libavcodec/vmdav.c:281: error: Integer Overflow L2
  ([0, `s->size` - `s->buf.offset` + `s->buf.offset` - 17] - 4):unsigned32 by call to `lz_unpack`.

libavcodec/vmdav.c:207:1: Parameter `*s->buf`
205. }
206. 
207. static void vmd_decode(VmdVideoContext *s)
     ^
208. {
209.     int i;

libavcodec/vmdav.c:276:9: Assignment
274.         /* originally UnpackFrame in VAG's code */
275.         pb = p;
276.         pb_size = s->buf + s->size - pb;
             ^
277.         if (pb_size < 1)
278.             return;

libavcodec/vmdav.c:279:23: Assignment
277.         if (pb_size < 1)
278.             return;
279.         meth = *pb++; pb_size--;
                           ^
280.         if (meth & 0x80) {
281.             lz_unpack(pb, pb_size,

libavcodec/vmdav.c:281:13: Call
279.         meth = *pb++; pb_size--;
280.         if (meth & 0x80) {
281.             lz_unpack(pb, pb_size,
                 ^
282.                       s->unpack_buffer, s->unpack_buffer_size);
283.             meth &= 0x7F;

libavcodec/vmdav.c:75:1: <LHS trace>
73. #define QUEUE_MASK 0x0FFF
74. 
75. static void lz_unpack(const unsigned char *src, int src_len,
    ^
76.                       unsigned char *dest, int dest_len)
77. {

libavcodec/vmdav.c:75:1: Parameter `src_len`
  73. #define QUEUE_MASK 0x0FFF
  74. 
  75. static void lz_unpack(const unsigned char *src, int src_len,
      ^
  76.                       unsigned char *dest, int dest_len)
  77. {

libavcodec/vmdav.c:92:5: Assignment
  90. 
  91.     s = src;
  92.     s_len = src_len;
          ^
  93.     d = dest;
  94.     d_end = d + dest_len;

libavcodec/vmdav.c:96:13: Binary operation: ([0, s->size - s->buf.offset + s->buf.offset - 17] - 4):unsigned32 by call to `lz_unpack` 
  94.     d_end = d + dest_len;
  95.     dataleft = AV_RL32(s);
  96.     s += 4; s_len -= 4;
                  ^
  97.     memset(queue, 0x20, QUEUE_SIZE);
  98.     if (s_len < 4)
