libavformat/oggparsetheora.c:114: error: Integer Overflow L1
  (0 - 8):unsigned32.

libavformat/oggparsetheora.c:52:15: <LHS trace>
50. 
51.     if(!thp){
52.         thp = av_mallocz(sizeof(*thp));
                  ^
53.         os->private = thp;
54.     }

libavformat/oggparsetheora.c:52:15: Call
50. 
51.     if(!thp){
52.         thp = av_mallocz(sizeof(*thp));
                  ^
53.         os->private = thp;
54.     }

libavutil/mem.c:158:17: Call
  156. void *av_mallocz(size_t size)
  157. {
  158.     void *ptr = av_malloc(size);
                       ^
  159.     if (ptr)
  160.         memset(ptr, 0, size);

libavutil/mem.c:75:9: Assignment
    73.     /* let's disallow possible ambiguous cases */
    74.     if (size > (INT_MAX-32) || !size)
    75.         return NULL;
                ^
    76. 
    77. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:158:5: Assignment
  156. void *av_mallocz(size_t size)
  157. {
  158.     void *ptr = av_malloc(size);
           ^
  159.     if (ptr)
  160.         memset(ptr, 0, size);

libavutil/mem.c:161:5: Assignment
  159.     if (ptr)
  160.         memset(ptr, 0, size);
  161.     return ptr;
           ^
  162. }
  163. 

libavformat/oggparsetheora.c:52:9: Assignment
50. 
51.     if(!thp){
52.         thp = av_mallocz(sizeof(*thp));
            ^
53.         os->private = thp;
54.     }

libavformat/oggparsetheora.c:53:9: Assignment
51.     if(!thp){
52.         thp = av_mallocz(sizeof(*thp));
53.         os->private = thp;
            ^
54.     }
55. 

libavformat/oggparsetheora.c:114:9: Binary operation: (0 - 8):unsigned32
112. 
113.     } else if (os->buf[os->pstart] == 0x83) {
114.         ff_vorbis_comment (s, &st->metadata, os->buf + os->pstart + 7, os->psize - 8);
             ^
115.     }
116. 
