libavcodec/sgidec.c:230: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `read_uncompressed_sgi`.

libavcodec/sgidec.c:179:17: Call
177.     dimension = bytestream_get_be16(&in_buf);
178.     s->width  = bytestream_get_be16(&in_buf);
179.     s->height = bytestream_get_be16(&in_buf);
                     ^
180.     s->depth  = bytestream_get_be16(&in_buf);
181. 

libavcodec/bytestream.h:51:1: Call
  49. DEF  (be32, 4, AV_RB32, AV_WB32)
  50. DEF  (be24, 3, AV_RB24, AV_WB24)
  51. DEF  (be16, 2, AV_RB16, AV_WB16)
      ^
  52. DEF  (byte, 1, AV_RB8 , AV_WB8 )
  53. 

libavutil/bswap.h:58:1: Parameter `x`
    56. 
    57. #ifndef av_bswap16
    58. static av_always_inline av_const uint16_t av_bswap16(uint16_t x)
        ^
    59. {
    60.     x= (x>>8) | (x<<8);

libavutil/bswap.h:60:5: Assignment
    58. static av_always_inline av_const uint16_t av_bswap16(uint16_t x)
    59. {
    60.     x= (x>>8) | (x<<8);
            ^
    61.     return x;
    62. }

libavutil/bswap.h:61:5: Assignment
    59. {
    60.     x= (x>>8) | (x<<8);
    61.     return x;
            ^
    62. }
    63. #endif

libavcodec/bytestream.h:51:1: Assignment
  49. DEF  (be32, 4, AV_RB32, AV_WB32)
  50. DEF  (be24, 3, AV_RB24, AV_WB24)
  51. DEF  (be16, 2, AV_RB16, AV_WB16)
      ^
  52. DEF  (byte, 1, AV_RB8 , AV_WB8 )
  53. 

libavcodec/sgidec.c:179:5: Assignment
177.     dimension = bytestream_get_be16(&in_buf);
178.     s->width  = bytestream_get_be16(&in_buf);
179.     s->height = bytestream_get_be16(&in_buf);
         ^
180.     s->depth  = bytestream_get_be16(&in_buf);
181. 

libavcodec/sgidec.c:230:15: Call
228.         ret = read_rle_sgi(out_end, in_buf, in_end, s);
229.     } else {
230.         ret = read_uncompressed_sgi(out_buf, out_end, in_buf, in_end, s);
                   ^
231.     }
232. 

libavcodec/sgidec.c:124:1: <LHS trace>
122.  * @return 0 if read success, otherwise return -1.
123.  */
124. static int read_uncompressed_sgi(unsigned char* out_buf, uint8_t* out_end,
     ^
125.                 const uint8_t *in_buf, const uint8_t *in_end, SgiState* s)
126. {

libavcodec/sgidec.c:124:1: Parameter `s->height`
  122.  * @return 0 if read success, otherwise return -1.
  123.  */
  124. static int read_uncompressed_sgi(unsigned char* out_buf, uint8_t* out_end,
       ^
  125.                 const uint8_t *in_buf, const uint8_t *in_end, SgiState* s)
  126. {

libavcodec/sgidec.c:136:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `read_uncompressed_sgi` 
  134.     }
  135. 
  136.     for (y = s->height - 1; y >= 0; y--) {
                ^
  137.         out_end = out_buf + (y * s->linesize);
  138.         for (x = s->width; x > 0; x--) {
