libavcodec/tscc2.c:297: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32.

libavcodec/tscc2.c:320:15: <LHS trace>
318.             return AVERROR_INVALIDDATA;
319.         }
320.         ret = tscc2_decode_slice(c, i, buf + bytestream2_tell(&gb), size);
                   ^
321.         if (ret) {
322.             av_log(avctx, AV_LOG_ERROR, "Error decoding slice %d\n", i);

libavcodec/tscc2.c:320:15: Call
318.             return AVERROR_INVALIDDATA;
319.         }
320.         ret = tscc2_decode_slice(c, i, buf + bytestream2_tell(&gb), size);
                   ^
321.         if (ret) {
322.             av_log(avctx, AV_LOG_ERROR, "Error decoding slice %d\n", i);

libavcodec/tscc2.c:192:1: Parameter `*c->bc.ptr`
  190. }
  191. 
  192. static int tscc2_decode_slice(TSCC2Context *c, int mb_y,
       ^
  193.                               const uint8_t *buf, int buf_size)
  194. {

libavcodec/tscc2.c:295:16: Call
293. 
294.     for (i = 0; i < c->mb_height; i++) {
295.         size = bytestream2_peek_byte(&gb);
                    ^
296.         if (size & 1) {
297.             size = bytestream2_get_byte(&gb) - 1;

libavcodec/bytestream.h:94:1: Parameter `*g->buffer`
  92. DEF(unsigned int, be24, 3, AV_RB24, AV_WB24)
  93. DEF(unsigned int, be16, 2, AV_RB16, AV_WB16)
  94. DEF(unsigned int, byte, 1, AV_RB8 , AV_WB8)
      ^
  95. 
  96. #if HAVE_BIGENDIAN

libavcodec/tscc2.c:297:20: Call
295.         size = bytestream2_peek_byte(&gb);
296.         if (size & 1) {
297.             size = bytestream2_get_byte(&gb) - 1;
                        ^
298.         } else {
299.             size = bytestream2_get_le32(&gb) >> 1;

libavcodec/bytestream.h:94:1: Assignment
  92. DEF(unsigned int, be24, 3, AV_RB24, AV_WB24)
  93. DEF(unsigned int, be16, 2, AV_RB16, AV_WB16)
  94. DEF(unsigned int, byte, 1, AV_RB8 , AV_WB8)
      ^
  95. 
  96. #if HAVE_BIGENDIAN

libavcodec/tscc2.c:297:13: Binary operation: ([0, +oo] - 1):unsigned32
295.         size = bytestream2_peek_byte(&gb);
296.         if (size & 1) {
297.             size = bytestream2_get_byte(&gb) - 1;
                 ^
298.         } else {
299.             size = bytestream2_get_le32(&gb) >> 1;
