libavcodec/4xm.c:890: error: Integer Overflow L2
  ([min(8, `*avpkt->data`), +oo] - [-oo, 134217748]):unsigned32 by call to `decode_p_frame`.

libavcodec/4xm.c:787:1: Parameter `*avpkt->data`
785. }
786. 
787. static int decode_frame(AVCodecContext *avctx, void *data,
     ^
788.                         int *got_frame, AVPacket *avpkt)
789. {

libavcodec/4xm.c:852:9: Assignment
850. 
851.         memcpy(cfrm->data + cfrm->size, buf + 20, data_size);
852.         cfrm->size += data_size;
             ^
853. 
854.         if (cfrm->size >= whole_size) {

libavcodec/4xm.c:856:13: Assignment
854.         if (cfrm->size >= whole_size) {
855.             buf        = cfrm->data;
856.             frame_size = cfrm->size;
                 ^
857. 
858.             if (id != avctx->frame_number)

libavcodec/4xm.c:890:20: Call
888.     } else if (frame_4cc == AV_RL32("pfrm") || frame_4cc == AV_RL32("pfr2")) {
889.         picture->pict_type = AV_PICTURE_TYPE_P;
890.         if ((ret = decode_p_frame(f, buf, frame_size)) < 0)
                        ^
891.             return ret;
892.     } else if (frame_4cc == AV_RL32("snd_")) {

libavcodec/4xm.c:400:1: <LHS trace>
398. }
399. 
400. static int decode_p_frame(FourXContext *f, const uint8_t *buf, int length)
     ^
401. {
402.     int x, y;

libavcodec/4xm.c:400:1: Parameter `length`
  398. }
  399. 
  400. static int decode_p_frame(FourXContext *f, const uint8_t *buf, int length)
       ^
  401. {
  402.     int x, y;

libavcodec/4xm.c:416:9: <RHS trace>
414.         if (length < 20)
415.             return AVERROR_INVALIDDATA;
416.         extra           = 20;
             ^
417.         bitstream_size  = AV_RL32(buf + 8);
418.         wordstream_size = AV_RL32(buf + 12);

libavcodec/4xm.c:416:9: Assignment
  414.         if (length < 20)
  415.             return AVERROR_INVALIDDATA;
  416.         extra           = 20;
               ^
  417.         bitstream_size  = AV_RL32(buf + 8);
  418.         wordstream_size = AV_RL32(buf + 12);

libavcodec/4xm.c:448:5: Assignment
  446. 
  447.     wordstream_offset = extra + bitstream_size;
  448.     bytestream_offset = extra + bitstream_size + wordstream_size;
           ^
  449.     bytestream2_init(&f->g2, buf + wordstream_offset,
  450.                      length - wordstream_offset);

libavcodec/4xm.c:451:5: Binary operation: ([min(8, *avpkt->data), +oo] - [-oo, 134217748]):unsigned32 by call to `decode_p_frame` 
  449.     bytestream2_init(&f->g2, buf + wordstream_offset,
  450.                      length - wordstream_offset);
  451.     bytestream2_init(&f->g, buf + bytestream_offset,
           ^
  452.                      length - bytestream_offset);
  453. 
