libavformat/bmv.c:96: error: Buffer Overrun L3
  Offset: 1 Size: [0, 2147483631].

libavformat/bmv.c:85:19: <Length trace>
83.         if (type == BMV_END)
84.             return AVERROR_EOF;
85.         c->size = avio_rl24(s->pb);
                      ^
86.         if (!c->size)
87.             return AVERROR_INVALIDDATA;

libavformat/bmv.c:85:19: Call
83.         if (type == BMV_END)
84.             return AVERROR_EOF;
85.         c->size = avio_rl24(s->pb);
                      ^
86.         if (!c->size)
87.             return AVERROR_INVALIDDATA;

libavformat/aviobuf.c:553:11: Call
  551. {
  552.     unsigned int val;
  553.     val = avio_rl16(s);
                 ^
  554.     val |= avio_r8(s) << 16;
  555.     return val;

libavformat/aviobuf.c:545:11: Call
    543. {
    544.     unsigned int val;
    545.     val = avio_r8(s);
                   ^
    546.     val |= avio_r8(s) << 8;
    547.     return val;

libavformat/aviobuf.c:443:5: Assignment
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
      443.     return 0;
               ^
      444. }
      445. 

libavformat/aviobuf.c:545:5: Assignment
    543. {
    544.     unsigned int val;
    545.     val = avio_r8(s);
             ^
    546.     val |= avio_r8(s) << 8;
    547.     return val;

libavformat/aviobuf.c:546:5: Assignment
    544.     unsigned int val;
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
             ^
    547.     return val;
    548. }

libavformat/aviobuf.c:547:5: Assignment
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
    547.     return val;
             ^
    548. }
    549. 

libavformat/aviobuf.c:553:5: Assignment
  551. {
  552.     unsigned int val;
  553.     val = avio_rl16(s);
           ^
  554.     val |= avio_r8(s) << 16;
  555.     return val;

libavformat/aviobuf.c:554:5: Assignment
  552.     unsigned int val;
  553.     val = avio_rl16(s);
  554.     val |= avio_r8(s) << 16;
           ^
  555.     return val;
  556. }

libavformat/aviobuf.c:555:5: Assignment
  553.     val = avio_rl16(s);
  554.     val |= avio_r8(s) << 16;
  555.     return val;
           ^
  556. }
  557. 

libavformat/bmv.c:85:9: Assignment
83.         if (type == BMV_END)
84.             return AVERROR_EOF;
85.         c->size = avio_rl24(s->pb);
            ^
86.         if (!c->size)
87.             return AVERROR_INVALIDDATA;

libavformat/bmv.c:88:15: Call
86.         if (!c->size)
87.             return AVERROR_INVALIDDATA;
88.         tmp = av_realloc(c->packet, c->size + 1);
                  ^
89.         if (!tmp)
90.             return AVERROR(ENOMEM);

libavutil/mem.c:124:9: Assignment
  122.     /* let's disallow possibly ambiguous cases */
  123.     if (size > (INT_MAX - 16))
  124.         return NULL;
               ^
  125. 
  126. #if CONFIG_MEMALIGN_HACK

libavformat/bmv.c:88:9: Assignment
86.         if (!c->size)
87.             return AVERROR_INVALIDDATA;
88.         tmp = av_realloc(c->packet, c->size + 1);
            ^
89.         if (!tmp)
90.             return AVERROR(ENOMEM);

libavformat/bmv.c:91:9: Assignment
89.         if (!tmp)
90.             return AVERROR(ENOMEM);
91.         c->packet = tmp;
            ^
92.         c->packet[0] = type;
93.         if (avio_read(s->pb, c->packet + 1, c->size) != c->size)

libavformat/bmv.c:96:30: Array access: Offset: 1 Size: [0, 2147483631]
94.             return AVERROR(EIO);
95.         if (type & BMV_AUDIO) {
96.             int audio_size = c->packet[1] * 65 + 1;
                                 ^
97.             if (audio_size >= c->size) {
98.                 av_log(s, AV_LOG_ERROR, "Reported audio size %d is bigger than packet size (%d)\n",
