libavformat/r3d.c:336: error: Integer Overflow L2
  ([0, +oo] - 8):unsigned32 by call to `r3d_read_redv`.

libavformat/r3d.c:328:13: Call
326. 
327.     while (!err) {
328.         if (read_atom(s, &atom) < 0) {
                 ^
329.             err = -1;
330.             break;

libavformat/r3d.c:43:18: Call
  41. {
  42.     atom->offset = avio_tell(s->pb);
  43.     atom->size = avio_rb32(s->pb);
                       ^
  44.     if (atom->size < 8)
  45.         return -1;

libavformat/aviobuf.c:598:11: Call
    596. {
    597.     unsigned int val;
    598.     val = avio_rb16(s) << 16;
                   ^
    599.     val |= avio_rb16(s);
    600.     return val;

libavformat/aviobuf.c:583:11: Call
      581. {
      582.     unsigned int val;
      583.     val = avio_r8(s) << 8;
                     ^
      584.     val |= avio_r8(s);
      585.     return val;

libavformat/aviobuf.c:449:5: Assignment
        447.     if (s->buf_ptr < s->buf_end)
        448.         return *s->buf_ptr++;
        449.     return 0;
                 ^
        450. }
        451. 

libavformat/aviobuf.c:583:5: Assignment
      581. {
      582.     unsigned int val;
      583.     val = avio_r8(s) << 8;
               ^
      584.     val |= avio_r8(s);
      585.     return val;

libavformat/aviobuf.c:584:5: Assignment
      582.     unsigned int val;
      583.     val = avio_r8(s) << 8;
      584.     val |= avio_r8(s);
               ^
      585.     return val;
      586. }

libavformat/aviobuf.c:585:5: Assignment
      583.     val = avio_r8(s) << 8;
      584.     val |= avio_r8(s);
      585.     return val;
               ^
      586. }
      587. 

libavformat/aviobuf.c:598:5: Assignment
    596. {
    597.     unsigned int val;
    598.     val = avio_rb16(s) << 16;
             ^
    599.     val |= avio_rb16(s);
    600.     return val;

libavformat/aviobuf.c:599:5: Assignment
    597.     unsigned int val;
    598.     val = avio_rb16(s) << 16;
    599.     val |= avio_rb16(s);
             ^
    600.     return val;
    601. }

libavformat/aviobuf.c:600:5: Assignment
    598.     val = avio_rb16(s) << 16;
    599.     val |= avio_rb16(s);
    600.     return val;
             ^
    601. }
    602. 

libavformat/r3d.c:43:5: Assignment
  41. {
  42.     atom->offset = avio_tell(s->pb);
  43.     atom->size = avio_rb32(s->pb);
          ^
  44.     if (atom->size < 8)
  45.         return -1;

libavformat/r3d.c:336:25: Call
334.             if (s->streams[0]->discard == AVDISCARD_ALL)
335.                 goto skip;
336.             if (!(err = r3d_read_redv(s, pkt, &atom)))
                             ^
337.                 return 0;
338.             break;

libavformat/r3d.c:217:1: <LHS trace>
215. }
216. 
217. static int r3d_read_redv(AVFormatContext *s, AVPacket *pkt, Atom *atom)
     ^
218. {
219.     AVStream *st = s->streams[0];

libavformat/r3d.c:217:1: Parameter `atom->size`
  215. }
  216. 
  217. static int r3d_read_redv(AVFormatContext *s, AVPacket *pkt, Atom *atom)
       ^
  218. {
  219.     AVStream *st = s->streams[0];

libavformat/r3d.c:253:5: Binary operation: ([0, +oo] - 8):unsigned32 by call to `r3d_read_redv` 
  251.         av_log(s, AV_LOG_TRACE, "metadata len %d\n", tmp);
  252.     }
  253.     tmp = atom->size - 8 - (avio_tell(s->pb) - pos);
           ^
  254.     if (tmp < 0)
  255.         return -1;
