libavformat/flvdec.c:308: error: Integer Overflow L2
  ([0, +oo] - 2):unsigned32 by call to `flv_read_metabody`.

libavformat/flvdec.c:286:12: Call
284.     url_fskip(s->pb, 4); /* size of previous packet */
285.     type = get_byte(s->pb);
286.     size = get_be24(s->pb);
                ^
287.     pts = get_be24(s->pb);
288.     pts |= get_byte(s->pb) << 24;

libavformat/aviobuf.c:470:11: Call
  468. {
  469.     unsigned int val;
  470.     val = get_be16(s) << 8;
                 ^
  471.     val |= get_byte(s);
  472.     return val;

libavformat/aviobuf.c:462:11: Call
    460. {
    461.     unsigned int val;
    462.     val = get_byte(s) << 8;
                   ^
    463.     val |= get_byte(s);
    464.     return val;

libavformat/aviobuf.c:348:13: Assignment
      346.             return *s->buf_ptr++;
      347.         else
      348.             return 0;
                       ^
      349.     }
      350. }

libavformat/aviobuf.c:462:5: Assignment
    460. {
    461.     unsigned int val;
    462.     val = get_byte(s) << 8;
             ^
    463.     val |= get_byte(s);
    464.     return val;

libavformat/aviobuf.c:463:5: Assignment
    461.     unsigned int val;
    462.     val = get_byte(s) << 8;
    463.     val |= get_byte(s);
             ^
    464.     return val;
    465. }

libavformat/aviobuf.c:464:5: Assignment
    462.     val = get_byte(s) << 8;
    463.     val |= get_byte(s);
    464.     return val;
             ^
    465. }
    466. 

libavformat/aviobuf.c:470:5: Assignment
  468. {
  469.     unsigned int val;
  470.     val = get_be16(s) << 8;
           ^
  471.     val |= get_byte(s);
  472.     return val;

libavformat/aviobuf.c:471:5: Assignment
  469.     unsigned int val;
  470.     val = get_be16(s) << 8;
  471.     val |= get_byte(s);
           ^
  472.     return val;
  473. }

libavformat/aviobuf.c:472:5: Assignment
  470.     val = get_be16(s) << 8;
  471.     val |= get_byte(s);
  472.     return val;
           ^
  473. }
  474. unsigned int get_be32(ByteIOContext *s)

libavformat/flvdec.c:286:5: Assignment
284.     url_fskip(s->pb, 4); /* size of previous packet */
285.     type = get_byte(s->pb);
286.     size = get_be24(s->pb);
         ^
287.     pts = get_be24(s->pb);
288.     pts |= get_byte(s->pb) << 24;

libavformat/flvdec.c:298:5: Assignment
296.         continue;
297. 
298.     next= size + url_ftell(s->pb);
         ^
299. 
300.     if (type == FLV_TAG_TYPE_AUDIO) {

libavformat/flvdec.c:308:13: Call
306.     } else {
307.         if (type == FLV_TAG_TYPE_META && size > 13+1+4)
308.             flv_read_metabody(s, next);
                 ^
309.         else /* skip packet */
310.             av_log(s, AV_LOG_ERROR, "skipping flv packet: type %d, size %d, flags %d\n", type, size, flags);

libavformat/flvdec.c:206:1: Parameter `next_pos`
  204. }
  205. 
  206. static int flv_read_metabody(AVFormatContext *s, unsigned int next_pos) {
       ^
  207.     AMFDataType type;
  208.     AVStream *stream, *astream, *vstream;

libavformat/flvdec.c:231:8: Call
  229. 
  230.     //parse the second object (we want a mixed array)
  231.     if(amf_parse_object(s, astream, vstream, buffer, next_pos, 0) < 0)
              ^
  232.         return -1;
  233. 

libavformat/flvdec.c:104:1: <LHS trace>
102. }
103. 
104. static int amf_parse_object(AVFormatContext *s, AVStream *astream, AVStream *vstream, const char *key, unsigned int max_pos, int depth) {
     ^
105.     AVCodecContext *acodec, *vcodec;
106.     ByteIOContext *ioc;

libavformat/flvdec.c:104:1: Parameter `max_pos`
    102. }
    103. 
    104. static int amf_parse_object(AVFormatContext *s, AVStream *astream, AVStream *vstream, const char *key, unsigned int max_pos, int depth) {
         ^
    105.     AVCodecContext *acodec, *vcodec;
    106.     ByteIOContext *ioc;

libavformat/flvdec.c:128:19: Binary operation: ([0, +oo] - 2):unsigned32 by call to `flv_read_metabody` 
    126.             unsigned int keylen;
    127. 
    128.             while(url_ftell(ioc) < max_pos - 2 && (keylen = get_be16(ioc))) {
                           ^
    129.                 url_fskip(ioc, keylen); //skip key string
    130.                 if(amf_parse_object(s, NULL, NULL, NULL, max_pos, depth + 1) < 0)
