libavcodec/sgidec.c:226: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `read_uncompressed_sgi`.

libavcodec/sgidec.c:175:17: Call
173.     dimension = bytestream_get_be16(&in_buf);
174.     s->width  = bytestream_get_be16(&in_buf);
175.     s->height = bytestream_get_be16(&in_buf);
                     ^
176.     s->depth  = bytestream_get_be16(&in_buf);
177. 

libavcodec/bytestream.h:49:1: Parameter `**b`
  47. DEF  (be32, 4, AV_RB32, AV_WB32)
  48. DEF  (be24, 3, AV_RB24, AV_WB24)
  49. DEF  (be16, 2, AV_RB16, AV_WB16)
      ^
  50. DEF  (byte, 1, AV_RB8 , AV_WB8 )
  51. 

libavcodec/bytestream.h:49:1: Assignment
  47. DEF  (be32, 4, AV_RB32, AV_WB32)
  48. DEF  (be24, 3, AV_RB24, AV_WB24)
  49. DEF  (be16, 2, AV_RB16, AV_WB16)
      ^
  50. DEF  (byte, 1, AV_RB8 , AV_WB8 )
  51. 

libavcodec/sgidec.c:175:5: Assignment
173.     dimension = bytestream_get_be16(&in_buf);
174.     s->width  = bytestream_get_be16(&in_buf);
175.     s->height = bytestream_get_be16(&in_buf);
         ^
176.     s->depth  = bytestream_get_be16(&in_buf);
177. 

libavcodec/sgidec.c:226:15: Call
224.         ret = read_rle_sgi(out_end, in_buf, in_end, s);
225.     } else {
226.         ret = read_uncompressed_sgi(out_buf, out_end, in_buf, in_end, s);
                   ^
227.     }
228. 

libavcodec/sgidec.c:123:1: <LHS trace>
121.  * @return 0 if read success, otherwise return -1.
122.  */
123. static int read_uncompressed_sgi(unsigned char* out_buf, uint8_t* out_end,
     ^
124.                 const uint8_t *in_buf, const uint8_t *in_end, SgiState* s)
125. {

libavcodec/sgidec.c:123:1: Parameter `s->height`
  121.  * @return 0 if read success, otherwise return -1.
  122.  */
  123. static int read_uncompressed_sgi(unsigned char* out_buf, uint8_t* out_end,
       ^
  124.                 const uint8_t *in_buf, const uint8_t *in_end, SgiState* s)
  125. {

libavcodec/sgidec.c:135:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `read_uncompressed_sgi` 
  133.     }
  134. 
  135.     for (y = s->height - 1; y >= 0; y--) {
                ^
  136.         out_end = out_buf + (y * s->linesize);
  137.         for (x = s->width; x > 0; x--) {
