libavcodec/on2avc.c:826: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `on2avc_read_ms_info`.

libavcodec/on2avc.c:811:27: Call
809.     }
810.     c->prev_window_type = c->window_type;
811.     c->window_type      = bitstream_read(&bc, 3);
                               ^
812.     if (c->window_type >= WINDOW_TYPE_EXT4 && c->avctx->channels == 1) {
813.         av_log(c->avctx, AV_LOG_ERROR, "stereo mode window for mono audio\n");

libavcodec/bitstream.h:183:1: Parameter `bc->bits_left`
  181. 
  182. /* Return n bits from the buffer. n has to be in the 0-32 range. */
  183. static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)
       ^
  184. {
  185.     if (!n)

libavcodec/on2avc.c:826:5: Call
824.         c->grouping[i] = !bitstream_read_bit(&bc);
825. 
826.     on2avc_read_ms_info(c, &bc);
         ^
827.     for (i = 0; i < c->avctx->channels; i++)
828.         if ((ret = on2avc_read_channel_data(c, &bc, i)) < 0)

libavcodec/on2avc.c:89:1: Parameter `bc->bits_left`
  87. } On2AVCContext;
  88. 
  89. static void on2avc_read_ms_info(On2AVCContext *c, BitstreamContext *bc)
      ^
  90. {
  91.     int w, b, band_off = 0;

libavcodec/on2avc.c:93:21: Call
  91.     int w, b, band_off = 0;
  92. 
  93.     c->ms_present = bitstream_read_bit(bc);
                          ^
  94.     if (!c->ms_present)
  95.         return;

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
    143. 
    144. /* Return one bit from the buffer. */
    145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
         ^
    146. {
    147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
    148.         refill_64(bc);
    149. 
    150.     return get_val(bc, 1);
                    ^
    151. }
    152. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `on2avc_read_ms_info` 
      137.     bc->bits <<= n;
      138. #endif
      139.     bc->bits_left -= n;
               ^
      140. 
      141.     return ret;
