libavcodec/wmaprodec.c:576: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `decode_subframe_length`.

libavcodec/wmaprodec.c:537:1: Parameter `s->bc.bits_left`
535.  *@return 0 on success, < 0 in case of an error
536.  */
537. static int decode_tilehdr(WMAProDecodeCtx *s)
     ^
538. {
539.     uint16_t num_samples[WMAPRO_MAX_CHANNELS] = { 0 };/**< sum of samples for all currently known subframes of a channel */

libavcodec/wmaprodec.c:576:29: Call
574. 
575.         /** get subframe length, subframe_len == 0 is not allowed */
576.         if ((subframe_len = decode_subframe_length(s, min_channel_len)) <= 0)
                                 ^
577.             return AVERROR_INVALIDDATA;
578. 

libavcodec/wmaprodec.c:488:1: Parameter `s->bc.bits_left`
  486.  *@return decoded subframe length on success, < 0 in case of an error
  487.  */
  488. static int decode_subframe_length(WMAProDecodeCtx *s, int offset)
       ^
  489. {
  490.     int frame_len_shift = 0;

libavcodec/wmaprodec.c:499:13: Call
  497.     /** 1 bit indicates if the subframe is of maximum length */
  498.     if (s->max_subframe_len_bit) {
  499.         if (bitstream_read_bit(&s->bc))
                   ^
  500.             frame_len_shift = 1 + bitstream_read(&s->bc,
  501.                                                  s->subframe_len_bits - 1);

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
    143. 
    144. /* Return one bit from the buffer. */
    145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
         ^
    146. {
    147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
    148.         refill_64(bc);
    149. 
    150.     return get_val(bc, 1);
                    ^
    151. }
    152. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `decode_subframe_length` 
      137.     bc->bits <<= n;
      138. #endif
      139.     bc->bits_left -= n;
               ^
      140. 
      141.     return ret;
