libavcodec/sgidec.c:274: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `read_uncompressed_sgi`.

libavcodec/sgidec.c:227:28: Call
225.     dimension            = bytestream2_get_be16(&s->g);
226.     s->width             = bytestream2_get_be16(&s->g);
227.     s->height            = bytestream2_get_be16(&s->g);
                                ^
228.     s->depth             = bytestream2_get_be16(&s->g);
229. 

libavcodec/bytestream.h:91:1: Assignment
  89. DEF(unsigned int, be32, 4, AV_RB32, AV_WB32)
  90. DEF(unsigned int, be24, 3, AV_RB24, AV_WB24)
  91. DEF(unsigned int, be16, 2, AV_RB16, AV_WB16)
      ^
  92. DEF(unsigned int, byte, 1, AV_RB8 , AV_WB8)
  93. 

libavcodec/sgidec.c:227:5: Assignment
225.     dimension            = bytestream2_get_be16(&s->g);
226.     s->width             = bytestream2_get_be16(&s->g);
227.     s->height            = bytestream2_get_be16(&s->g);
         ^
228.     s->depth             = bytestream2_get_be16(&s->g);
229. 

libavcodec/sgidec.c:274:15: Call
272.         ret = read_rle_sgi(out_end, s);
273.     } else {
274.         ret = read_uncompressed_sgi(out_buf, s);
                   ^
275.     }
276. 

libavcodec/sgidec.c:168:1: <LHS trace>
166.  * @return 0 if read success, otherwise return -1.
167.  */
168. static int read_uncompressed_sgi(unsigned char *out_buf, SgiState *s)
     ^
169. {
170.     int x, y, z;

libavcodec/sgidec.c:168:1: Parameter `s->height`
  166.  * @return 0 if read success, otherwise return -1.
  167.  */
  168. static int read_uncompressed_sgi(unsigned char *out_buf, SgiState *s)
       ^
  169. {
  170.     int x, y, z;

libavcodec/sgidec.c:185:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `read_uncompressed_sgi` 
  183.     }
  184. 
  185.     for (y = s->height - 1; y >= 0; y--) {
                ^
  186.         out_end = out_buf + (y * s->linesize);
  187.         if (s->bytes_per_channel == 1) {
