libavcodec/sgidec.c:228: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `read_uncompressed_sgi`.

libavcodec/sgidec.c:177:17: Call
175.     dimension = bytestream_get_be16(&in_buf);
176.     s->width  = bytestream_get_be16(&in_buf);
177.     s->height = bytestream_get_be16(&in_buf);
                     ^
178.     s->depth  = bytestream_get_be16(&in_buf);
179. 

libavcodec/bytestream.h:51:1: Call
  49. DEF  (be32, 4, AV_RB32, AV_WB32)
  50. DEF  (be24, 3, AV_RB24, AV_WB24)
  51. DEF  (be16, 2, AV_RB16, AV_WB16)
      ^
  52. DEF  (byte, 1, AV_RB8 , AV_WB8 )
  53. 

libavutil/bswap.h:44:1: Parameter `x`
    42. 
    43. #ifndef bswap_16
    44. static av_always_inline av_const uint16_t bswap_16(uint16_t x)
        ^
    45. {
    46.     x= (x>>8) | (x<<8);

libavutil/bswap.h:46:5: Assignment
    44. static av_always_inline av_const uint16_t bswap_16(uint16_t x)
    45. {
    46.     x= (x>>8) | (x<<8);
            ^
    47.     return x;
    48. }

libavutil/bswap.h:47:5: Assignment
    45. {
    46.     x= (x>>8) | (x<<8);
    47.     return x;
            ^
    48. }
    49. #endif

libavcodec/bytestream.h:51:1: Assignment
  49. DEF  (be32, 4, AV_RB32, AV_WB32)
  50. DEF  (be24, 3, AV_RB24, AV_WB24)
  51. DEF  (be16, 2, AV_RB16, AV_WB16)
      ^
  52. DEF  (byte, 1, AV_RB8 , AV_WB8 )
  53. 

libavcodec/sgidec.c:177:5: Assignment
175.     dimension = bytestream_get_be16(&in_buf);
176.     s->width  = bytestream_get_be16(&in_buf);
177.     s->height = bytestream_get_be16(&in_buf);
         ^
178.     s->depth  = bytestream_get_be16(&in_buf);
179. 

libavcodec/sgidec.c:228:15: Call
226.         ret = read_rle_sgi(out_end, in_buf, in_end, s);
227.     } else {
228.         ret = read_uncompressed_sgi(out_buf, out_end, in_buf, in_end, s);
                   ^
229.     }
230. 

libavcodec/sgidec.c:123:1: <LHS trace>
121.  * @return 0 if read success, otherwise return -1.
122.  */
123. static int read_uncompressed_sgi(unsigned char* out_buf, uint8_t* out_end,
     ^
124.                 const uint8_t *in_buf, const uint8_t *in_end, SgiState* s)
125. {

libavcodec/sgidec.c:123:1: Parameter `s->height`
  121.  * @return 0 if read success, otherwise return -1.
  122.  */
  123. static int read_uncompressed_sgi(unsigned char* out_buf, uint8_t* out_end,
       ^
  124.                 const uint8_t *in_buf, const uint8_t *in_end, SgiState* s)
  125. {

libavcodec/sgidec.c:135:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `read_uncompressed_sgi` 
  133.     }
  134. 
  135.     for (y = s->height - 1; y >= 0; y--) {
                ^
  136.         out_end = out_buf + (y * s->linesize);
  137.         for (x = s->width; x > 0; x--) {
