libavcodec/ivi.c:969: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `ivi_dec_tile_data_size`.

libavcodec/ivi.c:909:1: Parameter `ctx->bc.bits_left`
907.  *  @return         result code: 0 = OK, -1 = error
908.  */
909. static int decode_band(IVI45DecContext *ctx,
     ^
910.                        IVIBandDesc *band, AVCodecContext *avctx)
911. {

libavcodec/ivi.c:961:26: Call
959.             return AVERROR_INVALIDDATA;
960.         }
961.         tile->is_empty = bitstream_read_bit(&ctx->bc);
                              ^
962.         if (tile->is_empty) {
963.             result = ivi_process_empty_tile(avctx, band, tile,

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
  143. 
  144. /* Return one bit from the buffer. */
  145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
       ^
  146. {
  147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
  148.         refill_64(bc);
  149. 
  150.     return get_val(bc, 1);
                  ^
  151. }
  152. 

libavcodec/bitstream.h:130:1: Parameter `n`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Assignment
    137.     bc->bits <<= n;
    138. #endif
    139.     bc->bits_left -= n;
             ^
    140. 
    141.     return ret;

libavcodec/ivi.c:969:31: Call
967.             ff_dlog(avctx, "Empty tile encountered!\n");
968.         } else {
969.             tile->data_size = ivi_dec_tile_data_size(&ctx->bc);
                                   ^
970.             if (!tile->data_size) {
971.                 av_log(avctx, AV_LOG_ERROR, "Tile data size is zero!\n");

libavcodec/ivi.c:467:1: Parameter `bc->bits_left`
  465.  *  @return     size of the tile data in bytes
  466.  */
  467. static int ivi_dec_tile_data_size(BitstreamContext *bc)
       ^
  468. {
  469.     int    len;

libavcodec/ivi.c:472:9: Call
  470. 
  471.     len = 0;
  472.     if (bitstream_read_bit(bc)) {
               ^
  473.         len = bitstream_read(bc, 8);
  474.         if (len == 255)

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
    143. 
    144. /* Return one bit from the buffer. */
    145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
         ^
    146. {
    147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
    148.         refill_64(bc);
    149. 
    150.     return get_val(bc, 1);
                    ^
    151. }
    152. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ivi_dec_tile_data_size` 
      137.     bc->bits <<= n;
      138. #endif
      139.     bc->bits_left -= n;
               ^
      140. 
      141.     return ret;
