libavformat/oggparsetheora.c:106: error: Integer Overflow L1
  (0 - 8):unsigned32.

libavformat/oggparsetheora.c:51:15: <LHS trace>
49. 
50.     if(!thp){
51.         thp = av_mallocz(sizeof(*thp));
                  ^
52.         os->private = thp;
53.     }

libavformat/oggparsetheora.c:51:15: Call
49. 
50.     if(!thp){
51.         thp = av_mallocz(sizeof(*thp));
                  ^
52.         os->private = thp;
53.     }

libavutil/mem.c:141:17: Call
  139. void *av_mallocz(unsigned int size)
  140. {
  141.     void *ptr = av_malloc(size);
                       ^
  142.     if (ptr)
  143.         memset(ptr, 0, size);

libavutil/mem.c:56:9: Assignment
    54.     /* let's disallow possible ambiguous cases */
    55.     if(size > (INT_MAX-16) )
    56.         return NULL;
                ^
    57. 
    58. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:141:5: Assignment
  139. void *av_mallocz(unsigned int size)
  140. {
  141.     void *ptr = av_malloc(size);
           ^
  142.     if (ptr)
  143.         memset(ptr, 0, size);

libavutil/mem.c:144:5: Assignment
  142.     if (ptr)
  143.         memset(ptr, 0, size);
  144.     return ptr;
           ^
  145. }
  146. 

libavformat/oggparsetheora.c:51:9: Assignment
49. 
50.     if(!thp){
51.         thp = av_mallocz(sizeof(*thp));
            ^
52.         os->private = thp;
53.     }

libavformat/oggparsetheora.c:52:9: Assignment
50.     if(!thp){
51.         thp = av_mallocz(sizeof(*thp));
52.         os->private = thp;
            ^
53.     }
54. 

libavformat/oggparsetheora.c:106:9: Binary operation: (0 - 8):unsigned32
104. 
105.     } else if (os->buf[os->pstart] == 0x83) {
106.         vorbis_comment (s, os->buf + os->pstart + 7, os->psize - 8);
             ^
107.     }
108. 
