libavcodec/vmdav.c:283: error: Integer Overflow L2
  ([0, `s->size` - `s->buf.offset` + `s->buf.offset` - 17] - 4):unsigned32 by call to `lz_unpack`.

libavcodec/vmdav.c:209:1: Parameter `*s->buf`
207. }
208. 
209. static void vmd_decode(VmdVideoContext *s, AVFrame *frame)
     ^
210. {
211.     int i;

libavcodec/vmdav.c:278:9: Assignment
276.         /* originally UnpackFrame in VAG's code */
277.         pb = p;
278.         pb_size = s->buf + s->size - pb;
             ^
279.         if (pb_size < 1)
280.             return;

libavcodec/vmdav.c:281:23: Assignment
279.         if (pb_size < 1)
280.             return;
281.         meth = *pb++; pb_size--;
                           ^
282.         if (meth & 0x80) {
283.             lz_unpack(pb, pb_size,

libavcodec/vmdav.c:283:13: Call
281.         meth = *pb++; pb_size--;
282.         if (meth & 0x80) {
283.             lz_unpack(pb, pb_size,
                 ^
284.                       s->unpack_buffer, s->unpack_buffer_size);
285.             meth &= 0x7F;

libavcodec/vmdav.c:77:1: <LHS trace>
75. #define QUEUE_MASK 0x0FFF
76. 
77. static void lz_unpack(const unsigned char *src, int src_len,
    ^
78.                       unsigned char *dest, int dest_len)
79. {

libavcodec/vmdav.c:77:1: Parameter `src_len`
  75. #define QUEUE_MASK 0x0FFF
  76. 
  77. static void lz_unpack(const unsigned char *src, int src_len,
      ^
  78.                       unsigned char *dest, int dest_len)
  79. {

libavcodec/vmdav.c:94:5: Assignment
  92. 
  93.     s = src;
  94.     s_len = src_len;
          ^
  95.     d = dest;
  96.     d_end = d + dest_len;

libavcodec/vmdav.c:98:13: Binary operation: ([0, s->size - s->buf.offset + s->buf.offset - 17] - 4):unsigned32 by call to `lz_unpack` 
   96.     d_end = d + dest_len;
   97.     dataleft = AV_RL32(s);
   98.     s += 4; s_len -= 4;
                   ^
   99.     memset(queue, 0x20, QUEUE_SIZE);
  100.     if (s_len < 4)
