When bs_read_ue() returned 2^32-1, computing (val + 1) as 'int'
overflowed. With this patch, the conversion from unsigned to signed is
performed after the division by two, so that the absolute value range
is always within limits of the signed 32-bits integer type.

Also use fast types since the function are meant to be inlined.