libavcodec/pngdec.c:537: error: Integer Overflow L2
  ([0, 2139062143] + [0, 2139062143]):signed32 by call to `png_decode_idat`.

libavcodec/pngdec.c:413:11: Unknown value from: inflateInit_
411.     s->zstream.zfree = ff_png_zfree;
412.     s->zstream.opaque = NULL;
413.     ret = inflateInit(&s->zstream);
               ^
414.     if (ret != Z_OK)
415.         return -1;

libavcodec/pngdec.c:537:17: Call
535.             }
536.             s->state |= PNG_IDAT;
537.             if (png_decode_idat(s, length) < 0)
                     ^
538.                 goto fail;
539.             /* skip crc */

libavcodec/pngdec.c:354:1: Parameter `*s->crow_buf`
  352. }
  353. 
  354. static int png_decode_idat(PNGDecContext *s, int length)
       ^
  355. {
  356.     int ret;

libavcodec/pngdec.c:372:17: Call
  370.         if (s->zstream.avail_out == 0) {
  371.             if (!(s->state & PNG_ALLIMAGE)) {
  372.                 png_handle_row(s);
                       ^
  373.             }
  374.             s->zstream.avail_out = s->crow_size;

libavcodec/pngdec.c:277:1: Parameter `*s->crow_buf`
    275. 
    276. /* process exactly one decompressed row */
    277. static void png_handle_row(PNGDecContext *s)
         ^
    278. {
    279.     uint8_t *ptr, *last_row;

libavcodec/pngdec.c:297:13: Call
    295.                 last_row = ptr - s->image_linesize;
    296. 
    297.             png_filter_row(&s->dsp, ptr, s->crow_buf[0], s->crow_buf + 1,
                     ^
    298.                            last_row, s->row_size, s->bpp);
    299.         }

libavcodec/pngdec.c:186:1: <LHS trace>
184. 
185. /* NOTE: 'dst' can be equal to 'last' */
186. static void png_filter_row(DSPContext *dsp, uint8_t *dst, int filter_type,
     ^
187.                            uint8_t *src, uint8_t *last, int size, int bpp)
188. {

libavcodec/pngdec.c:186:1: Parameter `*src`
      184. 
      185. /* NOTE: 'dst' can be equal to 'last' */
      186. static void png_filter_row(DSPContext *dsp, uint8_t *dst, int filter_type,
           ^
      187.                            uint8_t *src, uint8_t *last, int size, int bpp)
      188. {

libavcodec/pngdec.c:202:17: Assignment
      200.             p = *(int*)dst;
      201.             for(; i < size; i+=bpp) {
      202.                 int s = *(int*)(src+i);
                           ^
      203.                 p = ((s&0x7f7f7f7f) + (p&0x7f7f7f7f)) ^ ((s^p)&0x80808080);
      204.                 *(int*)(dst+i) = p;

libavcodec/pngdec.c:186:1: <RHS trace>
184. 
185. /* NOTE: 'dst' can be equal to 'last' */
186. static void png_filter_row(DSPContext *dsp, uint8_t *dst, int filter_type,
     ^
187.                            uint8_t *src, uint8_t *last, int size, int bpp)
188. {

libavcodec/pngdec.c:186:1: Parameter `*dst`
      184. 
      185. /* NOTE: 'dst' can be equal to 'last' */
      186. static void png_filter_row(DSPContext *dsp, uint8_t *dst, int filter_type,
           ^
      187.                            uint8_t *src, uint8_t *last, int size, int bpp)
      188. {

libavcodec/pngdec.c:200:13: Assignment
      198.         }
      199.         if(bpp == 4) {
      200.             p = *(int*)dst;
                       ^
      201.             for(; i < size; i+=bpp) {
      202.                 int s = *(int*)(src+i);

libavcodec/pngdec.c:203:17: Binary operation: ([0, 2139062143] + [0, 2139062143]):signed32 by call to `png_decode_idat` 
      201.             for(; i < size; i+=bpp) {
      202.                 int s = *(int*)(src+i);
      203.                 p = ((s&0x7f7f7f7f) + (p&0x7f7f7f7f)) ^ ((s^p)&0x80808080);
                           ^
      204.                 *(int*)(dst+i) = p;
      205.             }
