libavcodec/pngdec.c:548: error: Integer Overflow L2
  ([0, 2139062143] + [0, 2139062143]):signed32 by call to `png_decode_idat`.

libavcodec/pngdec.c:422:11: Unknown value from: inflateInit_
420.     s->zstream.zfree = ff_png_zfree;
421.     s->zstream.opaque = NULL;
422.     ret = inflateInit(&s->zstream);
               ^
423.     if (ret != Z_OK)
424.         return -1;

libavcodec/pngdec.c:548:17: Call
546.             }
547.             s->state |= PNG_IDAT;
548.             if (png_decode_idat(s, length) < 0)
                     ^
549.                 goto fail;
550.             s->bytestream += 4; /* crc */

libavcodec/pngdec.c:362:1: Parameter `*s->crow_buf`
  360. }
  361. 
  362. static int png_decode_idat(PNGDecContext *s, int length)
       ^
  363. {
  364.     int ret;

libavcodec/pngdec.c:380:17: Call
  378.         if (s->zstream.avail_out == 0) {
  379.             if (!(s->state & PNG_ALLIMAGE)) {
  380.                 png_handle_row(s);
                       ^
  381.             }
  382.             s->zstream.avail_out = s->crow_size;

libavcodec/pngdec.c:285:1: Parameter `*s->crow_buf`
    283. 
    284. /* process exactly one decompressed row */
    285. static void png_handle_row(PNGDecContext *s)
         ^
    286. {
    287.     uint8_t *ptr, *last_row;

libavcodec/pngdec.c:305:13: Call
    303.                 last_row = ptr - s->image_linesize;
    304. 
    305.             png_filter_row(&s->dsp, ptr, s->crow_buf[0], s->crow_buf + 1,
                     ^
    306.                            last_row, s->row_size, s->bpp);
    307.         }

libavcodec/pngdec.c:194:1: <LHS trace>
192. 
193. /* NOTE: 'dst' can be equal to 'last' */
194. static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
     ^
195.                            uint8_t *src, uint8_t *last, int size, int bpp)
196. {

libavcodec/pngdec.c:194:1: Parameter `*src`
      192. 
      193. /* NOTE: 'dst' can be equal to 'last' */
      194. static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
           ^
      195.                            uint8_t *src, uint8_t *last, int size, int bpp)
      196. {

libavcodec/pngdec.c:210:17: Assignment
      208.             p = *(int*)dst;
      209.             for(; i < size; i+=bpp) {
      210.                 int s = *(int*)(src+i);
                           ^
      211.                 p = ((s&0x7f7f7f7f) + (p&0x7f7f7f7f)) ^ ((s^p)&0x80808080);
      212.                 *(int*)(dst+i) = p;

libavcodec/pngdec.c:194:1: <RHS trace>
192. 
193. /* NOTE: 'dst' can be equal to 'last' */
194. static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
     ^
195.                            uint8_t *src, uint8_t *last, int size, int bpp)
196. {

libavcodec/pngdec.c:194:1: Parameter `*dst`
      192. 
      193. /* NOTE: 'dst' can be equal to 'last' */
      194. static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
           ^
      195.                            uint8_t *src, uint8_t *last, int size, int bpp)
      196. {

libavcodec/pngdec.c:208:13: Assignment
      206.         }
      207.         if(bpp == 4) {
      208.             p = *(int*)dst;
                       ^
      209.             for(; i < size; i+=bpp) {
      210.                 int s = *(int*)(src+i);

libavcodec/pngdec.c:211:17: Binary operation: ([0, 2139062143] + [0, 2139062143]):signed32 by call to `png_decode_idat` 
      209.             for(; i < size; i+=bpp) {
      210.                 int s = *(int*)(src+i);
      211.                 p = ((s&0x7f7f7f7f) + (p&0x7f7f7f7f)) ^ ((s^p)&0x80808080);
                           ^
      212.                 *(int*)(dst+i) = p;
      213.             }
