libavformat/r3d.c:317: error: Integer Overflow L2
  ([0, +oo] - 8):unsigned32 by call to `r3d_read_redv`.

libavformat/r3d.c:309:13: Call
307. 
308.     while (!err) {
309.         if (read_atom(s, &atom) < 0) {
                 ^
310.             err = -1;
311.             break;

libavformat/r3d.c:42:18: Call
  40. {
  41.     atom->offset = url_ftell(s->pb);
  42.     atom->size = get_be32(s->pb);
                       ^
  43.     if (atom->size < 8)
  44.         return -1;

libavformat/aviobuf.c:490:11: Call
    488. {
    489.     unsigned int val;
    490.     val = get_be16(s) << 16;
                   ^
    491.     val |= get_be16(s);
    492.     return val;

libavformat/aviobuf.c:475:11: Call
      473. {
      474.     unsigned int val;
      475.     val = get_byte(s) << 8;
                     ^
      476.     val |= get_byte(s);
      477.     return val;

libavformat/aviobuf.c:361:13: Assignment
        359.             return *s->buf_ptr++;
        360.         else
        361.             return 0;
                         ^
        362.     }
        363. }

libavformat/aviobuf.c:475:5: Assignment
      473. {
      474.     unsigned int val;
      475.     val = get_byte(s) << 8;
               ^
      476.     val |= get_byte(s);
      477.     return val;

libavformat/aviobuf.c:476:5: Assignment
      474.     unsigned int val;
      475.     val = get_byte(s) << 8;
      476.     val |= get_byte(s);
               ^
      477.     return val;
      478. }

libavformat/aviobuf.c:477:5: Assignment
      475.     val = get_byte(s) << 8;
      476.     val |= get_byte(s);
      477.     return val;
               ^
      478. }
      479. 

libavformat/aviobuf.c:490:5: Assignment
    488. {
    489.     unsigned int val;
    490.     val = get_be16(s) << 16;
             ^
    491.     val |= get_be16(s);
    492.     return val;

libavformat/aviobuf.c:491:5: Assignment
    489.     unsigned int val;
    490.     val = get_be16(s) << 16;
    491.     val |= get_be16(s);
             ^
    492.     return val;
    493. }

libavformat/aviobuf.c:492:5: Assignment
    490.     val = get_be16(s) << 16;
    491.     val |= get_be16(s);
    492.     return val;
             ^
    493. }
    494. 

libavformat/r3d.c:42:5: Assignment
  40. {
  41.     atom->offset = url_ftell(s->pb);
  42.     atom->size = get_be32(s->pb);
          ^
  43.     if (atom->size < 8)
  44.         return -1;

libavformat/r3d.c:317:25: Call
315.             if (s->streams[0]->discard == AVDISCARD_ALL)
316.                 goto skip;
317.             if (!(err = r3d_read_redv(s, pkt, &atom)))
                             ^
318.                 return 0;
319.             break;

libavformat/r3d.c:207:1: <LHS trace>
205. }
206. 
207. static int r3d_read_redv(AVFormatContext *s, AVPacket *pkt, Atom *atom)
     ^
208. {
209.     AVStream *st = s->streams[0];

libavformat/r3d.c:207:1: Parameter `atom->size`
  205. }
  206. 
  207. static int r3d_read_redv(AVFormatContext *s, AVPacket *pkt, Atom *atom)
       ^
  208. {
  209.     AVStream *st = s->streams[0];

libavformat/r3d.c:241:5: Binary operation: ([0, +oo] - 8):unsigned32 by call to `r3d_read_redv` 
  239.         dprintf(s, "metadata len %d\n", tmp);
  240.     }
  241.     tmp = atom->size - 8 - (url_ftell(s->pb) - pos);
           ^
  242.     if (tmp < 0)
  243.         return -1;
