libavcodec/svq3.c:1519: error: Integer Overflow L2
  ([-1, +oo] - 1):unsigned32 by call to `svq3_decode_mb`.

libavcodec/svq3.c:1513:23: Call
1511.             }
1512. 
1513.             mb_type = get_interleaved_ue_golomb(&s->bc_slice);
                            ^
1514. 
1515.             if (s->pict_type == AV_PICTURE_TYPE_I)

libavcodec/golomb.h:112:9: Call
  110.     if (buf & 0xAA800000) {
  111.         buf >>= 32 - 8;
  112.         bitstream_skip(bc, ff_interleaved_golomb_vlc_len[buf]);
               ^
  113. 
  114.         return ff_interleaved_ue_golomb_vlc_code[buf];

libavcodec/bitstream.h:247:9: Assignment
    245.         n -= bc->bits_left;
    246.         bc->bits      = 0;
    247.         bc->bits_left = 0;
                 ^
    248. 
    249.         if (n >= 64) {

libavcodec/bitstream.h:255:9: Call
    253.             bc->ptr += skip;
    254.         }
    255.         refill_64(bc);
                 ^
    256.         if (n)
    257.             skip_remaining(bc, n);

libavcodec/bitstream.h:45:1: Parameter `bc->bits_left`
      43. } BitstreamContext;
      44. 
      45. static inline void refill_64(BitstreamContext *bc)
          ^
      46. {
      47.     if (bc->ptr >= bc->buffer_end)

libavcodec/svq3.c:1519:33: Call
1517.             else if (s->pict_type == AV_PICTURE_TYPE_B && mb_type >= 4)
1518.                 mb_type += 4;
1519.             if (mb_type > 33 || svq3_decode_mb(s, mb_type)) {
                                      ^
1520.                 av_log(s->avctx, AV_LOG_ERROR,
1521.                        "error while decoding MB %d %d\n", s->mb_x, s->mb_y);

libavcodec/svq3.c:714:1: Parameter `s->bc_slice.bits_left`
  712. }
  713. 
  714. static int svq3_decode_mb(SVQ3Context *s, unsigned int mb_type)
       ^
  715. {
  716.     int i, j, k, m, dir, mode;

libavcodec/svq3.c:751:39: Call
  749.             mode = THIRDPEL_MODE;
  750.         else if (s->halfpel_flag &&
  751.                  s->thirdpel_flag == !bitstream_read_bit(&s->bc_slice))
                                             ^
  752.             mode = HALFPEL_MODE;
  753.         else

libavcodec/bitstream.h:144:1: Parameter `bc->bits_left`
    142. 
    143. /* Return one bit from the buffer. */
    144. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
         ^
    145. {
    146.     if (!bc->bits_left)

libavcodec/bitstream.h:149:12: Call
    147.         refill_64(bc);
    148. 
    149.     return get_val(bc, 1);
                    ^
    150. }
    151. 

libavcodec/bitstream.h:129:1: <LHS trace>
127. }
128. 
129. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
130. {
131. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:129:1: Parameter `bc->bits_left`
      127. }
      128. 
      129. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      130. {
      131. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:129:1: <RHS trace>
127. }
128. 
129. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
130. {
131. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:129:1: Parameter `n`
      127. }
      128. 
      129. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      130. {
      131. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:138:5: Binary operation: ([-1, +oo] - 1):unsigned32 by call to `svq3_decode_mb` 
      136.     bc->bits <<= n;
      137. #endif
      138.     bc->bits_left -= n;
               ^
      139. 
      140.     return ret;
