libavformat/flvdec.c:329: error: Integer Overflow L2
  ([0, +oo] - 2):unsigned32 by call to `flv_read_metabody`.

libavformat/flvdec.c:307:12: Call
305.     url_fskip(s->pb, 4); /* size of previous packet */
306.     type = get_byte(s->pb);
307.     size = get_be24(s->pb);
                ^
308.     dts = get_be24(s->pb);
309.     dts |= get_byte(s->pb) << 24;

libavformat/aviobuf.c:471:11: Call
  469. {
  470.     unsigned int val;
  471.     val = get_be16(s) << 8;
                 ^
  472.     val |= get_byte(s);
  473.     return val;

libavformat/aviobuf.c:463:11: Call
    461. {
    462.     unsigned int val;
    463.     val = get_byte(s) << 8;
                   ^
    464.     val |= get_byte(s);
    465.     return val;

libavformat/aviobuf.c:349:13: Assignment
      347.             return *s->buf_ptr++;
      348.         else
      349.             return 0;
                       ^
      350.     }
      351. }

libavformat/aviobuf.c:463:5: Assignment
    461. {
    462.     unsigned int val;
    463.     val = get_byte(s) << 8;
             ^
    464.     val |= get_byte(s);
    465.     return val;

libavformat/aviobuf.c:464:5: Assignment
    462.     unsigned int val;
    463.     val = get_byte(s) << 8;
    464.     val |= get_byte(s);
             ^
    465.     return val;
    466. }

libavformat/aviobuf.c:465:5: Assignment
    463.     val = get_byte(s) << 8;
    464.     val |= get_byte(s);
    465.     return val;
             ^
    466. }
    467. 

libavformat/aviobuf.c:471:5: Assignment
  469. {
  470.     unsigned int val;
  471.     val = get_be16(s) << 8;
           ^
  472.     val |= get_byte(s);
  473.     return val;

libavformat/aviobuf.c:472:5: Assignment
  470.     unsigned int val;
  471.     val = get_be16(s) << 8;
  472.     val |= get_byte(s);
           ^
  473.     return val;
  474. }

libavformat/aviobuf.c:473:5: Assignment
  471.     val = get_be16(s) << 8;
  472.     val |= get_byte(s);
  473.     return val;
           ^
  474. }
  475. unsigned int get_be32(ByteIOContext *s)

libavformat/flvdec.c:307:5: Assignment
305.     url_fskip(s->pb, 4); /* size of previous packet */
306.     type = get_byte(s->pb);
307.     size = get_be24(s->pb);
         ^
308.     dts = get_be24(s->pb);
309.     dts |= get_byte(s->pb) << 24;

libavformat/flvdec.c:319:5: Assignment
317.         continue;
318. 
319.     next= size + url_ftell(s->pb);
         ^
320. 
321.     if (type == FLV_TAG_TYPE_AUDIO) {

libavformat/flvdec.c:329:13: Call
327.     } else {
328.         if (type == FLV_TAG_TYPE_META && size > 13+1+4)
329.             flv_read_metabody(s, next);
                 ^
330.         else /* skip packet */
331.             av_log(s, AV_LOG_ERROR, "skipping flv packet: type %d, size %d, flags %d\n", type, size, flags);

libavformat/flvdec.c:210:1: Parameter `next_pos`
  208. }
  209. 
  210. static int flv_read_metabody(AVFormatContext *s, unsigned int next_pos) {
       ^
  211.     AMFDataType type;
  212.     AVStream *stream, *astream, *vstream;

libavformat/flvdec.c:235:8: Call
  233. 
  234.     //parse the second object (we want a mixed array)
  235.     if(amf_parse_object(s, astream, vstream, buffer, next_pos, 0) < 0)
              ^
  236.         return -1;
  237. 

libavformat/flvdec.c:108:1: <LHS trace>
106. }
107. 
108. static int amf_parse_object(AVFormatContext *s, AVStream *astream, AVStream *vstream, const char *key, unsigned int max_pos, int depth) {
     ^
109.     AVCodecContext *acodec, *vcodec;
110.     ByteIOContext *ioc;

libavformat/flvdec.c:108:1: Parameter `max_pos`
    106. }
    107. 
    108. static int amf_parse_object(AVFormatContext *s, AVStream *astream, AVStream *vstream, const char *key, unsigned int max_pos, int depth) {
         ^
    109.     AVCodecContext *acodec, *vcodec;
    110.     ByteIOContext *ioc;

libavformat/flvdec.c:132:19: Binary operation: ([0, +oo] - 2):unsigned32 by call to `flv_read_metabody` 
    130.             unsigned int keylen;
    131. 
    132.             while(url_ftell(ioc) < max_pos - 2 && (keylen = get_be16(ioc))) {
                           ^
    133.                 url_fskip(ioc, keylen); //skip key string
    134.                 if(amf_parse_object(s, NULL, NULL, NULL, max_pos, depth + 1) < 0)
