libavcodec/webp.c:1159: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `decode_entropy_coded_image`.

libavcodec/webp.c:1086:11: Call
1084.     }
1085. 
1086.     ret = bitstream_init(&s->bc, data_start, data_size * 8);
                ^
1087.     if (ret < 0)
1088.         return ret;

libavcodec/bitstream.h:85:9: Assignment
  83.         bc->buffer    =
  84.         bc->ptr       = NULL;
  85.         bc->bits_left = 0;
              ^
  86.         return AVERROR_INVALIDDATA;
  87.     }

libavcodec/webp.c:1130:12: Call
1128.     s->reduced_width = 0;
1129.     used = 0;
1130.     while (bitstream_read_bit(&s->bc)) {
                 ^
1131.         enum TransformType transform = bitstream_read(&s->bc, 2);
1132.         s->transforms[s->nb_transforms++] = transform;

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
  143. 
  144. /* Return one bit from the buffer. */
  145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
       ^
  146. {
  147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
  148.         refill_64(bc);
  149. 
  150.     return get_val(bc, 1);
                  ^
  151. }
  152. 

libavcodec/bitstream.h:130:1: Parameter `n`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Assignment
    137.     bc->bits <<= n;
    138. #endif
    139.     bc->bits_left -= n;
             ^
    140. 
    141.     return ret;

libavcodec/webp.c:1159:11: Call
1157.     if (is_alpha_chunk)
1158.         s->image[IMAGE_ROLE_ARGB].is_alpha_primary = 1;
1159.     ret = decode_entropy_coded_image(s, IMAGE_ROLE_ARGB, w, h);
                ^
1160.     if (ret < 0)
1161.         goto free_and_return;

libavcodec/webp.c:575:1: Parameter `s->bc.bits_left`
  573. }
  574. 
  575. static int decode_entropy_coded_image(WebPContext *s, enum ImageRole role,
       ^
  576.                                       int w, int h)
  577. {

libavcodec/webp.c:603:9: Call
  601.         return ret;
  602. 
  603.     if (bitstream_read_bit(&s->bc)) {
               ^
  604.         img->color_cache_bits = bitstream_read(&s->bc, 4);
  605.         if (img->color_cache_bits < 1 || img->color_cache_bits > 11) {

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
    143. 
    144. /* Return one bit from the buffer. */
    145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
         ^
    146. {
    147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
    148.         refill_64(bc);
    149. 
    150.     return get_val(bc, 1);
                    ^
    151. }
    152. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `decode_entropy_coded_image` 
      137.     bc->bits <<= n;
      138. #endif
      139.     bc->bits_left -= n;
               ^
      140. 
      141.     return ret;

static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);
    bc->bits >>= n;
#else
    uint64_t ret = bc->bits >> (64 - n);
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
    return ret;
}
['static int vp8_lossless_decode_frame(AVCodecContext *avctx, AVFrame *p,\n                                     int *got_frame, uint8_t *data_start,\n                                     unsigned int data_size, int is_alpha_chunk)\n{\n    WebPContext *s = avctx->priv_data;\n    int w, h, ret, i, used;\n    if (!is_alpha_chunk) {\n        s->lossless = 1;\n        avctx->pix_fmt = AV_PIX_FMT_ARGB;\n    }\n    ret = bitstream_init(&s->bc, data_start, data_size * 8);\n    if (ret < 0)\n        return ret;\n    if (!is_alpha_chunk) {\n        if (bitstream_read(&s->bc, 8) != 0x2F) {\n            av_log(avctx, AV_LOG_ERROR, "Invalid WebP Lossless signature\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        w = bitstream_read(&s->bc, 14) + 1;\n        h = bitstream_read(&s->bc, 14) + 1;\n        if (s->width && s->width != w) {\n            av_log(avctx, AV_LOG_WARNING, "Width mismatch. %d != %d\\n",\n                   s->width, w);\n        }\n        s->width = w;\n        if (s->height && s->height != h) {\n            av_log(avctx, AV_LOG_WARNING, "Height mismatch. %d != %d\\n",\n                   s->width, w);\n        }\n        s->height = h;\n        ret = ff_set_dimensions(avctx, s->width, s->height);\n        if (ret < 0)\n            return ret;\n        s->has_alpha = bitstream_read_bit(&s->bc);\n        if (bitstream_read(&s->bc, 3) != 0x0) {\n            av_log(avctx, AV_LOG_ERROR, "Invalid WebP Lossless version\\n");\n            return AVERROR_INVALIDDATA;\n        }\n    } else {\n        if (!s->width || !s->height)\n            return AVERROR_BUG;\n        w = s->width;\n        h = s->height;\n    }\n    s->nb_transforms = 0;\n    s->reduced_width = 0;\n    used = 0;\n    while (bitstream_read_bit(&s->bc)) {\n        enum TransformType transform = bitstream_read(&s->bc, 2);\n        s->transforms[s->nb_transforms++] = transform;\n        if (used & (1 << transform)) {\n            av_log(avctx, AV_LOG_ERROR, "Transform %d used more than once\\n",\n                   transform);\n            ret = AVERROR_INVALIDDATA;\n            goto free_and_return;\n        }\n        used |= (1 << transform);\n        switch (transform) {\n        case PREDICTOR_TRANSFORM:\n            ret = parse_transform_predictor(s);\n            break;\n        case COLOR_TRANSFORM:\n            ret = parse_transform_color(s);\n            break;\n        case COLOR_INDEXING_TRANSFORM:\n            ret = parse_transform_color_indexing(s);\n            break;\n        }\n        if (ret < 0)\n            goto free_and_return;\n    }\n    s->image[IMAGE_ROLE_ARGB].frame = p;\n    if (is_alpha_chunk)\n        s->image[IMAGE_ROLE_ARGB].is_alpha_primary = 1;\n    ret = decode_entropy_coded_image(s, IMAGE_ROLE_ARGB, w, h);\n    if (ret < 0)\n        goto free_and_return;\n    for (i = s->nb_transforms - 1; i >= 0; i--) {\n        switch (s->transforms[i]) {\n        case PREDICTOR_TRANSFORM:\n            ret = apply_predictor_transform(s);\n            break;\n        case COLOR_TRANSFORM:\n            ret = apply_color_transform(s);\n            break;\n        case SUBTRACT_GREEN:\n            ret = apply_subtract_green_transform(s);\n            break;\n        case COLOR_INDEXING_TRANSFORM:\n            ret = apply_color_indexing_transform(s);\n            break;\n        }\n        if (ret < 0)\n            goto free_and_return;\n    }\n    *got_frame   = 1;\n    p->pict_type = AV_PICTURE_TYPE_I;\n    p->key_frame = 1;\n    ret          = data_size;\nfree_and_return:\n    for (i = 0; i < IMAGE_ROLE_NB; i++)\n        image_ctx_free(&s->image[i]);\n    return ret;\n}', 'static inline int bitstream_init(BitstreamContext *bc, const uint8_t *buffer,\n                                 unsigned bit_size)\n{\n    unsigned buffer_size;\n    if (bit_size > INT_MAX - 7 || !buffer) {\n        buffer        =\n        bc->buffer    =\n        bc->ptr       = NULL;\n        bc->bits_left = 0;\n        return AVERROR_INVALIDDATA;\n    }\n    buffer_size = (bit_size + 7) >> 3;\n    bc->buffer       = buffer;\n    bc->buffer_end   = buffer + buffer_size;\n    bc->ptr          = bc->buffer;\n    bc->size_in_bits = bit_size;\n    bc->bits_left    = 0;\n    bc->bits         = 0;\n    refill_64(bc);\n    return 0;\n}', 'static inline unsigned bitstream_read_bit(BitstreamContext *bc)\n{\n    if (!bc->bits_left)\n        refill_64(bc);\n    return get_val(bc, 1);\n}', 'static inline uint64_t get_val(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);\n    bc->bits >>= n;\n#else\n    uint64_t ret = bc->bits >> (64 - n);\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n    return ret;\n}', 'static int decode_entropy_coded_image(WebPContext *s, enum ImageRole role,\n                                      int w, int h)\n{\n    ImageContext *img;\n    HuffReader *hg;\n    int i, j, ret, x, y, width;\n    img       = &s->image[role];\n    img->role = role;\n    if (!img->frame) {\n        img->frame = av_frame_alloc();\n        if (!img->frame)\n            return AVERROR(ENOMEM);\n    }\n    img->frame->format = AV_PIX_FMT_ARGB;\n    img->frame->width  = w;\n    img->frame->height = h;\n    if (role == IMAGE_ROLE_ARGB && !img->is_alpha_primary) {\n        ThreadFrame pt = { .f = img->frame };\n        ret = ff_thread_get_buffer(s->avctx, &pt, 0);\n    } else\n        ret = av_frame_get_buffer(img->frame, 1);\n    if (ret < 0)\n        return ret;\n    if (bitstream_read_bit(&s->bc)) {\n        img->color_cache_bits = bitstream_read(&s->bc, 4);\n        if (img->color_cache_bits < 1 || img->color_cache_bits > 11) {\n            av_log(s->avctx, AV_LOG_ERROR, "invalid color cache bits: %d\\n",\n                   img->color_cache_bits);\n            return AVERROR_INVALIDDATA;\n        }\n        img->color_cache = av_mallocz_array(1 << img->color_cache_bits,\n                                            sizeof(*img->color_cache));\n        if (!img->color_cache)\n            return AVERROR(ENOMEM);\n    } else {\n        img->color_cache_bits = 0;\n    }\n    img->nb_huffman_groups = 1;\n    if (role == IMAGE_ROLE_ARGB && bitstream_read_bit(&s->bc)) {\n        ret = decode_entropy_image(s);\n        if (ret < 0)\n            return ret;\n        img->nb_huffman_groups = s->nb_huffman_groups;\n    }\n    img->huffman_groups = av_mallocz_array(img->nb_huffman_groups *\n                                           HUFFMAN_CODES_PER_META_CODE,\n                                           sizeof(*img->huffman_groups));\n    if (!img->huffman_groups)\n        return AVERROR(ENOMEM);\n    for (i = 0; i < img->nb_huffman_groups; i++) {\n        hg = &img->huffman_groups[i * HUFFMAN_CODES_PER_META_CODE];\n        for (j = 0; j < HUFFMAN_CODES_PER_META_CODE; j++) {\n            int alphabet_size = alphabet_sizes[j];\n            if (!j && img->color_cache_bits > 0)\n                alphabet_size += 1 << img->color_cache_bits;\n            if (bitstream_read_bit(&s->bc)) {\n                read_huffman_code_simple(s, &hg[j]);\n            } else {\n                ret = read_huffman_code_normal(s, &hg[j], alphabet_size);\n                if (ret < 0)\n                    return ret;\n            }\n        }\n    }\n    width = img->frame->width;\n    if (role == IMAGE_ROLE_ARGB && s->reduced_width > 0)\n        width = s->reduced_width;\n    x = 0; y = 0;\n    while (y < img->frame->height) {\n        int v;\n        hg = get_huffman_group(s, img, x, y);\n        v = huff_reader_get_symbol(&hg[HUFF_IDX_GREEN], &s->bc);\n        if (v < NUM_LITERAL_CODES) {\n            uint8_t *p = GET_PIXEL(img->frame, x, y);\n            p[2] = v;\n            p[1] = huff_reader_get_symbol(&hg[HUFF_IDX_RED],   &s->bc);\n            p[3] = huff_reader_get_symbol(&hg[HUFF_IDX_BLUE],  &s->bc);\n            p[0] = huff_reader_get_symbol(&hg[HUFF_IDX_ALPHA], &s->bc);\n            if (img->color_cache_bits)\n                color_cache_put(img, AV_RB32(p));\n            x++;\n            if (x == width) {\n                x = 0;\n                y++;\n            }\n        } else if (v < NUM_LITERAL_CODES + NUM_LENGTH_CODES) {\n            int prefix_code, length, distance, ref_x, ref_y;\n            prefix_code = v - NUM_LITERAL_CODES;\n            if (prefix_code < 4) {\n                length = prefix_code + 1;\n            } else {\n                int extra_bits = (prefix_code - 2) >> 1;\n                int offset     = 2 + (prefix_code & 1) << extra_bits;\n                length = offset + bitstream_read(&s->bc, extra_bits) + 1;\n            }\n            prefix_code = huff_reader_get_symbol(&hg[HUFF_IDX_DIST], &s->bc);\n            if (prefix_code > 39) {\n                av_log(s->avctx, AV_LOG_ERROR,\n                       "distance prefix code too large: %d\\n", prefix_code);\n                return AVERROR_INVALIDDATA;\n            }\n            if (prefix_code < 4) {\n                distance = prefix_code + 1;\n            } else {\n                int extra_bits = prefix_code - 2 >> 1;\n                int offset     = 2 + (prefix_code & 1) << extra_bits;\n                distance = offset + bitstream_read(&s->bc, extra_bits) + 1;\n            }\n            if (distance <= NUM_SHORT_DISTANCES) {\n                int xi = lz77_distance_offsets[distance - 1][0];\n                int yi = lz77_distance_offsets[distance - 1][1];\n                distance = FFMAX(1, xi + yi * width);\n            } else {\n                distance -= NUM_SHORT_DISTANCES;\n            }\n            ref_x = x;\n            ref_y = y;\n            if (distance <= x) {\n                ref_x -= distance;\n                distance = 0;\n            } else {\n                ref_x = 0;\n                distance -= x;\n            }\n            while (distance >= width) {\n                ref_y--;\n                distance -= width;\n            }\n            if (distance > 0) {\n                ref_x = width - distance;\n                ref_y--;\n            }\n            ref_x = FFMAX(0, ref_x);\n            ref_y = FFMAX(0, ref_y);\n            for (i = 0; i < length; i++) {\n                uint8_t *p_ref = GET_PIXEL(img->frame, ref_x, ref_y);\n                uint8_t *p     = GET_PIXEL(img->frame,     x,     y);\n                AV_COPY32(p, p_ref);\n                if (img->color_cache_bits)\n                    color_cache_put(img, AV_RB32(p));\n                x++;\n                ref_x++;\n                if (x == width) {\n                    x = 0;\n                    y++;\n                }\n                if (ref_x == width) {\n                    ref_x = 0;\n                    ref_y++;\n                }\n                if (y == img->frame->height || ref_y == img->frame->height)\n                    break;\n            }\n        } else {\n            uint8_t *p = GET_PIXEL(img->frame, x, y);\n            int cache_idx = v - (NUM_LITERAL_CODES + NUM_LENGTH_CODES);\n            if (!img->color_cache_bits) {\n                av_log(s->avctx, AV_LOG_ERROR, "color cache not found\\n");\n                return AVERROR_INVALIDDATA;\n            }\n            if (cache_idx >= 1 << img->color_cache_bits) {\n                av_log(s->avctx, AV_LOG_ERROR,\n                       "color cache index out-of-bounds\\n");\n                return AVERROR_INVALIDDATA;\n            }\n            AV_WB32(p, img->color_cache[cache_idx]);\n            x++;\n            if (x == width) {\n                x = 0;\n                y++;\n            }\n        }\n    }\n    return 0;\n}']