libavcodec/mlp_parser.c:159: error: Integer Overflow L2
  ([0, 2⋅`*bc->buffer` + 28] - 2):unsigned32 by call to `ff_mlp_checksum16`.

libavcodec/mlp_parser.c:146:1: Parameter `*bc->buffer`
144.  */
145. 
146. int ff_mlp_read_major_sync(void *log, MLPHeaderInfo *mh, BitstreamContext *bc)
     ^
147. {
148.     int ratebits, channel_arrangement, header_size;

libavcodec/mlp_parser.c:153:19: Call
151.     assert(bitstream_tell(bc) == 0);
152. 
153.     header_size = mlp_get_major_sync_size(bc->buffer, bc->size_in_bits >> 3);
                       ^
154.     if (header_size < 0 || bc->size_in_bits < header_size << 3) {
155.         av_log(log, AV_LOG_ERROR, "packet too short, unable to read major sync\n");

libavcodec/mlp_parser.c:128:9: Assignment
  126.     int size = 28;
  127.     if (bufsize < 28)
  128.         return -1;
               ^
  129. 
  130.     if (AV_RB32(buf) == 0xf8726fba) {

libavcodec/mlp_parser.c:153:5: Assignment
151.     assert(bitstream_tell(bc) == 0);
152. 
153.     header_size = mlp_get_major_sync_size(bc->buffer, bc->size_in_bits >> 3);
         ^
154.     if (header_size < 0 || bc->size_in_bits < header_size << 3) {
155.         av_log(log, AV_LOG_ERROR, "packet too short, unable to read major sync\n");

libavcodec/mlp_parser.c:159:16: Call
157.     }
158. 
159.     checksum = ff_mlp_checksum16(bc->buffer, header_size - 2);
                    ^
160.     if (checksum != AV_RL16(bc->buffer + header_size - 2)) {
161.         av_log(log, AV_LOG_ERROR, "major sync info header checksum error\n");

libavcodec/mlp.c:64:1: <LHS trace>
62. }
63. 
64. uint16_t ff_mlp_checksum16(const uint8_t *buf, unsigned int buf_size)
    ^
65. {
66.     uint16_t crc;

libavcodec/mlp.c:64:1: Parameter `buf_size`
  62. }
  63. 
  64. uint16_t ff_mlp_checksum16(const uint8_t *buf, unsigned int buf_size)
      ^
  65. {
  66.     uint16_t crc;

libavcodec/mlp.c:68:11: Binary operation: ([0, 2⋅*bc->buffer + 28] - 2):unsigned32 by call to `ff_mlp_checksum16` 
  66.     uint16_t crc;
  67. 
  68.     crc = av_crc(crc_2D, 0, buf, buf_size - 2);
                ^
  69.     crc ^= AV_RL16(buf + buf_size - 2);
  70.     return crc;
