libavformat/mxfdec.c:372: error: Integer Overflow L2
  ([-oo, 238609294] × 18):signed32.

libavformat/mxfdec.c:361:20: <LHS trace>
359. {
360.     MXFContext *mxf = arg;
361.     int item_num = avio_rb32(pb);
                        ^
362.     int item_len = avio_rb32(pb);
363. 

libavformat/mxfdec.c:361:20: Call
359. {
360.     MXFContext *mxf = arg;
361.     int item_num = avio_rb32(pb);
                        ^
362.     int item_len = avio_rb32(pb);
363. 

libavformat/aviobuf.c:772:11: Call
  770. {
  771.     unsigned int val;
  772.     val = avio_rb16(s) << 16;
                 ^
  773.     val |= avio_rb16(s);
  774.     return val;

libavformat/aviobuf.c:757:11: Call
    755. {
    756.     unsigned int val;
    757.     val = avio_r8(s) << 8;
                   ^
    758.     val |= avio_r8(s);
    759.     return val;

libavformat/aviobuf.c:638:5: Assignment
      636.     if (s->buf_ptr < s->buf_end)
      637.         return *s->buf_ptr++;
      638.     return 0;
               ^
      639. }
      640. 

libavformat/aviobuf.c:757:5: Assignment
    755. {
    756.     unsigned int val;
    757.     val = avio_r8(s) << 8;
             ^
    758.     val |= avio_r8(s);
    759.     return val;

libavformat/aviobuf.c:758:5: Assignment
    756.     unsigned int val;
    757.     val = avio_r8(s) << 8;
    758.     val |= avio_r8(s);
             ^
    759.     return val;
    760. }

libavformat/aviobuf.c:759:5: Assignment
    757.     val = avio_r8(s) << 8;
    758.     val |= avio_r8(s);
    759.     return val;
             ^
    760. }
    761. 

libavformat/aviobuf.c:772:5: Assignment
  770. {
  771.     unsigned int val;
  772.     val = avio_rb16(s) << 16;
           ^
  773.     val |= avio_rb16(s);
  774.     return val;

libavformat/aviobuf.c:773:5: Assignment
  771.     unsigned int val;
  772.     val = avio_rb16(s) << 16;
  773.     val |= avio_rb16(s);
           ^
  774.     return val;
  775. }

libavformat/aviobuf.c:774:5: Assignment
  772.     val = avio_rb16(s) << 16;
  773.     val |= avio_rb16(s);
  774.     return val;
           ^
  775. }
  776. 

libavformat/mxfdec.c:361:5: Assignment
359. {
360.     MXFContext *mxf = arg;
361.     int item_num = avio_rb32(pb);
         ^
362.     int item_len = avio_rb32(pb);
363. 

libavformat/mxfdec.c:362:20: <RHS trace>
360.     MXFContext *mxf = arg;
361.     int item_num = avio_rb32(pb);
362.     int item_len = avio_rb32(pb);
                        ^
363. 
364.     if (item_len != 18) {

libavformat/mxfdec.c:362:20: Call
360.     MXFContext *mxf = arg;
361.     int item_num = avio_rb32(pb);
362.     int item_len = avio_rb32(pb);
                        ^
363. 
364.     if (item_len != 18) {

libavformat/aviobuf.c:772:11: Call
  770. {
  771.     unsigned int val;
  772.     val = avio_rb16(s) << 16;
                 ^
  773.     val |= avio_rb16(s);
  774.     return val;

libavformat/aviobuf.c:757:11: Call
    755. {
    756.     unsigned int val;
    757.     val = avio_r8(s) << 8;
                   ^
    758.     val |= avio_r8(s);
    759.     return val;

libavformat/aviobuf.c:638:5: Assignment
      636.     if (s->buf_ptr < s->buf_end)
      637.         return *s->buf_ptr++;
      638.     return 0;
               ^
      639. }
      640. 

libavformat/aviobuf.c:757:5: Assignment
    755. {
    756.     unsigned int val;
    757.     val = avio_r8(s) << 8;
             ^
    758.     val |= avio_r8(s);
    759.     return val;

libavformat/aviobuf.c:758:5: Assignment
    756.     unsigned int val;
    757.     val = avio_r8(s) << 8;
    758.     val |= avio_r8(s);
             ^
    759.     return val;
    760. }

libavformat/aviobuf.c:759:5: Assignment
    757.     val = avio_r8(s) << 8;
    758.     val |= avio_r8(s);
    759.     return val;
             ^
    760. }
    761. 

libavformat/aviobuf.c:772:5: Assignment
  770. {
  771.     unsigned int val;
  772.     val = avio_rb16(s) << 16;
           ^
  773.     val |= avio_rb16(s);
  774.     return val;

libavformat/aviobuf.c:773:5: Assignment
  771.     unsigned int val;
  772.     val = avio_rb16(s) << 16;
  773.     val |= avio_rb16(s);
           ^
  774.     return val;
  775. }

libavformat/aviobuf.c:774:5: Assignment
  772.     val = avio_rb16(s) << 16;
  773.     val |= avio_rb16(s);
  774.     return val;
           ^
  775. }
  776. 

libavformat/mxfdec.c:362:5: Assignment
360.     MXFContext *mxf = arg;
361.     int item_num = avio_rb32(pb);
362.     int item_len = avio_rb32(pb);
         ^
363. 
364.     if (item_len != 18) {

libavformat/mxfdec.c:372:23: Binary operation: ([-oo, 238609294] × 18):signed32
370.         return AVERROR_INVALIDDATA;
371.     mxf->local_tags_count = item_num;
372.     mxf->local_tags = av_malloc(item_num*item_len);
                           ^
373.     if (!mxf->local_tags)
374.         return AVERROR(ENOMEM);
