libavcodec/pngdec.c:545: error: Integer Overflow L2
  ([0, 2139062143] + [0, 2139062143]):signed32 by call to `png_decode_idat`.

libavcodec/pngdec.c:418:11: Unknown value from: inflateInit_
416.     s->zstream.zfree  = ff_png_zfree;
417.     s->zstream.opaque = NULL;
418.     ret = inflateInit(&s->zstream);
               ^
419.     if (ret != Z_OK)
420.         return -1;

libavcodec/pngdec.c:545:17: Call
543.             }
544.             s->state |= PNG_IDAT;
545.             if (png_decode_idat(s, length) < 0)
                     ^
546.                 goto fail;
547.             bytestream2_skip(&s->gb, 4); /* crc */

libavcodec/pngdec.c:364:1: Parameter `*s->crow_buf`
  362. }
  363. 
  364. static int png_decode_idat(PNGDecContext *s, int length)
       ^
  365. {
  366.     int ret;

libavcodec/pngdec.c:379:17: Call
  377.         if (s->zstream.avail_out == 0) {
  378.             if (!(s->state & PNG_ALLIMAGE)) {
  379.                 png_handle_row(s);
                       ^
  380.             }
  381.             s->zstream.avail_out = s->crow_size;

libavcodec/pngdec.c:287:1: Parameter `*s->crow_buf`
    285. 
    286. /* process exactly one decompressed row */
    287. static void png_handle_row(PNGDecContext *s)
         ^
    288. {
    289.     uint8_t *ptr, *last_row;

libavcodec/pngdec.c:307:13: Call
    305.                 last_row = ptr - s->image_linesize;
    306. 
    307.             png_filter_row(&s->dsp, ptr, s->crow_buf[0], s->crow_buf + 1,
                     ^
    308.                            last_row, s->row_size, s->bpp);
    309.         }

libavcodec/pngdec.c:194:1: <LHS trace>
192. 
193. /* NOTE: 'dst' can be equal to 'last' */
194. static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
     ^
195.                            uint8_t *src, uint8_t *last, int size, int bpp)
196. {

libavcodec/pngdec.c:194:1: Parameter `*src`
      192. 
      193. /* NOTE: 'dst' can be equal to 'last' */
      194. static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
           ^
      195.                            uint8_t *src, uint8_t *last, int size, int bpp)
      196. {

libavcodec/pngdec.c:210:17: Assignment
      208.             p = *(int*)dst;
      209.             for (; i < size; i += bpp) {
      210.                 int s = *(int*)(src + i);
                           ^
      211.                 p = ((s & 0x7f7f7f7f) + (p & 0x7f7f7f7f)) ^ ((s ^ p) & 0x80808080);
      212.                 *(int*)(dst + i) = p;

libavcodec/pngdec.c:194:1: <RHS trace>
192. 
193. /* NOTE: 'dst' can be equal to 'last' */
194. static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
     ^
195.                            uint8_t *src, uint8_t *last, int size, int bpp)
196. {

libavcodec/pngdec.c:194:1: Parameter `*dst`
      192. 
      193. /* NOTE: 'dst' can be equal to 'last' */
      194. static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
           ^
      195.                            uint8_t *src, uint8_t *last, int size, int bpp)
      196. {

libavcodec/pngdec.c:208:13: Assignment
      206.         }
      207.         if (bpp == 4) {
      208.             p = *(int*)dst;
                       ^
      209.             for (; i < size; i += bpp) {
      210.                 int s = *(int*)(src + i);

libavcodec/pngdec.c:211:17: Binary operation: ([0, 2139062143] + [0, 2139062143]):signed32 by call to `png_decode_idat` 
      209.             for (; i < size; i += bpp) {
      210.                 int s = *(int*)(src + i);
      211.                 p = ((s & 0x7f7f7f7f) + (p & 0x7f7f7f7f)) ^ ((s ^ p) & 0x80808080);
                           ^
      212.                 *(int*)(dst + i) = p;
      213.             }
