libavformat/bmv.c:94: error: Buffer Overrun L3
  Offset: 1 Size: [0, 2147483631].

libavformat/bmv.c:83:19: <Length trace>
81.         if (type == BMV_END)
82.             return AVERROR_EOF;
83.         c->size = avio_rl24(s->pb);
                      ^
84.         if (!c->size)
85.             return AVERROR_INVALIDDATA;

libavformat/bmv.c:83:19: Call
81.         if (type == BMV_END)
82.             return AVERROR_EOF;
83.         c->size = avio_rl24(s->pb);
                      ^
84.         if (!c->size)
85.             return AVERROR_INVALIDDATA;

libavformat/aviobuf.c:514:11: Call
  512. {
  513.     unsigned int val;
  514.     val = avio_rl16(s);
                 ^
  515.     val |= avio_r8(s) << 16;
  516.     return val;

libavformat/aviobuf.c:506:11: Call
    504. {
    505.     unsigned int val;
    506.     val = avio_r8(s);
                   ^
    507.     val |= avio_r8(s) << 8;
    508.     return val;

libavformat/aviobuf.c:430:5: Assignment
      428.     if (s->buf_ptr < s->buf_end)
      429.         return *s->buf_ptr++;
      430.     return 0;
               ^
      431. }
      432. 

libavformat/aviobuf.c:506:5: Assignment
    504. {
    505.     unsigned int val;
    506.     val = avio_r8(s);
             ^
    507.     val |= avio_r8(s) << 8;
    508.     return val;

libavformat/aviobuf.c:507:5: Assignment
    505.     unsigned int val;
    506.     val = avio_r8(s);
    507.     val |= avio_r8(s) << 8;
             ^
    508.     return val;
    509. }

libavformat/aviobuf.c:508:5: Assignment
    506.     val = avio_r8(s);
    507.     val |= avio_r8(s) << 8;
    508.     return val;
             ^
    509. }
    510. 

libavformat/aviobuf.c:514:5: Assignment
  512. {
  513.     unsigned int val;
  514.     val = avio_rl16(s);
           ^
  515.     val |= avio_r8(s) << 16;
  516.     return val;

libavformat/aviobuf.c:515:5: Assignment
  513.     unsigned int val;
  514.     val = avio_rl16(s);
  515.     val |= avio_r8(s) << 16;
           ^
  516.     return val;
  517. }

libavformat/aviobuf.c:516:5: Assignment
  514.     val = avio_rl16(s);
  515.     val |= avio_r8(s) << 16;
  516.     return val;
           ^
  517. }
  518. 

libavformat/bmv.c:83:9: Assignment
81.         if (type == BMV_END)
82.             return AVERROR_EOF;
83.         c->size = avio_rl24(s->pb);
            ^
84.         if (!c->size)
85.             return AVERROR_INVALIDDATA;

libavformat/bmv.c:86:15: Call
84.         if (!c->size)
85.             return AVERROR_INVALIDDATA;
86.         tmp = av_realloc(c->packet, c->size + 1);
                  ^
87.         if (!tmp)
88.             return AVERROR(ENOMEM);

libavutil/mem.c:127:9: Assignment
  125.     /* let's disallow possible ambiguous cases */
  126.     if (size > (INT_MAX - 16))
  127.         return NULL;
               ^
  128. 
  129. #if CONFIG_MEMALIGN_HACK

libavformat/bmv.c:86:9: Assignment
84.         if (!c->size)
85.             return AVERROR_INVALIDDATA;
86.         tmp = av_realloc(c->packet, c->size + 1);
            ^
87.         if (!tmp)
88.             return AVERROR(ENOMEM);

libavformat/bmv.c:89:9: Assignment
87.         if (!tmp)
88.             return AVERROR(ENOMEM);
89.         c->packet = tmp;
            ^
90.         c->packet[0] = type;
91.         if (avio_read(s->pb, c->packet + 1, c->size) != c->size)

libavformat/bmv.c:94:30: Array access: Offset: 1 Size: [0, 2147483631]
92.             return AVERROR(EIO);
93.         if (type & BMV_AUDIO) {
94.             int audio_size = c->packet[1] * 65 + 1;
                                 ^
95.             if (audio_size >= c->size) {
96.                 av_log(s, AV_LOG_ERROR, "Reported audio size %d is bigger than packet size (%d)\n",
