libavformat/oggparsetheora.c:112: error: Integer Overflow L1
  (0 - 8):unsigned32.

libavformat/oggparsetheora.c:51:15: <LHS trace>
49. 
50.     if(!thp){
51.         thp = av_mallocz(sizeof(*thp));
                  ^
52.         os->private = thp;
53.     }

libavformat/oggparsetheora.c:51:15: Call
49. 
50.     if(!thp){
51.         thp = av_mallocz(sizeof(*thp));
                  ^
52.         os->private = thp;
53.     }

libavutil/mem.c:158:17: Call
  156. void *av_mallocz(size_t size)
  157. {
  158.     void *ptr = av_malloc(size);
                       ^
  159.     if (ptr)
  160.         memset(ptr, 0, size);

libavutil/mem.c:73:9: Assignment
    71.     /* let's disallow possible ambiguous cases */
    72.     if(size > (INT_MAX-16) )
    73.         return NULL;
                ^
    74. 
    75. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:158:5: Assignment
  156. void *av_mallocz(size_t size)
  157. {
  158.     void *ptr = av_malloc(size);
           ^
  159.     if (ptr)
  160.         memset(ptr, 0, size);

libavutil/mem.c:161:5: Assignment
  159.     if (ptr)
  160.         memset(ptr, 0, size);
  161.     return ptr;
           ^
  162. }
  163. 

libavformat/oggparsetheora.c:51:9: Assignment
49. 
50.     if(!thp){
51.         thp = av_mallocz(sizeof(*thp));
            ^
52.         os->private = thp;
53.     }

libavformat/oggparsetheora.c:52:9: Assignment
50.     if(!thp){
51.         thp = av_mallocz(sizeof(*thp));
52.         os->private = thp;
            ^
53.     }
54. 

libavformat/oggparsetheora.c:112:9: Binary operation: (0 - 8):unsigned32
110. 
111.     } else if (os->buf[os->pstart] == 0x83) {
112.         ff_vorbis_comment (s, &st->metadata, os->buf + os->pstart + 7, os->psize - 8);
             ^
113.     }
114. 
