libavformat/asfdec.c:400: error: Integer Overflow L2
  ([-oo, 4294967294] + 1):signed32 by call to `get_tag`.

libavformat/asfdec.c:395:20: Call
393.             int len1, len2, len3, len4, len5;
394. 
395.             len1 = get_le16(pb);
                        ^
396.             len2 = get_le16(pb);
397.             len3 = get_le16(pb);

libavformat/aviobuf.c:450:11: Call
  448. {
  449.     unsigned int val;
  450.     val = get_byte(s);
                 ^
  451.     val |= get_byte(s) << 8;
  452.     return val;

libavformat/aviobuf.c:360:13: Assignment
    358.             return *s->buf_ptr++;
    359.         else
    360.             return 0;
                     ^
    361.     }
    362. }

libavformat/aviobuf.c:450:5: Assignment
  448. {
  449.     unsigned int val;
  450.     val = get_byte(s);
           ^
  451.     val |= get_byte(s) << 8;
  452.     return val;

libavformat/aviobuf.c:451:5: Assignment
  449.     unsigned int val;
  450.     val = get_byte(s);
  451.     val |= get_byte(s) << 8;
           ^
  452.     return val;
  453. }

libavformat/aviobuf.c:452:5: Assignment
  450.     val = get_byte(s);
  451.     val |= get_byte(s) << 8;
  452.     return val;
           ^
  453. }
  454. 

libavformat/asfdec.c:395:13: Assignment
393.             int len1, len2, len3, len4, len5;
394. 
395.             len1 = get_le16(pb);
                 ^
396.             len2 = get_le16(pb);
397.             len3 = get_le16(pb);

libavformat/asfdec.c:400:13: Call
398.             len4 = get_le16(pb);
399.             len5 = get_le16(pb);
400.             get_tag(s, "title"    , 0, len1);
                 ^
401.             get_tag(s, "author"   , 0, len2);
402.             get_tag(s, "copyright", 0, len3);

libavformat/asfdec.c:153:1: <LHS trace>
151. }
152. 
153. static void get_tag(AVFormatContext *s, const char *key, int type, int len)
     ^
154. {
155.     char *value;

libavformat/asfdec.c:153:1: Parameter `len`
  151. }
  152. 
  153. static void get_tag(AVFormatContext *s, const char *key, int type, int len)
       ^
  154. {
  155.     char *value;

libavformat/asfdec.c:160:13: Binary operation: ([-oo, 4294967294] + 1):signed32 by call to `get_tag` 
  158.         return;
  159. 
  160.     value = av_malloc(len+1);
                   ^
  161.     if (!value)
  162.         return;
