libavformat/r3d.c:322: error: Integer Overflow L2
  ([0, +oo] - 8):unsigned32 by call to `r3d_read_redv`.

libavformat/r3d.c:314:13: Call
312. 
313.     while (!err) {
314.         if (read_atom(s, &atom) < 0) {
                 ^
315.             err = -1;
316.             break;

libavformat/r3d.c:42:18: Call
  40. {
  41.     atom->offset = avio_tell(s->pb);
  42.     atom->size = avio_rb32(s->pb);
                       ^
  43.     if (atom->size < 8)
  44.         return -1;

libavformat/aviobuf.c:673:11: Call
    671. {
    672.     unsigned int val;
    673.     val = avio_rb16(s) << 16;
                   ^
    674.     val |= avio_rb16(s);
    675.     return val;

libavformat/aviobuf.c:658:11: Call
      656. {
      657.     unsigned int val;
      658.     val = avio_r8(s) << 8;
                     ^
      659.     val |= avio_r8(s);
      660.     return val;

libavformat/aviobuf.c:541:5: Assignment
        539.     if (s->buf_ptr < s->buf_end)
        540.         return *s->buf_ptr++;
        541.     return 0;
                 ^
        542. }
        543. 

libavformat/aviobuf.c:658:5: Assignment
      656. {
      657.     unsigned int val;
      658.     val = avio_r8(s) << 8;
               ^
      659.     val |= avio_r8(s);
      660.     return val;

libavformat/aviobuf.c:659:5: Assignment
      657.     unsigned int val;
      658.     val = avio_r8(s) << 8;
      659.     val |= avio_r8(s);
               ^
      660.     return val;
      661. }

libavformat/aviobuf.c:660:5: Assignment
      658.     val = avio_r8(s) << 8;
      659.     val |= avio_r8(s);
      660.     return val;
               ^
      661. }
      662. 

libavformat/aviobuf.c:673:5: Assignment
    671. {
    672.     unsigned int val;
    673.     val = avio_rb16(s) << 16;
             ^
    674.     val |= avio_rb16(s);
    675.     return val;

libavformat/aviobuf.c:674:5: Assignment
    672.     unsigned int val;
    673.     val = avio_rb16(s) << 16;
    674.     val |= avio_rb16(s);
             ^
    675.     return val;
    676. }

libavformat/aviobuf.c:675:5: Assignment
    673.     val = avio_rb16(s) << 16;
    674.     val |= avio_rb16(s);
    675.     return val;
             ^
    676. }
    677. 

libavformat/r3d.c:42:5: Assignment
  40. {
  41.     atom->offset = avio_tell(s->pb);
  42.     atom->size = avio_rb32(s->pb);
          ^
  43.     if (atom->size < 8)
  44.         return -1;

libavformat/r3d.c:322:25: Call
320.             if (s->streams[0]->discard == AVDISCARD_ALL)
321.                 goto skip;
322.             if (!(err = r3d_read_redv(s, pkt, &atom)))
                             ^
323.                 return 0;
324.             break;

libavformat/r3d.c:209:1: <LHS trace>
207. }
208. 
209. static int r3d_read_redv(AVFormatContext *s, AVPacket *pkt, Atom *atom)
     ^
210. {
211.     AVStream *st = s->streams[0];

libavformat/r3d.c:209:1: Parameter `atom->size`
  207. }
  208. 
  209. static int r3d_read_redv(AVFormatContext *s, AVPacket *pkt, Atom *atom)
       ^
  210. {
  211.     AVStream *st = s->streams[0];

libavformat/r3d.c:244:5: Binary operation: ([0, +oo] - 8):unsigned32 by call to `r3d_read_redv` 
  242.         av_dlog(s, "metadata len %d\n", tmp);
  243.     }
  244.     tmp = atom->size - 8 - (avio_tell(s->pb) - pos);
           ^
  245.     if (tmp < 0)
  246.         return -1;
