@swirsz: Thanks for the report.

Most of these look like false positives: we're intentionally making use of C's unsigned arithmetic behaviour. Note that these are technically *not* overflows. As the C standard itself says, in C99 §6.2.5, paragraph 9:

> A computation involving unsigned operands can never overflow,
> because a result that cannot be represented by the resulting
> unsigned integer type is reduced modulo the number that is one
> greater than the largest value that can be represented by the
> resulting type. 

.. and we're deliberately depending on exactly that well-defined reduction behaviour.

Would you be able to do a first pass over the results and identify those that might be genuine issues, worthy of further investigation?