libavformat/apetag.c:106: error: Integer Overflow L2
  ([32, +oo] - [-oo, 16777248]):unsigned32.

libavformat/apetag.c:67:21: <LHS trace>
65. {
66.     ByteIOContext *pb = s->pb;
67.     int file_size = url_fsize(pb);
                        ^
68.     uint32_t val, fields, tag_bytes;
69.     uint8_t buf[8];

libavformat/apetag.c:67:21: Call
65. {
66.     ByteIOContext *pb = s->pb;
67.     int file_size = url_fsize(pb);
                        ^
68.     uint32_t val, fields, tag_bytes;
69.     uint8_t buf[8];

libavformat/aviobuf.c:196:9: Assignment
  194. 
  195.     if(!s)
  196.         return AVERROR(EINVAL);
               ^
  197. 
  198.     if (!s->seek)

libavformat/apetag.c:67:5: Assignment
65. {
66.     ByteIOContext *pb = s->pb;
67.     int file_size = url_fsize(pb);
        ^
68.     uint32_t val, fields, tag_bytes;
69.     uint8_t buf[8];

libavformat/apetag.c:88:17: <RHS trace>
86.     }
87. 
88.     tag_bytes = get_le32(pb);  /* tag size */
                    ^
89.     if (tag_bytes - APE_TAG_FOOTER_BYTES > (1024 * 1024 * 16)) {
90.         av_log(s, AV_LOG_ERROR, "Tag size is way too big\n");

libavformat/apetag.c:88:17: Call
86.     }
87. 
88.     tag_bytes = get_le32(pb);  /* tag size */
                    ^
89.     if (tag_bytes - APE_TAG_FOOTER_BYTES > (1024 * 1024 * 16)) {
90.         av_log(s, AV_LOG_ERROR, "Tag size is way too big\n");

libavformat/aviobuf.c:459:11: Call
  457. {
  458.     unsigned int val;
  459.     val = get_le16(s);
                 ^
  460.     val |= get_le16(s) << 16;
  461.     return val;

libavformat/aviobuf.c:443:11: Call
    441. {
    442.     unsigned int val;
    443.     val = get_byte(s);
                   ^
    444.     val |= get_byte(s) << 8;
    445.     return val;

libavformat/aviobuf.c:361:13: Assignment
      359.             return *s->buf_ptr++;
      360.         else
      361.             return 0;
                       ^
      362.     }
      363. }

libavformat/aviobuf.c:443:5: Assignment
    441. {
    442.     unsigned int val;
    443.     val = get_byte(s);
             ^
    444.     val |= get_byte(s) << 8;
    445.     return val;

libavformat/aviobuf.c:444:5: Assignment
    442.     unsigned int val;
    443.     val = get_byte(s);
    444.     val |= get_byte(s) << 8;
             ^
    445.     return val;
    446. }

libavformat/aviobuf.c:445:5: Assignment
    443.     val = get_byte(s);
    444.     val |= get_byte(s) << 8;
    445.     return val;
             ^
    446. }
    447. 

libavformat/aviobuf.c:459:5: Assignment
  457. {
  458.     unsigned int val;
  459.     val = get_le16(s);
           ^
  460.     val |= get_le16(s) << 16;
  461.     return val;

libavformat/aviobuf.c:460:5: Assignment
  458.     unsigned int val;
  459.     val = get_le16(s);
  460.     val |= get_le16(s) << 16;
           ^
  461.     return val;
  462. }

libavformat/aviobuf.c:461:5: Assignment
  459.     val = get_le16(s);
  460.     val |= get_le16(s) << 16;
  461.     return val;
           ^
  462. }
  463. 

libavformat/apetag.c:88:5: Assignment
86.     }
87. 
88.     tag_bytes = get_le32(pb);  /* tag size */
        ^
89.     if (tag_bytes - APE_TAG_FOOTER_BYTES > (1024 * 1024 * 16)) {
90.         av_log(s, AV_LOG_ERROR, "Tag size is way too big\n");

libavformat/apetag.c:106:5: Binary operation: ([32, +oo] - [-oo, 16777248]):unsigned32
104.     }
105. 
106.     url_fseek(pb, file_size - tag_bytes, SEEK_SET);
         ^
107. 
108.     for (i=0; i<fields; i++)
