libavformat/apetag.c:147: error: Integer Overflow L2
  ([32, +oo] - [-oo, 16777248]):unsigned32.

libavformat/apetag.c:119:21: <LHS trace>
117. {
118.     AVIOContext *pb = s->pb;
119.     int file_size = avio_size(pb);
                         ^
120.     uint32_t val, fields, tag_bytes;
121.     uint8_t buf[8];

libavformat/apetag.c:119:21: Call
117. {
118.     AVIOContext *pb = s->pb;
119.     int file_size = avio_size(pb);
                         ^
120.     uint32_t val, fields, tag_bytes;
121.     uint8_t buf[8];

libavformat/aviobuf.c:242:9: Assignment
  240. 
  241.     if(!s)
  242.         return AVERROR(EINVAL);
               ^
  243. 
  244.     if (!s->seek)

libavformat/apetag.c:119:5: Assignment
117. {
118.     AVIOContext *pb = s->pb;
119.     int file_size = avio_size(pb);
         ^
120.     uint32_t val, fields, tag_bytes;
121.     uint8_t buf[8];

libavformat/apetag.c:141:17: <RHS trace>
139.     }
140. 
141.     tag_bytes = avio_rl32(pb); /* tag size */
                     ^
142.     if (tag_bytes - APE_TAG_FOOTER_BYTES > (1024 * 1024 * 16)) {
143.         av_log(s, AV_LOG_ERROR, "Tag size is way too big\n");

libavformat/apetag.c:141:17: Call
139.     }
140. 
141.     tag_bytes = avio_rl32(pb); /* tag size */
                     ^
142.     if (tag_bytes - APE_TAG_FOOTER_BYTES > (1024 * 1024 * 16)) {
143.         av_log(s, AV_LOG_ERROR, "Tag size is way too big\n");

libavformat/aviobuf.c:524:11: Call
  522. {
  523.     unsigned int val;
  524.     val = avio_rl16(s);
                 ^
  525.     val |= avio_rl16(s) << 16;
  526.     return val;

libavformat/aviobuf.c:508:11: Call
    506. {
    507.     unsigned int val;
    508.     val = avio_r8(s);
                   ^
    509.     val |= avio_r8(s) << 8;
    510.     return val;

libavformat/aviobuf.c:432:5: Assignment
      430.     if (s->buf_ptr < s->buf_end)
      431.         return *s->buf_ptr++;
      432.     return 0;
               ^
      433. }
      434. 

libavformat/aviobuf.c:508:5: Assignment
    506. {
    507.     unsigned int val;
    508.     val = avio_r8(s);
             ^
    509.     val |= avio_r8(s) << 8;
    510.     return val;

libavformat/aviobuf.c:509:5: Assignment
    507.     unsigned int val;
    508.     val = avio_r8(s);
    509.     val |= avio_r8(s) << 8;
             ^
    510.     return val;
    511. }

libavformat/aviobuf.c:510:5: Assignment
    508.     val = avio_r8(s);
    509.     val |= avio_r8(s) << 8;
    510.     return val;
             ^
    511. }
    512. 

libavformat/aviobuf.c:524:5: Assignment
  522. {
  523.     unsigned int val;
  524.     val = avio_rl16(s);
           ^
  525.     val |= avio_rl16(s) << 16;
  526.     return val;

libavformat/aviobuf.c:525:5: Assignment
  523.     unsigned int val;
  524.     val = avio_rl16(s);
  525.     val |= avio_rl16(s) << 16;
           ^
  526.     return val;
  527. }

libavformat/aviobuf.c:526:5: Assignment
  524.     val = avio_rl16(s);
  525.     val |= avio_rl16(s) << 16;
  526.     return val;
           ^
  527. }
  528. 

libavformat/apetag.c:141:5: Assignment
139.     }
140. 
141.     tag_bytes = avio_rl32(pb); /* tag size */
         ^
142.     if (tag_bytes - APE_TAG_FOOTER_BYTES > (1024 * 1024 * 16)) {
143.         av_log(s, AV_LOG_ERROR, "Tag size is way too big\n");

libavformat/apetag.c:147:5: Binary operation: ([32, +oo] - [-oo, 16777248]):unsigned32
145.     }
146. 
147.     tag_start = file_size - tag_bytes - APE_TAG_FOOTER_BYTES;
         ^
148.     if (tag_start < 0) {
149.         av_log(s, AV_LOG_ERROR, "Invalid tag size %u.\n", tag_bytes);
