libavcodec/pngdec.c:542: error: Integer Overflow L2
  ([0, 2139062143] + [0, 2139062143]):signed32 by call to `png_decode_idat`.

libavcodec/pngdec.c:416:11: Unknown value from: inflateInit_
414.     s->zstream.zfree = ff_png_zfree;
415.     s->zstream.opaque = NULL;
416.     ret = inflateInit(&s->zstream);
               ^
417.     if (ret != Z_OK)
418.         return -1;

libavcodec/pngdec.c:542:17: Call
540.             }
541.             s->state |= PNG_IDAT;
542.             if (png_decode_idat(s, length) < 0)
                     ^
543.                 goto fail;
544.             bytestream2_skip(&s->gb, 4); /* crc */

libavcodec/pngdec.c:361:1: Parameter `*s->crow_buf`
  359. }
  360. 
  361. static int png_decode_idat(PNGDecContext *s, int length)
       ^
  362. {
  363.     int ret;

libavcodec/pngdec.c:376:17: Call
  374.         if (s->zstream.avail_out == 0) {
  375.             if (!(s->state & PNG_ALLIMAGE)) {
  376.                 png_handle_row(s);
                       ^
  377.             }
  378.             s->zstream.avail_out = s->crow_size;

libavcodec/pngdec.c:284:1: Parameter `*s->crow_buf`
    282. 
    283. /* process exactly one decompressed row */
    284. static void png_handle_row(PNGDecContext *s)
         ^
    285. {
    286.     uint8_t *ptr, *last_row;

libavcodec/pngdec.c:304:13: Call
    302.                 last_row = ptr - s->image_linesize;
    303. 
    304.             png_filter_row(&s->dsp, ptr, s->crow_buf[0], s->crow_buf + 1,
                     ^
    305.                            last_row, s->row_size, s->bpp);
    306.         }

libavcodec/pngdec.c:193:1: <LHS trace>
191. 
192. /* NOTE: 'dst' can be equal to 'last' */
193. static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
     ^
194.                            uint8_t *src, uint8_t *last, int size, int bpp)
195. {

libavcodec/pngdec.c:193:1: Parameter `*src`
      191. 
      192. /* NOTE: 'dst' can be equal to 'last' */
      193. static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
           ^
      194.                            uint8_t *src, uint8_t *last, int size, int bpp)
      195. {

libavcodec/pngdec.c:209:17: Assignment
      207.             p = *(int*)dst;
      208.             for(; i < size; i+=bpp) {
      209.                 int s = *(int*)(src+i);
                           ^
      210.                 p = ((s&0x7f7f7f7f) + (p&0x7f7f7f7f)) ^ ((s^p)&0x80808080);
      211.                 *(int*)(dst+i) = p;

libavcodec/pngdec.c:193:1: <RHS trace>
191. 
192. /* NOTE: 'dst' can be equal to 'last' */
193. static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
     ^
194.                            uint8_t *src, uint8_t *last, int size, int bpp)
195. {

libavcodec/pngdec.c:193:1: Parameter `*dst`
      191. 
      192. /* NOTE: 'dst' can be equal to 'last' */
      193. static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
           ^
      194.                            uint8_t *src, uint8_t *last, int size, int bpp)
      195. {

libavcodec/pngdec.c:207:13: Assignment
      205.         }
      206.         if(bpp == 4) {
      207.             p = *(int*)dst;
                       ^
      208.             for(; i < size; i+=bpp) {
      209.                 int s = *(int*)(src+i);

libavcodec/pngdec.c:210:17: Binary operation: ([0, 2139062143] + [0, 2139062143]):signed32 by call to `png_decode_idat` 
      208.             for(; i < size; i+=bpp) {
      209.                 int s = *(int*)(src+i);
      210.                 p = ((s&0x7f7f7f7f) + (p&0x7f7f7f7f)) ^ ((s^p)&0x80808080);
                           ^
      211.                 *(int*)(dst+i) = p;
      212.             }
