libavcodec/cavsdec.c:1039: error: Integer Overflow L2
  ([-3, +oo] - 1):unsigned32 by call to `decode_mb_p`.

libavcodec/cavsdec.c:1034:17: Call
1032.     } else if (h->cur.f->pict_type == AV_PICTURE_TYPE_P) {
1033.         do {
1034.             if (check_for_slice(h))
                      ^
1035.                 skip_count = -1;
1036.             if (h->skip_mode_flag && (skip_count < 0))

libavcodec/cavsdec.c:900:1: Parameter `h->bc.bits_left`
  898. }
  899. 
  900. static inline int check_for_slice(AVSContext *h)
       ^
  901. {
  902.     BitstreamContext *bc = &h->bc;

libavcodec/cavsdec.c:1039:17: Call
1037.                 skip_count = get_ue_golomb(&h->bc);
1038.             if (h->skip_mode_flag && skip_count--) {
1039.                 decode_mb_p(h, P_SKIP);
                      ^
1040.             } else {
1041.                 mb_type = get_ue_golomb(&h->bc) + P_SKIP + h->skip_mode_flag;

libavcodec/cavsdec.c:717:1: Parameter `h->bc.bits_left`
  715. }
  716. 
  717. static void decode_mb_p(AVSContext *h, enum cavs_mb mb_type)
       ^
  718. {
  719.     BitstreamContext *bc = &h->bc;

libavcodec/cavsdec.c:747:36: Call
  745.         ref[1] = h->ref_flag ? 0 : bitstream_read_bit(bc);
  746.         ref[2] = h->ref_flag ? 0 : bitstream_read_bit(bc);
  747.         ref[3] = h->ref_flag ? 0 : bitstream_read_bit(bc);
                                          ^
  748.         ff_cavs_mv(h, MV_FWD_X0, MV_FWD_B3, MV_PRED_MEDIAN,   BLK_8X8, ref[0]);
  749.         ff_cavs_mv(h, MV_FWD_X1, MV_FWD_C2, MV_PRED_MEDIAN,   BLK_8X8, ref[1]);

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
    143. 
    144. /* Return one bit from the buffer. */
    145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
         ^
    146. {
    147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
    148.         refill_64(bc);
    149. 
    150.     return get_val(bc, 1);
                    ^
    151. }
    152. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([-3, +oo] - 1):unsigned32 by call to `decode_mb_p` 
      137.     bc->bits <<= n;
      138. #endif
      139.     bc->bits_left -= n;
               ^
      140. 
      141.     return ret;
