libavcodec/webp.c:1159: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `decode_entropy_coded_image`.

libavcodec/webp.c:1086:11: Call
1084.     }
1085. 
1086.     ret = bitstream_init(&s->bc, data_start, data_size * 8);
                ^
1087.     if (ret < 0)
1088.         return ret;

libavcodec/bitstream.h:85:9: Assignment
  83.         bc->buffer    =
  84.         bc->ptr       = NULL;
  85.         bc->bits_left = 0;
              ^
  86.         return AVERROR_INVALIDDATA;
  87.     }

libavcodec/webp.c:1130:12: Call
1128.     s->reduced_width = 0;
1129.     used = 0;
1130.     while (bitstream_read_bit(&s->bc)) {
                 ^
1131.         enum TransformType transform = bitstream_read(&s->bc, 2);
1132.         s->transforms[s->nb_transforms++] = transform;

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
  143. 
  144. /* Return one bit from the buffer. */
  145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
       ^
  146. {
  147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
  148.         refill_64(bc);
  149. 
  150.     return get_val(bc, 1);
                  ^
  151. }
  152. 

libavcodec/bitstream.h:130:1: Parameter `n`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Assignment
    137.     bc->bits <<= n;
    138. #endif
    139.     bc->bits_left -= n;
             ^
    140. 
    141.     return ret;

libavcodec/webp.c:1159:11: Call
1157.     if (is_alpha_chunk)
1158.         s->image[IMAGE_ROLE_ARGB].is_alpha_primary = 1;
1159.     ret = decode_entropy_coded_image(s, IMAGE_ROLE_ARGB, w, h);
                ^
1160.     if (ret < 0)
1161.         goto free_and_return;

libavcodec/webp.c:575:1: Parameter `s->bc.bits_left`
  573. }
  574. 
  575. static int decode_entropy_coded_image(WebPContext *s, enum ImageRole role,
       ^
  576.                                       int w, int h)
  577. {

libavcodec/webp.c:603:9: Call
  601.         return ret;
  602. 
  603.     if (bitstream_read_bit(&s->bc)) {
               ^
  604.         img->color_cache_bits = bitstream_read(&s->bc, 4);
  605.         if (img->color_cache_bits < 1 || img->color_cache_bits > 11) {

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
    143. 
    144. /* Return one bit from the buffer. */
    145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
         ^
    146. {
    147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
    148.         refill_64(bc);
    149. 
    150.     return get_val(bc, 1);
                    ^
    151. }
    152. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `decode_entropy_coded_image` 
      137.     bc->bits <<= n;
      138. #endif
      139.     bc->bits_left -= n;
               ^
      140. 
      141.     return ret;
