libavcodec/tscc2.c:207: error: Integer Overflow L2
  ([-1, +oo] - 1):unsigned32 by call to `tscc2_decode_mb`.

libavcodec/tscc2.c:192:1: Parameter `c->bc.bits_left`
190. }
191. 
192. static int tscc2_decode_slice(TSCC2Context *c, int mb_y,
     ^
193.                               const uint8_t *buf, int buf_size)
194. {

libavcodec/tscc2.c:198:5: Call
196.     int off;
197. 
198.     bitstream_init8(&c->bc, buf, buf_size);
         ^
199. 
200.     for (mb_x = 0; mb_x < c->mb_width; mb_x++) {

libavcodec/bitstream.h:104:1: Parameter `bc->bits_left`
  102. 
  103. /* Initialize BitstreamContext with buffer size in bytes instead of bits. */
  104. static inline int bitstream_init8(BitstreamContext *bc, const uint8_t *buffer,
       ^
  105.                                   unsigned byte_size)
  106. {

libavcodec/tscc2.c:207:19: Call
205.         for (i = 0; i < 3; i++) {
206.             off = mb_x * 16 + mb_y * 8 * c->pic->linesize[i];
207.             ret = tscc2_decode_mb(c, c->q[q - 1], c->quant[q - 1] - 2,
                       ^
208.                                   c->pic->data[i] + off, c->pic->linesize[i], i);
209.             if (ret)

libavcodec/tscc2.c:127:1: Parameter `c->bc.bits_left`
  125. }
  126. 
  127. static int tscc2_decode_mb(TSCC2Context *c, int *q, int vlc_set,
       ^
  128.                            uint8_t *dst, int stride, int plane)
  129. {

libavcodec/tscc2.c:134:9: Call
  132.     int i, j, k, l;
  133. 
  134.     if (bitstream_read_bit(bc)) {
               ^
  135.         if (bitstream_read_bit(bc)) {
  136.             val = bitstream_read(bc, 8);

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
    143. 
    144. /* Return one bit from the buffer. */
    145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
         ^
    146. {
    147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
    148.         refill_64(bc);
    149. 
    150.     return get_val(bc, 1);
                    ^
    151. }
    152. 

libavcodec/bitstream.h:130:1: Parameter `n`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Assignment
      137.     bc->bits <<= n;
      138. #endif
      139.     bc->bits_left -= n;
               ^
      140. 
      141.     return ret;

libavcodec/tscc2.c:135:13: Call
  133. 
  134.     if (bitstream_read_bit(bc)) {
  135.         if (bitstream_read_bit(bc)) {
                   ^
  136.             val = bitstream_read(bc, 8);
  137.             for (i = 0; i < 8; i++, dst += stride)

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
    143. 
    144. /* Return one bit from the buffer. */
    145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
         ^
    146. {
    147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
    148.         refill_64(bc);
    149. 
    150.     return get_val(bc, 1);
                    ^
    151. }
    152. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([-1, +oo] - 1):unsigned32 by call to `tscc2_decode_mb` 
      137.     bc->bits <<= n;
      138. #endif
      139.     bc->bits_left -= n;
               ^
      140. 
      141.     return ret;
