libavformat/bmv.c:93: error: Buffer Overrun L3
  Offset: 1 Size: [1, 2147483631].

libavformat/bmv.c:84:19: <Length trace>
82.         if (type == BMV_END)
83.             return AVERROR_EOF;
84.         c->size = avio_rl24(s->pb);
                      ^
85.         if (!c->size)
86.             return AVERROR_INVALIDDATA;

libavformat/bmv.c:84:19: Call
82.         if (type == BMV_END)
83.             return AVERROR_EOF;
84.         c->size = avio_rl24(s->pb);
                      ^
85.         if (!c->size)
86.             return AVERROR_INVALIDDATA;

libavformat/aviobuf.c:559:11: Call
  557. {
  558.     unsigned int val;
  559.     val = avio_rl16(s);
                 ^
  560.     val |= avio_r8(s) << 16;
  561.     return val;

libavformat/aviobuf.c:551:11: Call
    549. {
    550.     unsigned int val;
    551.     val = avio_r8(s);
                   ^
    552.     val |= avio_r8(s) << 8;
    553.     return val;

libavformat/aviobuf.c:449:5: Assignment
      447.     if (s->buf_ptr < s->buf_end)
      448.         return *s->buf_ptr++;
      449.     return 0;
               ^
      450. }
      451. 

libavformat/aviobuf.c:551:5: Assignment
    549. {
    550.     unsigned int val;
    551.     val = avio_r8(s);
             ^
    552.     val |= avio_r8(s) << 8;
    553.     return val;

libavformat/aviobuf.c:552:5: Assignment
    550.     unsigned int val;
    551.     val = avio_r8(s);
    552.     val |= avio_r8(s) << 8;
             ^
    553.     return val;
    554. }

libavformat/aviobuf.c:553:5: Assignment
    551.     val = avio_r8(s);
    552.     val |= avio_r8(s) << 8;
    553.     return val;
             ^
    554. }
    555. 

libavformat/aviobuf.c:559:5: Assignment
  557. {
  558.     unsigned int val;
  559.     val = avio_rl16(s);
           ^
  560.     val |= avio_r8(s) << 16;
  561.     return val;

libavformat/aviobuf.c:560:5: Assignment
  558.     unsigned int val;
  559.     val = avio_rl16(s);
  560.     val |= avio_r8(s) << 16;
           ^
  561.     return val;
  562. }

libavformat/aviobuf.c:561:5: Assignment
  559.     val = avio_rl16(s);
  560.     val |= avio_r8(s) << 16;
  561.     return val;
           ^
  562. }
  563. 

libavformat/bmv.c:84:9: Assignment
82.         if (type == BMV_END)
83.             return AVERROR_EOF;
84.         c->size = avio_rl24(s->pb);
            ^
85.         if (!c->size)
86.             return AVERROR_INVALIDDATA;

libavformat/bmv.c:87:20: Call
85.         if (!c->size)
86.             return AVERROR_INVALIDDATA;
87.         if ((err = av_reallocp(&c->packet, c->size + 1)) < 0)
                       ^
88.             return err;
89.         c->packet[0] = type;

libavutil/mem.c:145:9: Call
  143. 
  144.     if (!size) {
  145.         av_freep(ptr);
               ^
  146.         return 0;
  147.     }

libavutil/mem.c:207:26: Assignment
    205. 
    206.     memcpy(&val, arg, sizeof(val));
    207.     memcpy(arg, &(void *){ NULL }, sizeof(val));
                                  ^
    208.     av_free(val);
    209. }

libavformat/bmv.c:93:30: Array access: Offset: 1 Size: [1, 2147483631]
91.             return AVERROR(EIO);
92.         if (type & BMV_AUDIO) {
93.             int audio_size = c->packet[1] * 65 + 1;
                                 ^
94.             if (audio_size >= c->size) {
95.                 av_log(s, AV_LOG_ERROR, "Reported audio size %d is bigger than packet size (%d)\n",
