libavformat/apetag.c:108: error: Integer Overflow L2
  ([32, +oo] - [-oo, 16777248]):unsigned32.

libavformat/apetag.c:69:21: <LHS trace>
67. {
68.     AVIOContext *pb = s->pb;
69.     int file_size = url_fsize(pb);
                        ^
70.     uint32_t val, fields, tag_bytes;
71.     uint8_t buf[8];

libavformat/apetag.c:69:21: Call
67. {
68.     AVIOContext *pb = s->pb;
69.     int file_size = url_fsize(pb);
                        ^
70.     uint32_t val, fields, tag_bytes;
71.     uint8_t buf[8];

libavformat/aviobuf.c:254:9: Assignment
  252. 
  253.     if(!s)
  254.         return AVERROR(EINVAL);
               ^
  255. 
  256.     if (!s->seek)

libavformat/apetag.c:69:5: Assignment
67. {
68.     AVIOContext *pb = s->pb;
69.     int file_size = url_fsize(pb);
        ^
70.     uint32_t val, fields, tag_bytes;
71.     uint8_t buf[8];

libavformat/apetag.c:90:17: <RHS trace>
88.     }
89. 
90.     tag_bytes = avio_rl32(pb); /* tag size */
                    ^
91.     if (tag_bytes - APE_TAG_FOOTER_BYTES > (1024 * 1024 * 16)) {
92.         av_log(s, AV_LOG_ERROR, "Tag size is way too big\n");

libavformat/apetag.c:90:17: Call
88.     }
89. 
90.     tag_bytes = avio_rl32(pb); /* tag size */
                    ^
91.     if (tag_bytes - APE_TAG_FOOTER_BYTES > (1024 * 1024 * 16)) {
92.         av_log(s, AV_LOG_ERROR, "Tag size is way too big\n");

libavformat/aviobuf.c:642:11: Call
  640. {
  641.     unsigned int val;
  642.     val = avio_rl16(s);
                 ^
  643.     val |= avio_rl16(s) << 16;
  644.     return val;

libavformat/aviobuf.c:626:11: Call
    624. {
    625.     unsigned int val;
    626.     val = avio_r8(s);
                   ^
    627.     val |= avio_r8(s) << 8;
    628.     return val;

libavformat/aviobuf.c:541:5: Assignment
      539.     if (s->buf_ptr < s->buf_end)
      540.         return *s->buf_ptr++;
      541.     return 0;
               ^
      542. }
      543. 

libavformat/aviobuf.c:626:5: Assignment
    624. {
    625.     unsigned int val;
    626.     val = avio_r8(s);
             ^
    627.     val |= avio_r8(s) << 8;
    628.     return val;

libavformat/aviobuf.c:627:5: Assignment
    625.     unsigned int val;
    626.     val = avio_r8(s);
    627.     val |= avio_r8(s) << 8;
             ^
    628.     return val;
    629. }

libavformat/aviobuf.c:628:5: Assignment
    626.     val = avio_r8(s);
    627.     val |= avio_r8(s) << 8;
    628.     return val;
             ^
    629. }
    630. 

libavformat/aviobuf.c:642:5: Assignment
  640. {
  641.     unsigned int val;
  642.     val = avio_rl16(s);
           ^
  643.     val |= avio_rl16(s) << 16;
  644.     return val;

libavformat/aviobuf.c:643:5: Assignment
  641.     unsigned int val;
  642.     val = avio_rl16(s);
  643.     val |= avio_rl16(s) << 16;
           ^
  644.     return val;
  645. }

libavformat/aviobuf.c:644:5: Assignment
  642.     val = avio_rl16(s);
  643.     val |= avio_rl16(s) << 16;
  644.     return val;
           ^
  645. }
  646. 

libavformat/apetag.c:90:5: Assignment
88.     }
89. 
90.     tag_bytes = avio_rl32(pb); /* tag size */
        ^
91.     if (tag_bytes - APE_TAG_FOOTER_BYTES > (1024 * 1024 * 16)) {
92.         av_log(s, AV_LOG_ERROR, "Tag size is way too big\n");

libavformat/apetag.c:108:5: Binary operation: ([32, +oo] - [-oo, 16777248]):unsigned32
106.     }
107. 
108.     avio_seek(pb, file_size - tag_bytes, SEEK_SET);
         ^
109. 
110.     for (i=0; i<fields; i++)
