libavformat/r3d.c:322: error: Integer Overflow L2
  ([0, +oo] - 8):unsigned32 by call to `r3d_read_redv`.

libavformat/r3d.c:314:13: Call
312. 
313.     while (!err) {
314.         if (read_atom(s, &atom) < 0) {
                 ^
315.             err = -1;
316.             break;

libavformat/r3d.c:42:18: Call
  40. {
  41.     atom->offset = url_ftell(s->pb);
  42.     atom->size = get_be32(s->pb);
                       ^
  43.     if (atom->size < 8)
  44.         return -1;

libavformat/aviobuf.c:570:11: Call
    568. {
    569.     unsigned int val;
    570.     val = get_be16(s) << 16;
                   ^
    571.     val |= get_be16(s);
    572.     return val;

libavformat/aviobuf.c:555:11: Call
      553. {
      554.     unsigned int val;
      555.     val = get_byte(s) << 8;
                     ^
      556.     val |= get_byte(s);
      557.     return val;

libavformat/aviobuf.c:438:5: Assignment
        436.     if (s->buf_ptr < s->buf_end)
        437.         return *s->buf_ptr++;
        438.     return 0;
                 ^
        439. }
        440. 

libavformat/aviobuf.c:555:5: Assignment
      553. {
      554.     unsigned int val;
      555.     val = get_byte(s) << 8;
               ^
      556.     val |= get_byte(s);
      557.     return val;

libavformat/aviobuf.c:556:5: Assignment
      554.     unsigned int val;
      555.     val = get_byte(s) << 8;
      556.     val |= get_byte(s);
               ^
      557.     return val;
      558. }

libavformat/aviobuf.c:557:5: Assignment
      555.     val = get_byte(s) << 8;
      556.     val |= get_byte(s);
      557.     return val;
               ^
      558. }
      559. 

libavformat/aviobuf.c:570:5: Assignment
    568. {
    569.     unsigned int val;
    570.     val = get_be16(s) << 16;
             ^
    571.     val |= get_be16(s);
    572.     return val;

libavformat/aviobuf.c:571:5: Assignment
    569.     unsigned int val;
    570.     val = get_be16(s) << 16;
    571.     val |= get_be16(s);
             ^
    572.     return val;
    573. }

libavformat/aviobuf.c:572:5: Assignment
    570.     val = get_be16(s) << 16;
    571.     val |= get_be16(s);
    572.     return val;
             ^
    573. }
    574. 

libavformat/r3d.c:42:5: Assignment
  40. {
  41.     atom->offset = url_ftell(s->pb);
  42.     atom->size = get_be32(s->pb);
          ^
  43.     if (atom->size < 8)
  44.         return -1;

libavformat/r3d.c:322:25: Call
320.             if (s->streams[0]->discard == AVDISCARD_ALL)
321.                 goto skip;
322.             if (!(err = r3d_read_redv(s, pkt, &atom)))
                             ^
323.                 return 0;
324.             break;

libavformat/r3d.c:209:1: <LHS trace>
207. }
208. 
209. static int r3d_read_redv(AVFormatContext *s, AVPacket *pkt, Atom *atom)
     ^
210. {
211.     AVStream *st = s->streams[0];

libavformat/r3d.c:209:1: Parameter `atom->size`
  207. }
  208. 
  209. static int r3d_read_redv(AVFormatContext *s, AVPacket *pkt, Atom *atom)
       ^
  210. {
  211.     AVStream *st = s->streams[0];

libavformat/r3d.c:244:5: Binary operation: ([0, +oo] - 8):unsigned32 by call to `r3d_read_redv` 
  242.         av_dlog(s, "metadata len %d\n", tmp);
  243.     }
  244.     tmp = atom->size - 8 - (url_ftell(s->pb) - pos);
           ^
  245.     if (tmp < 0)
  246.         return -1;
