libavformat/apetag.c:108: error: Integer Overflow L2
  ([32, +oo] - [-oo, 16777248]):unsigned32.

libavformat/apetag.c:69:21: <LHS trace>
67. {
68.     AVIOContext *pb = s->pb;
69.     int file_size = url_fsize(pb);
                        ^
70.     uint32_t val, fields, tag_bytes;
71.     uint8_t buf[8];

libavformat/apetag.c:69:21: Call
67. {
68.     AVIOContext *pb = s->pb;
69.     int file_size = url_fsize(pb);
                        ^
70.     uint32_t val, fields, tag_bytes;
71.     uint8_t buf[8];

libavformat/aviobuf.c:252:9: Assignment
  250. 
  251.     if(!s)
  252.         return AVERROR(EINVAL);
               ^
  253. 
  254.     if (!s->seek)

libavformat/apetag.c:69:5: Assignment
67. {
68.     AVIOContext *pb = s->pb;
69.     int file_size = url_fsize(pb);
        ^
70.     uint32_t val, fields, tag_bytes;
71.     uint8_t buf[8];

libavformat/apetag.c:90:17: <RHS trace>
88.     }
89. 
90.     tag_bytes = avio_rl32(pb); /* tag size */
                    ^
91.     if (tag_bytes - APE_TAG_FOOTER_BYTES > (1024 * 1024 * 16)) {
92.         av_log(s, AV_LOG_ERROR, "Tag size is way too big\n");

libavformat/apetag.c:90:17: Call
88.     }
89. 
90.     tag_bytes = avio_rl32(pb); /* tag size */
                    ^
91.     if (tag_bytes - APE_TAG_FOOTER_BYTES > (1024 * 1024 * 16)) {
92.         av_log(s, AV_LOG_ERROR, "Tag size is way too big\n");

libavformat/aviobuf.c:625:11: Call
  623. {
  624.     unsigned int val;
  625.     val = avio_rl16(s);
                 ^
  626.     val |= avio_rl16(s) << 16;
  627.     return val;

libavformat/aviobuf.c:609:11: Call
    607. {
    608.     unsigned int val;
    609.     val = avio_r8(s);
                   ^
    610.     val |= avio_r8(s) << 8;
    611.     return val;

libavformat/aviobuf.c:524:5: Assignment
      522.     if (s->buf_ptr < s->buf_end)
      523.         return *s->buf_ptr++;
      524.     return 0;
               ^
      525. }
      526. 

libavformat/aviobuf.c:609:5: Assignment
    607. {
    608.     unsigned int val;
    609.     val = avio_r8(s);
             ^
    610.     val |= avio_r8(s) << 8;
    611.     return val;

libavformat/aviobuf.c:610:5: Assignment
    608.     unsigned int val;
    609.     val = avio_r8(s);
    610.     val |= avio_r8(s) << 8;
             ^
    611.     return val;
    612. }

libavformat/aviobuf.c:611:5: Assignment
    609.     val = avio_r8(s);
    610.     val |= avio_r8(s) << 8;
    611.     return val;
             ^
    612. }
    613. 

libavformat/aviobuf.c:625:5: Assignment
  623. {
  624.     unsigned int val;
  625.     val = avio_rl16(s);
           ^
  626.     val |= avio_rl16(s) << 16;
  627.     return val;

libavformat/aviobuf.c:626:5: Assignment
  624.     unsigned int val;
  625.     val = avio_rl16(s);
  626.     val |= avio_rl16(s) << 16;
           ^
  627.     return val;
  628. }

libavformat/aviobuf.c:627:5: Assignment
  625.     val = avio_rl16(s);
  626.     val |= avio_rl16(s) << 16;
  627.     return val;
           ^
  628. }
  629. 

libavformat/apetag.c:90:5: Assignment
88.     }
89. 
90.     tag_bytes = avio_rl32(pb); /* tag size */
        ^
91.     if (tag_bytes - APE_TAG_FOOTER_BYTES > (1024 * 1024 * 16)) {
92.         av_log(s, AV_LOG_ERROR, "Tag size is way too big\n");

libavformat/apetag.c:108:5: Binary operation: ([32, +oo] - [-oo, 16777248]):unsigned32
106.     }
107. 
108.     url_fseek(pb, file_size - tag_bytes, SEEK_SET);
         ^
109. 
110.     for (i=0; i<fields; i++)
