->cur_frame].window_type];\n        sub = mtab->fmode[bits->ftype].sub;\n        if (bits->ftype != TWINVQ_FT_SHORT && !tctx->is_6kbps)\n            bitstream_read(&bc, 2);\n        read_cb_data(tctx, &bc, bits->main_coeffs, bits->ftype);\n        for (i = 0; i < channels; i++)\n            for (j = 0; j < sub; j++)\n                for (k = 0; k < mtab->fmode[bits->ftype].bark_n_coef; k++)\n                    bits->bark1[i][j][k] =\n                        bitstream_read(&bc, mtab->fmode[bits->ftype].bark_n_bit);\n        for (i = 0; i < channels; i++)\n            for (j = 0; j < sub; j++)\n                bits->bark_use_hist[i][j] = bitstream_read_bit(&bc);\n        if (bits->ftype == TWINVQ_FT_LONG) {\n            for (i = 0; i < channels; i++)\n                bits->gain_bits[i] = bitstream_read(&bc, TWINVQ_GAIN_BITS);\n        } else {\n            for (i = 0; i < channels; i++) {\n                bits->gain_bits[i] = bitstream_read(&bc, TWINVQ_GAIN_BITS);\n                for (j = 0; j < sub; j++)\n                    bits->sub_gain_bits[i * sub + j] =\n                        bitstream_read(&bc, TWINVQ_SUB_GAIN_BITS);\n            }\n        }\n        for (i = 0; i < channels; i++) {\n            bits->lpc_hist_idx[i] = bitstream_read(&bc, mtab->lsp_bit0);\n            bits->lpc_idx1[i]     = bitstream_read(&bc, mtab->lsp_bit1);\n            for (j = 0; j < mtab->lsp_split; j++)\n                bits->lpc_idx2[i][j] = bitstream_read(&bc, mtab->lsp_bit2);\n        }\n        if (bits->ftype == TWINVQ_FT_LONG) {\n            read_cb_data(tctx, &bc, bits->ppc_coeffs, 3);\n            for (i = 0; i < channels; i++) {\n                bits->p_coef[i] = bitstream_read(&bc, mtab->ppc_period_bit);\n                bits->g_coef[i] = bitstream_read(&bc, mtab->pgain_bit);\n            }\n        }\n        if (bitstream_tell(&bc) & 3)\n            bitstream_skip(&bc, 4 - (bitstream_tell(&bc) & 3));\n    }\n    return 0;\n}', 'static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)\n{\n    if (!n)\n        return 0;\n    if (n > bc->bits_left) {\n        refill_32(bc);\n        if (bc->bits_left < 32)\n            bc->bits_left = n;\n    }\n    return get_val(bc, n);\n}', 'static inline uint64_t get_val(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);\n    bc->bits >>= n;\n#else\n    uint64_t ret = bc->bits >> (64 - n);\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n    return ret;\n}']