libavcodec/tscc2.c:297: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32.

libavcodec/tscc2.c:320:15: <LHS trace>
318.             return AVERROR_INVALIDDATA;
319.         }
320.         ret = tscc2_decode_slice(c, i, buf + bytestream2_tell(&gb), size);
                   ^
321.         if (ret) {
322.             av_log(avctx, AV_LOG_ERROR, "Error decoding slice %d\n", i);

libavcodec/tscc2.c:320:15: Call
318.             return AVERROR_INVALIDDATA;
319.         }
320.         ret = tscc2_decode_slice(c, i, buf + bytestream2_tell(&gb), size);
                   ^
321.         if (ret) {
322.             av_log(avctx, AV_LOG_ERROR, "Error decoding slice %d\n", i);

libavcodec/tscc2.c:192:1: Parameter `*c->bc.ptr`
  190. }
  191. 
  192. static int tscc2_decode_slice(TSCC2Context *c, int mb_y,
       ^
  193.                               const uint8_t *buf, int buf_size)
  194. {

libavcodec/tscc2.c:295:16: Call
293. 
294.     for (i = 0; i < c->mb_height; i++) {
295.         size = bytestream2_peek_byte(&gb);
                    ^
296.         if (size & 1) {
297.             size = bytestream2_get_byte(&gb) - 1;

libavcodec/bytestream.h:94:1: Parameter `*g->buffer`
  92. DEF(unsigned int, be24, 3, AV_RB24, AV_WB24)
  93. DEF(unsigned int, be16, 2, AV_RB16, AV_WB16)
  94. DEF(unsigned int, byte, 1, AV_RB8 , AV_WB8)
      ^
  95. 
  96. #if HAVE_BIGENDIAN

libavcodec/tscc2.c:297:20: Call
295.         size = bytestream2_peek_byte(&gb);
296.         if (size & 1) {
297.             size = bytestream2_get_byte(&gb) - 1;
                        ^
298.         } else {
299.             size = bytestream2_get_le32(&gb) >> 1;

libavcodec/bytestream.h:94:1: Assignment
  92. DEF(unsigned int, be24, 3, AV_RB24, AV_WB24)
  93. DEF(unsigned int, be16, 2, AV_RB16, AV_WB16)
  94. DEF(unsigned int, byte, 1, AV_RB8 , AV_WB8)
      ^
  95. 
  96. #if HAVE_BIGENDIAN

libavcodec/tscc2.c:297:13: Binary operation: ([0, +oo] - 1):unsigned32
295.         size = bytestream2_peek_byte(&gb);
296.         if (size & 1) {
297.             size = bytestream2_get_byte(&gb) - 1;
                 ^
298.         } else {
299.             size = bytestream2_get_le32(&gb) >> 1;

static int tscc2_decode_frame(AVCodecContext *avctx, void *data,
                              int *got_frame, AVPacket *avpkt)
{
    const uint8_t *buf = avpkt->data;
    int buf_size = avpkt->size;
    TSCC2Context *c = avctx->priv_data;
    GetByteContext gb;
    uint32_t frame_type, size;
    int i, val, len, pos = 0;
    int num_mb = c->mb_width * c->mb_height;
    int ret;
    bytestream2_init(&gb, buf, buf_size);
    frame_type = bytestream2_get_byte(&gb);
    if (frame_type > 1) {
        av_log(avctx, AV_LOG_ERROR, "Incorrect frame type %"PRIu32"\n",
               frame_type);
        return AVERROR_INVALIDDATA;
    }
    if ((ret = ff_reget_buffer(avctx, c->pic)) < 0) {
        av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n");
        return ret;
    }
    if (frame_type == 0) {
        *got_frame      = 1;
        if ((ret = av_frame_ref(data, c->pic)) < 0)
            return ret;
        return buf_size;
    }
    if (bytestream2_get_bytes_left(&gb) < 4) {
        av_log(avctx, AV_LOG_ERROR, "Frame is too short\n");
        return AVERROR_INVALIDDATA;
    }
    c->quant[0] = bytestream2_get_byte(&gb);
    c->quant[1] = bytestream2_get_byte(&gb);
    if (c->quant[0] < 2 || c->quant[0] > NUM_VLC_SETS + 1 ||
        c->quant[1] < 2 || c->quant[1] > NUM_VLC_SETS + 1) {
        av_log(avctx, AV_LOG_ERROR, "Invalid quantisers %d / %d\n",
               c->quant[0], c->quant[1]);
        return AVERROR_INVALIDDATA;
    }
    for (i = 0; i < 3; i++) {
        c->q[0][i] = tscc2_quants[c->quant[0] - 2][i];
        c->q[1][i] = tscc2_quants[c->quant[1] - 2][i];
    }
    bytestream2_skip(&gb, 1);
    size = bytestream2_get_le32(&gb);
    if (size > bytestream2_get_bytes_left(&gb)) {
        av_log(avctx, AV_LOG_ERROR, "Slice properties chunk is too large\n");
        return AVERROR_INVALIDDATA;
    }
    for (i = 0; i < size; i++) {
        val   = bytestream2_get_byte(&gb);
        len   = val & 0x3F;
        val >>= 6;
        if (pos + len > num_mb) {
            av_log(avctx, AV_LOG_ERROR, "Too many slice properties\n");
            return AVERROR_INVALIDDATA;
        }
        memset(c->slice_quants + pos, val, len);
        pos += len;
    }
    if (pos < num_mb) {
        av_log(avctx, AV_LOG_ERROR, "Too few slice properties (%d / %d)\n",
               pos, num_mb);
        return AVERROR_INVALIDDATA;
    }
    for (i = 0; i < c->mb_height; i++) {
        size = bytestream2_peek_byte(&gb);
        if (size & 1) {
            size = bytestream2_get_byte(&gb) - 1;
        } else {
            size = bytestream2_get_le32(&gb) >> 1;
        }
        if (!size) {
            int skip_row = 1, j, off = i * c->mb_width;
            for (j = 0; j < c->mb_width; j++) {
                if (c->slice_quants[off + j] == 1 ||
                    c->slice_quants[off + j] == 2) {
                    skip_row = 0;
                    break;
                }
            }
            if (!skip_row) {
                av_log(avctx, AV_LOG_ERROR, "Non-skip row with zero size\n");
                return AVERROR_INVALIDDATA;
            }
        }
        if (bytestream2_get_bytes_left(&gb) < size) {
            av_log(avctx, AV_LOG_ERROR, "Invalid slice size (%"PRIu32"/%u)\n",
                   size, bytestream2_get_bytes_left(&gb));
            return AVERROR_INVALIDDATA;
        }
        ret = tscc2_decode_slice(c, i, buf + bytestream2_tell(&gb), size);
        if (ret) {
            av_log(avctx, AV_LOG_ERROR, "Error decoding slice %d\n", i);
            return ret;
        }
        bytestream2_skip(&gb, size);
    }
    *got_frame      = 1;
    if ((ret = av_frame_ref(data, c->pic)) < 0)
        return ret;
    return buf_size;
}
['static int tscc2_decode_frame(AVCodecContext *avctx, void *data,\n                              int *got_frame, AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    TSCC2Context *c = avctx->priv_data;\n    GetByteContext gb;\n    uint32_t frame_type, size;\n    int i, val, len, pos = 0;\n    int num_mb = c->mb_width * c->mb_height;\n    int ret;\n    bytestream2_init(&gb, buf, buf_size);\n    frame_type = bytestream2_get_byte(&gb);\n    if (frame_type > 1) {\n        av_log(avctx, AV_LOG_ERROR, "Incorrect frame type %"PRIu32"\\n",\n               frame_type);\n        return AVERROR_INVALIDDATA;\n    }\n    if ((ret = ff_reget_buffer(avctx, c->pic)) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\\n");\n        return ret;\n    }\n    if (frame_type == 0) {\n        *got_frame      = 1;\n        if ((ret = av_frame_ref(data, c->pic)) < 0)\n            return ret;\n        return buf_size;\n    }\n    if (bytestream2_get_bytes_left(&gb) < 4) {\n        av_log(avctx, AV_LOG_ERROR, "Frame is too short\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    c->quant[0] = bytestream2_get_byte(&gb);\n    c->quant[1] = bytestream2_get_byte(&gb);\n    if (c->quant[0] < 2 || c->quant[0] > NUM_VLC_SETS + 1 ||\n        c->quant[1] < 2 || c->quant[1] > NUM_VLC_SETS + 1) {\n        av_log(avctx, AV_LOG_ERROR, "Invalid quantisers %d / %d\\n",\n               c->quant[0], c->quant[1]);\n        return AVERROR_INVALIDDATA;\n    }\n    for (i = 0; i < 3; i++) {\n        c->q[0][i] = tscc2_quants[c->quant[0] - 2][i];\n        c->q[1][i] = tscc2_quants[c->quant[1] - 2][i];\n    }\n    bytestream2_skip(&gb, 1);\n    size = bytestream2_get_le32(&gb);\n    if (size > bytestream2_get_bytes_left(&gb)) {\n        av_log(avctx, AV_LOG_ERROR, "Slice properties chunk is too large\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    for (i = 0; i < size; i++) {\n        val   = bytestream2_get_byte(&gb);\n        len   = val & 0x3F;\n        val >>= 6;\n        if (pos + len > num_mb) {\n            av_log(avctx, AV_LOG_ERROR, "Too many slice properties\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        memset(c->slice_quants + pos, val, len);\n        pos += len;\n    }\n    if (pos < num_mb) {\n        av_log(avctx, AV_LOG_ERROR, "Too few slice properties (%d / %d)\\n",\n               pos, num_mb);\n        return AVERROR_INVALIDDATA;\n    }\n    for (i = 0; i < c->mb_height; i++) {\n        size = bytestream2_peek_byte(&gb);\n        if (size & 1) {\n            size = bytestream2_get_byte(&gb) - 1;\n        } else {\n            size = bytestream2_get_le32(&gb) >> 1;\n        }\n        if (!size) {\n            int skip_row = 1, j, off = i * c->mb_width;\n            for (j = 0; j < c->mb_width; j++) {\n                if (c->slice_quants[off + j] == 1 ||\n                    c->slice_quants[off + j] == 2) {\n                    skip_row = 0;\n                    break;\n                }\n            }\n            if (!skip_row) {\n                av_log(avctx, AV_LOG_ERROR, "Non-skip row with zero size\\n");\n                return AVERROR_INVALIDDATA;\n            }\n        }\n        if (bytestream2_get_bytes_left(&gb) < size) {\n            av_log(avctx, AV_LOG_ERROR, "Invalid slice size (%"PRIu32"/%u)\\n",\n                   size, bytestream2_get_bytes_left(&gb));\n            return AVERROR_INVALIDDATA;\n        }\n        ret = tscc2_decode_slice(c, i, buf + bytestream2_tell(&gb), size);\n        if (ret) {\n            av_log(avctx, AV_LOG_ERROR, "Error decoding slice %d\\n", i);\n            return ret;\n        }\n        bytestream2_skip(&gb, size);\n    }\n    *got_frame      = 1;\n    if ((ret = av_frame_ref(data, c->pic)) < 0)\n        return ret;\n    return buf_size;\n}', 'static int tscc2_decode_slice(TSCC2Context *c, int mb_y,\n                              const uint8_t *buf, int buf_size)\n{\n    int i, mb_x, q, ret;\n    int off;\n    bitstream_init8(&c->bc, buf, buf_size);\n    for (mb_x = 0; mb_x < c->mb_width; mb_x++) {\n        q = c->slice_quants[mb_x + c->mb_width * mb_y];\n        if (q == 0 || q == 3)\n            continue;\n        for (i = 0; i < 3; i++) {\n            off = mb_x * 16 + mb_y * 8 * c->pic->linesize[i];\n            ret = tscc2_decode_mb(c, c->q[q - 1], c->quant[q - 1] - 2,\n                                  c->pic->data[i] + off, c->pic->linesize[i], i);\n            if (ret)\n                return ret;\n        }\n    }\n    return 0;\n}', 'DEF(unsigned int, byte, 1, AV_RB8 , AV_WB8)']