libavcodec/vc1dec.c:5650: error: Integer Overflow L2
  ([0, 2147483640] + [0, 64]):signed32 by call to `vc1_decode_sprites`.

libavcodec/vc1dec.c:5443:9: Call
5441.             buf_size2 = vc1_unescape_buffer(buf, buf_size, buf2);
5442.         }
5443.         init_get_bits(&s->gb, buf2, buf_size2*8);
              ^
5444.     } else
5445.         init_get_bits(&s->gb, buf, buf_size*8);

libavcodec/get_bits.h:372:1: Parameter `bit_size`
  370.  * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
  371.  */
  372. static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
       ^
  373.                                 int bit_size)
  374. {

libavcodec/get_bits.h:387:5: Assignment
  385. 
  386.     s->buffer       = buffer;
  387.     s->size_in_bits = bit_size;
           ^
  388. #if !UNCHECKED_BITSTREAM_READER
  389.     s->size_in_bits_plus8 = bit_size + 8;

libavcodec/vc1dec.c:5650:13: Call
5648.             goto end;
5649. #if CONFIG_WMV3IMAGE_DECODER || CONFIG_VC1IMAGE_DECODER
5650.         if (vc1_decode_sprites(v, &s->gb))
                  ^
5651.             goto err;
5652. #endif

libavcodec/vc1dec.c:5006:1: Parameter `gb->size_in_bits`
  5004. 
  5005. 
  5006. static int vc1_decode_sprites(VC1Context *v, GetBitContext* gb)
        ^
  5007. {
  5008.     MpegEncContext *s     = &v->s;

libavcodec/vc1dec.c:5012:5: Call
  5010.     SpriteData sd;
  5011. 
  5012.     vc1_parse_sprites(v, gb, &sd);
            ^
  5013. 
  5014.     if (!s->current_picture.f.data[0]) {

libavcodec/vc1dec.c:4842:1: <LHS trace>
4840. }
4841. 
4842. static void vc1_parse_sprites(VC1Context *v, GetBitContext* gb, SpriteData* sd)
      ^
4843. {
4844.     AVCodecContext *avctx = v->s.avctx;

libavcodec/vc1dec.c:4842:1: Parameter `gb->size_in_bits`
    4840. }
    4841. 
    4842. static void vc1_parse_sprites(VC1Context *v, GetBitContext* gb, SpriteData* sd)
          ^
    4843. {
    4844.     AVCodecContext *avctx = v->s.avctx;

libavcodec/vc1dec.c:4903:9: <RHS trace>
4901. 
4902.     if (get_bits_count(gb) >= gb->size_in_bits +
4903.        (avctx->codec_id == AV_CODEC_ID_WMV3IMAGE ? 64 : 0))
              ^
4904.         av_log(avctx, AV_LOG_ERROR, "Buffer overrun\n");
4905.     if (get_bits_count(gb) < gb->size_in_bits - 8)

libavcodec/vc1dec.c:4903:9: Assignment
    4901. 
    4902.     if (get_bits_count(gb) >= gb->size_in_bits +
    4903.        (avctx->codec_id == AV_CODEC_ID_WMV3IMAGE ? 64 : 0))
                  ^
    4904.         av_log(avctx, AV_LOG_ERROR, "Buffer overrun\n");
    4905.     if (get_bits_count(gb) < gb->size_in_bits - 8)

libavcodec/vc1dec.c:4902:9: Binary operation: ([0, 2147483640] + [0, 64]):signed32 by call to `vc1_decode_sprites` 
    4900.         av_log(avctx, AV_LOG_DEBUG, "Effect flag set\n");
    4901. 
    4902.     if (get_bits_count(gb) >= gb->size_in_bits +
                  ^
    4903.        (avctx->codec_id == AV_CODEC_ID_WMV3IMAGE ? 64 : 0))
    4904.         av_log(avctx, AV_LOG_ERROR, "Buffer overrun\n");
