libavcodec/sgidec.c:230: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `read_uncompressed_sgi`.

libavcodec/sgidec.c:179:28: Call
177.     dimension            = bytestream2_get_be16(&s->g);
178.     s->width             = bytestream2_get_be16(&s->g);
179.     s->height            = bytestream2_get_be16(&s->g);
                                ^
180.     s->depth             = bytestream2_get_be16(&s->g);
181. 

libavcodec/bytestream.h:71:1: Assignment
  69. DEF  (be32, 4, AV_RB32, AV_WB32)
  70. DEF  (be24, 3, AV_RB24, AV_WB24)
  71. DEF  (be16, 2, AV_RB16, AV_WB16)
      ^
  72. DEF  (byte, 1, AV_RB8 , AV_WB8 )
  73. 

libavcodec/sgidec.c:179:5: Assignment
177.     dimension            = bytestream2_get_be16(&s->g);
178.     s->width             = bytestream2_get_be16(&s->g);
179.     s->height            = bytestream2_get_be16(&s->g);
         ^
180.     s->depth             = bytestream2_get_be16(&s->g);
181. 

libavcodec/sgidec.c:230:15: Call
228.         ret = read_rle_sgi(out_end, s);
229.     } else {
230.         ret = read_uncompressed_sgi(out_buf, out_end, s);
                   ^
231.     }
232. 

libavcodec/sgidec.c:119:1: <LHS trace>
117.  * @return 0 if read success, otherwise return -1.
118.  */
119. static int read_uncompressed_sgi(unsigned char* out_buf, uint8_t* out_end,
     ^
120.                                  SgiState *s)
121. {

libavcodec/sgidec.c:119:1: Parameter `s->height`
  117.  * @return 0 if read success, otherwise return -1.
  118.  */
  119. static int read_uncompressed_sgi(unsigned char* out_buf, uint8_t* out_end,
       ^
  120.                                  SgiState *s)
  121. {

libavcodec/sgidec.c:136:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `read_uncompressed_sgi` 
  134.     }
  135. 
  136.     for (y = s->height - 1; y >= 0; y--) {
                ^
  137.         out_end = out_buf + (y * s->linesize);
  138.         if (s->bytes_per_channel == 1) {
