libavformat/oggparsetheora.c:112: error: Integer Overflow L1
  (0 - 8):unsigned32.

libavformat/oggparsetheora.c:51:15: <LHS trace>
49. 
50.     if(!thp){
51.         thp = av_mallocz(sizeof(*thp));
                  ^
52.         os->private = thp;
53.     }

libavformat/oggparsetheora.c:51:15: Call
49. 
50.     if(!thp){
51.         thp = av_mallocz(sizeof(*thp));
                  ^
52.         os->private = thp;
53.     }

libavutil/mem.c:159:17: Call
  157. void *av_mallocz(unsigned int size)
  158. {
  159.     void *ptr = av_malloc(size);
                       ^
  160.     if (ptr)
  161.         memset(ptr, 0, size);

libavutil/mem.c:73:9: Assignment
    71.     /* let's disallow possible ambiguous cases */
    72.     if(size > (INT_MAX-16) )
    73.         return NULL;
                ^
    74. 
    75. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:159:5: Assignment
  157. void *av_mallocz(unsigned int size)
  158. {
  159.     void *ptr = av_malloc(size);
           ^
  160.     if (ptr)
  161.         memset(ptr, 0, size);

libavutil/mem.c:162:5: Assignment
  160.     if (ptr)
  161.         memset(ptr, 0, size);
  162.     return ptr;
           ^
  163. }
  164. 

libavformat/oggparsetheora.c:51:9: Assignment
49. 
50.     if(!thp){
51.         thp = av_mallocz(sizeof(*thp));
            ^
52.         os->private = thp;
53.     }

libavformat/oggparsetheora.c:52:9: Assignment
50.     if(!thp){
51.         thp = av_mallocz(sizeof(*thp));
52.         os->private = thp;
            ^
53.     }
54. 

libavformat/oggparsetheora.c:112:9: Binary operation: (0 - 8):unsigned32
110. 
111.     } else if (os->buf[os->pstart] == 0x83) {
112.         ff_vorbis_comment (s, &st->metadata, os->buf + os->pstart + 7, os->psize - 8);
             ^
113.     }
114. 

static int
theora_header (AVFormatContext * s, int idx)
{
    struct ogg *ogg = s->priv_data;
    struct ogg_stream *os = ogg->streams + idx;
    AVStream *st = s->streams[idx];
    struct theora_params *thp = os->private;
    int cds = st->codec->extradata_size + os->psize + 2;
    uint8_t *cdp;
    if(!(os->buf[os->pstart] & 0x80))
        return 0;
    if(!thp){
        thp = av_mallocz(sizeof(*thp));
        os->private = thp;
    }
    if (os->buf[os->pstart] == 0x80) {
        GetBitContext gb;
        int width, height;
        init_get_bits(&gb, os->buf + os->pstart, os->psize*8);
        skip_bits_long(&gb, 7*8);
        thp->version = get_bits_long(&gb, 24);
        if (thp->version < 0x030100)
        {
            av_log(s, AV_LOG_ERROR,
                "Too old or unsupported Theora (%x)\n", thp->version);
            return -1;
        }
        width  = get_bits(&gb, 16) << 4;
        height = get_bits(&gb, 16) << 4;
        avcodec_set_dimensions(st->codec, width, height);
        if (thp->version >= 0x030400)
            skip_bits(&gb, 100);
        if (thp->version >= 0x030200) {
            width  = get_bits_long(&gb, 24);
            height = get_bits_long(&gb, 24);
            if (   width  <= st->codec->width  && width  > st->codec->width-16
                && height <= st->codec->height && height > st->codec->height-16)
                avcodec_set_dimensions(st->codec, width, height);
            skip_bits(&gb, 16);
        }
        st->codec->time_base.den = get_bits_long(&gb, 32);
        st->codec->time_base.num = get_bits_long(&gb, 32);
        if (!(st->codec->time_base.num > 0 && st->codec->time_base.den > 0)) {
            av_log(s, AV_LOG_WARNING, "Invalid time base in theora stream, assuming 25 FPS\n");
            st->codec->time_base.num = 1;
            st->codec->time_base.den = 25;
        }
        st->time_base = st->codec->time_base;
        st->sample_aspect_ratio.num = get_bits_long(&gb, 24);
        st->sample_aspect_ratio.den = get_bits_long(&gb, 24);
        if (thp->version >= 0x030200)
            skip_bits_long(&gb, 38);
        if (thp->version >= 0x304000)
            skip_bits(&gb, 2);
        thp->gpshift = get_bits(&gb, 5);
        thp->gpmask = (1 << thp->gpshift) - 1;
        st->codec->codec_type = CODEC_TYPE_VIDEO;
        st->codec->codec_id = CODEC_ID_THEORA;
        st->need_parsing = AVSTREAM_PARSE_HEADERS;
    } else if (os->buf[os->pstart] == 0x83) {
        ff_vorbis_comment (s, &st->metadata, os->buf + os->pstart + 7, os->psize - 8);
    }
    st->codec->extradata = av_realloc (st->codec->extradata,
                                       cds + FF_INPUT_BUFFER_PADDING_SIZE);
    cdp = st->codec->extradata + st->codec->extradata_size;
    *cdp++ = os->psize >> 8;
    *cdp++ = os->psize & 0xff;
    memcpy (cdp, os->buf + os->pstart, os->psize);
    st->codec->extradata_size = cds;
    return 1;
}
['static int\ntheora_header (AVFormatContext * s, int idx)\n{\n    struct ogg *ogg = s->priv_data;\n    struct ogg_stream *os = ogg->streams + idx;\n    AVStream *st = s->streams[idx];\n    struct theora_params *thp = os->private;\n    int cds = st->codec->extradata_size + os->psize + 2;\n    uint8_t *cdp;\n    if(!(os->buf[os->pstart] & 0x80))\n        return 0;\n    if(!thp){\n        thp = av_mallocz(sizeof(*thp));\n        os->private = thp;\n    }\n    if (os->buf[os->pstart] == 0x80) {\n        GetBitContext gb;\n        int width, height;\n        init_get_bits(&gb, os->buf + os->pstart, os->psize*8);\n        skip_bits_long(&gb, 7*8);\n        thp->version = get_bits_long(&gb, 24);\n        if (thp->version < 0x030100)\n        {\n            av_log(s, AV_LOG_ERROR,\n                "Too old or unsupported Theora (%x)\\n", thp->version);\n            return -1;\n        }\n        width  = get_bits(&gb, 16) << 4;\n        height = get_bits(&gb, 16) << 4;\n        avcodec_set_dimensions(st->codec, width, height);\n        if (thp->version >= 0x030400)\n            skip_bits(&gb, 100);\n        if (thp->version >= 0x030200) {\n            width  = get_bits_long(&gb, 24);\n            height = get_bits_long(&gb, 24);\n            if (   width  <= st->codec->width  && width  > st->codec->width-16\n                && height <= st->codec->height && height > st->codec->height-16)\n                avcodec_set_dimensions(st->codec, width, height);\n            skip_bits(&gb, 16);\n        }\n        st->codec->time_base.den = get_bits_long(&gb, 32);\n        st->codec->time_base.num = get_bits_long(&gb, 32);\n        if (!(st->codec->time_base.num > 0 && st->codec->time_base.den > 0)) {\n            av_log(s, AV_LOG_WARNING, "Invalid time base in theora stream, assuming 25 FPS\\n");\n            st->codec->time_base.num = 1;\n            st->codec->time_base.den = 25;\n        }\n        st->time_base = st->codec->time_base;\n        st->sample_aspect_ratio.num = get_bits_long(&gb, 24);\n        st->sample_aspect_ratio.den = get_bits_long(&gb, 24);\n        if (thp->version >= 0x030200)\n            skip_bits_long(&gb, 38);\n        if (thp->version >= 0x304000)\n            skip_bits(&gb, 2);\n        thp->gpshift = get_bits(&gb, 5);\n        thp->gpmask = (1 << thp->gpshift) - 1;\n        st->codec->codec_type = CODEC_TYPE_VIDEO;\n        st->codec->codec_id = CODEC_ID_THEORA;\n        st->need_parsing = AVSTREAM_PARSE_HEADERS;\n    } else if (os->buf[os->pstart] == 0x83) {\n        ff_vorbis_comment (s, &st->metadata, os->buf + os->pstart + 7, os->psize - 8);\n    }\n    st->codec->extradata = av_realloc (st->codec->extradata,\n                                       cds + FF_INPUT_BUFFER_PADDING_SIZE);\n    cdp = st->codec->extradata + st->codec->extradata_size;\n    *cdp++ = os->psize >> 8;\n    *cdp++ = os->psize & 0xff;\n    memcpy (cdp, os->buf + os->pstart, os->psize);\n    st->codec->extradata_size = cds;\n    return 1;\n}', 'void *av_mallocz(unsigned int size)\n{\n    void *ptr = av_malloc(size);\n    if (ptr)\n        memset(ptr, 0, size);\n    return ptr;\n}', 'void *av_malloc(unsigned int size)\n{\n    void *ptr = NULL;\n#if CONFIG_MEMALIGN_HACK\n    long diff;\n#endif\n    if(size > (INT_MAX-16) )\n        return NULL;\n#if CONFIG_MEMALIGN_HACK\n    ptr = malloc(size+16);\n    if(!ptr)\n        return ptr;\n    diff= ((-(long)ptr - 1)&15) + 1;\n    ptr = (char*)ptr + diff;\n    ((char*)ptr)[-1]= diff;\n#elif HAVE_POSIX_MEMALIGN\n    if (posix_memalign(&ptr,16,size))\n        ptr = NULL;\n#elif HAVE_MEMALIGN\n    ptr = memalign(16,size);\n#else\n    ptr = malloc(size);\n#endif\n    return ptr;\n}']