libavcodec/pngdec.c:553: error: Integer Overflow L2
  ([0, 2139062143] + [0, 2139062143]):signed32 by call to `png_decode_idat`.

libavcodec/pngdec.c:429:11: Unknown value from: inflateInit_
427.     s->zstream.zfree  = ff_png_zfree;
428.     s->zstream.opaque = NULL;
429.     ret = inflateInit(&s->zstream);
               ^
430.     if (ret != Z_OK)
431.         return -1;

libavcodec/pngdec.c:553:17: Call
551.             }
552.             s->state |= PNG_IDAT;
553.             if (png_decode_idat(s, length) < 0)
                     ^
554.                 goto fail;
555.             bytestream2_skip(&s->gb, 4); /* crc */

libavcodec/pngdec.c:375:1: Parameter `*s->crow_buf`
  373. }
  374. 
  375. static int png_decode_idat(PNGDecContext *s, int length)
       ^
  376. {
  377.     int ret;

libavcodec/pngdec.c:390:17: Call
  388.         if (s->zstream.avail_out == 0) {
  389.             if (!(s->state & PNG_ALLIMAGE)) {
  390.                 png_handle_row(s);
                       ^
  391.             }
  392.             s->zstream.avail_out = s->crow_size;

libavcodec/pngdec.c:297:1: Parameter `*s->crow_buf`
    295. 
    296. /* process exactly one decompressed row */
    297. static void png_handle_row(PNGDecContext *s)
         ^
    298. {
    299.     uint8_t *ptr, *last_row;

libavcodec/pngdec.c:341:17: Call
    339.                 if (got_line)
    340.                     break;
    341.                 png_filter_row(&s->dsp, s->tmp_row, s->crow_buf[0], s->crow_buf + 1,
                         ^
    342.                                s->last_row, s->pass_row_size, s->bpp);
    343.                 FFSWAP(uint8_t *, s->last_row, s->tmp_row);

libavcodec/pngdec.c:203:1: <LHS trace>
201. 
202. /* NOTE: 'dst' can be equal to 'last' */
203. static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
     ^
204.                            uint8_t *src, uint8_t *last, int size, int bpp)
205. {

libavcodec/pngdec.c:203:1: Parameter `*src`
      201. 
      202. /* NOTE: 'dst' can be equal to 'last' */
      203. static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
           ^
      204.                            uint8_t *src, uint8_t *last, int size, int bpp)
      205. {

libavcodec/pngdec.c:218:17: Assignment
      216.             p = *(int *)dst;
      217.             for (; i < size; i += bpp) {
      218.                 int s = *(int *)(src + i);
                           ^
      219.                 p = ((s & 0x7f7f7f7f) + (p & 0x7f7f7f7f)) ^ ((s ^ p) & 0x80808080);
      220.                 *(int *)(dst + i) = p;

libavcodec/pngdec.c:203:1: <RHS trace>
201. 
202. /* NOTE: 'dst' can be equal to 'last' */
203. static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
     ^
204.                            uint8_t *src, uint8_t *last, int size, int bpp)
205. {

libavcodec/pngdec.c:203:1: Parameter `*dst`
      201. 
      202. /* NOTE: 'dst' can be equal to 'last' */
      203. static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
           ^
      204.                            uint8_t *src, uint8_t *last, int size, int bpp)
      205. {

libavcodec/pngdec.c:216:13: Assignment
      214.             dst[i] = src[i];
      215.         if (bpp == 4) {
      216.             p = *(int *)dst;
                       ^
      217.             for (; i < size; i += bpp) {
      218.                 int s = *(int *)(src + i);

libavcodec/pngdec.c:219:17: Binary operation: ([0, 2139062143] + [0, 2139062143]):signed32 by call to `png_decode_idat` 
      217.             for (; i < size; i += bpp) {
      218.                 int s = *(int *)(src + i);
      219.                 p = ((s & 0x7f7f7f7f) + (p & 0x7f7f7f7f)) ^ ((s ^ p) & 0x80808080);
                           ^
      220.                 *(int *)(dst + i) = p;
      221.             }
