libavcodec/pngdec.c:530: error: Integer Overflow L2
  ([0, 2139062143] + [0, 2139062143]):signed32 by call to `png_decode_idat`.

libavcodec/pngdec.c:406:11: Unknown value from: inflateInit_
404.     s->zstream.zfree = ff_png_zfree;
405.     s->zstream.opaque = NULL;
406.     ret = inflateInit(&s->zstream);
               ^
407.     if (ret != Z_OK)
408.         return -1;

libavcodec/pngdec.c:530:17: Call
528.             }
529.             s->state |= PNG_IDAT;
530.             if (png_decode_idat(s, length) < 0)
                     ^
531.                 goto fail;
532.             /* skip crc */

libavcodec/pngdec.c:353:1: Parameter `*s->crow_buf`
  351. }
  352. 
  353. static int png_decode_idat(PNGDecContext *s, int length)
       ^
  354. {
  355.     int ret;

libavcodec/pngdec.c:371:17: Call
  369.         if (s->zstream.avail_out == 0) {
  370.             if (!(s->state & PNG_ALLIMAGE)) {
  371.                 png_handle_row(s);
                       ^
  372.             }
  373.             s->zstream.avail_out = s->crow_size;

libavcodec/pngdec.c:276:1: Parameter `*s->crow_buf`
    274. 
    275. /* process exactly one decompressed row */
    276. static void png_handle_row(PNGDecContext *s)
         ^
    277. {
    278.     uint8_t *ptr, *last_row;

libavcodec/pngdec.c:319:17: Call
    317.                 if (got_line)
    318.                     break;
    319.                 png_filter_row(&s->dsp, s->tmp_row, s->crow_buf[0], s->crow_buf + 1,
                         ^
    320.                                s->last_row, s->pass_row_size, s->bpp);
    321.                 FFSWAP(uint8_t*, s->last_row, s->tmp_row);

libavcodec/pngdec.c:185:1: <LHS trace>
183. 
184. /* NOTE: 'dst' can be equal to 'last' */
185. static void png_filter_row(DSPContext *dsp, uint8_t *dst, int filter_type,
     ^
186.                            uint8_t *src, uint8_t *last, int size, int bpp)
187. {

libavcodec/pngdec.c:185:1: Parameter `*src`
      183. 
      184. /* NOTE: 'dst' can be equal to 'last' */
      185. static void png_filter_row(DSPContext *dsp, uint8_t *dst, int filter_type,
           ^
      186.                            uint8_t *src, uint8_t *last, int size, int bpp)
      187. {

libavcodec/pngdec.c:201:17: Assignment
      199.             p = *(int*)dst;
      200.             for(; i < size; i+=bpp) {
      201.                 int s = *(int*)(src+i);
                           ^
      202.                 p = ((s&0x7f7f7f7f) + (p&0x7f7f7f7f)) ^ ((s^p)&0x80808080);
      203.                 *(int*)(dst+i) = p;

libavcodec/pngdec.c:185:1: <RHS trace>
183. 
184. /* NOTE: 'dst' can be equal to 'last' */
185. static void png_filter_row(DSPContext *dsp, uint8_t *dst, int filter_type,
     ^
186.                            uint8_t *src, uint8_t *last, int size, int bpp)
187. {

libavcodec/pngdec.c:185:1: Parameter `*dst`
      183. 
      184. /* NOTE: 'dst' can be equal to 'last' */
      185. static void png_filter_row(DSPContext *dsp, uint8_t *dst, int filter_type,
           ^
      186.                            uint8_t *src, uint8_t *last, int size, int bpp)
      187. {

libavcodec/pngdec.c:199:13: Assignment
      197.         }
      198.         if(bpp == 4) {
      199.             p = *(int*)dst;
                       ^
      200.             for(; i < size; i+=bpp) {
      201.                 int s = *(int*)(src+i);

libavcodec/pngdec.c:202:17: Binary operation: ([0, 2139062143] + [0, 2139062143]):signed32 by call to `png_decode_idat` 
      200.             for(; i < size; i+=bpp) {
      201.                 int s = *(int*)(src+i);
      202.                 p = ((s&0x7f7f7f7f) + (p&0x7f7f7f7f)) ^ ((s^p)&0x80808080);
                           ^
      203.                 *(int*)(dst+i) = p;
      204.             }
