libavformat/bmv.c:93: error: Buffer Overrun L3
  Offset: 1 Size: [0, 2147483631].

libavformat/bmv.c:82:19: <Length trace>
80.         if (type == BMV_END)
81.             return AVERROR_EOF;
82.         c->size = avio_rl24(s->pb);
                      ^
83.         if (!c->size)
84.             return AVERROR_INVALIDDATA;

libavformat/bmv.c:82:19: Call
80.         if (type == BMV_END)
81.             return AVERROR_EOF;
82.         c->size = avio_rl24(s->pb);
                      ^
83.         if (!c->size)
84.             return AVERROR_INVALIDDATA;

libavformat/aviobuf.c:701:11: Call
  699. {
  700.     unsigned int val;
  701.     val = avio_rl16(s);
                 ^
  702.     val |= avio_r8(s) << 16;
  703.     return val;

libavformat/aviobuf.c:693:11: Call
    691. {
    692.     unsigned int val;
    693.     val = avio_r8(s);
                   ^
    694.     val |= avio_r8(s) << 8;
    695.     return val;

libavformat/aviobuf.c:606:5: Assignment
      604.     if (s->buf_ptr < s->buf_end)
      605.         return *s->buf_ptr++;
      606.     return 0;
               ^
      607. }
      608. 

libavformat/aviobuf.c:693:5: Assignment
    691. {
    692.     unsigned int val;
    693.     val = avio_r8(s);
             ^
    694.     val |= avio_r8(s) << 8;
    695.     return val;

libavformat/aviobuf.c:694:5: Assignment
    692.     unsigned int val;
    693.     val = avio_r8(s);
    694.     val |= avio_r8(s) << 8;
             ^
    695.     return val;
    696. }

libavformat/aviobuf.c:695:5: Assignment
    693.     val = avio_r8(s);
    694.     val |= avio_r8(s) << 8;
    695.     return val;
             ^
    696. }
    697. 

libavformat/aviobuf.c:701:5: Assignment
  699. {
  700.     unsigned int val;
  701.     val = avio_rl16(s);
           ^
  702.     val |= avio_r8(s) << 16;
  703.     return val;

libavformat/aviobuf.c:702:5: Assignment
  700.     unsigned int val;
  701.     val = avio_rl16(s);
  702.     val |= avio_r8(s) << 16;
           ^
  703.     return val;
  704. }

libavformat/aviobuf.c:703:5: Assignment
  701.     val = avio_rl16(s);
  702.     val |= avio_r8(s) << 16;
  703.     return val;
           ^
  704. }
  705. 

libavformat/bmv.c:82:9: Assignment
80.         if (type == BMV_END)
81.             return AVERROR_EOF;
82.         c->size = avio_rl24(s->pb);
            ^
83.         if (!c->size)
84.             return AVERROR_INVALIDDATA;

libavformat/bmv.c:85:15: Call
83.         if (!c->size)
84.             return AVERROR_INVALIDDATA;
85.         tmp = av_realloc(c->packet, c->size + 1);
                  ^
86.         if (!tmp)
87.             return AVERROR(ENOMEM);

libavutil/mem.c:125:9: Assignment
  123.     /* let's disallow possible ambiguous cases */
  124.     if(size > (INT_MAX-16) )
  125.         return NULL;
               ^
  126. 
  127. #if CONFIG_MEMALIGN_HACK

libavformat/bmv.c:85:9: Assignment
83.         if (!c->size)
84.             return AVERROR_INVALIDDATA;
85.         tmp = av_realloc(c->packet, c->size + 1);
            ^
86.         if (!tmp)
87.             return AVERROR(ENOMEM);

libavformat/bmv.c:88:9: Assignment
86.         if (!tmp)
87.             return AVERROR(ENOMEM);
88.         c->packet = tmp;
            ^
89.         c->packet[0] = type;
90.         if (avio_read(s->pb, c->packet + 1, c->size) != c->size)

libavformat/bmv.c:93:30: Array access: Offset: 1 Size: [0, 2147483631]
91.             return AVERROR(EIO);
92.         if (type & BMV_AUDIO) {
93.             int audio_size = c->packet[1] * 65 + 1;
                                 ^
94.             if (audio_size >= c->size) {
95.                 av_log(s, AV_LOG_ERROR, "Reported audio size %d is bigger than packet size (%d)\n",
