libavcodec/h264_parser.c:242: error: Buffer Overrun L3
  Offset: [2, +oo] Size: [1, 2147483631] by call to `ff_h264_decode_sei`.

libavcodec/h264_parser.c:201:5: Call
199. 
200.     h->avctx = avctx;
201.     ff_h264_reset_sei(h);
         ^
202. 
203.     if (!buf_size)

libavcodec/h264_sei.c:47:5: Assignment
  45.     h->sei_reguserdata_afd_present  =  0;
  46. 
  47.     h->a53_caption_size = 0;
          ^
  48.     av_freep(&h->a53_caption);
  49. }

libavcodec/h264_parser.c:242:13: Call
240.             break;
241.         case NAL_SEI:
242.             ff_h264_decode_sei(h);
                 ^
243.             break;
244.         case NAL_IDR_SLICE:

libavcodec/h264_sei.c:324:1: Parameter `h->a53_caption_size`
  322. }
  323. 
  324. int ff_h264_decode_sei(H264Context *h)
       ^
  325. {
  326.     while (get_bits_left(&h->gb) > 16) {

libavcodec/h264_sei.c:356:19: Call
  354.             break;
  355.         case SEI_TYPE_USER_DATA_REGISTERED:
  356.             ret = decode_registered_user_data(h, size);
                         ^
  357.             break;
  358.         case SEI_TYPE_USER_DATA_UNREGISTERED:

libavcodec/h264_sei.c:177:1: Parameter `h->a53_caption_size`
    175. }
    176. 
    177. static int decode_registered_user_data(H264Context *h, int size)
         ^
    178. {
    179.     uint32_t country_code;

libavcodec/h264_sei.c:201:20: Call
    199.             return decode_registered_user_data_afd(h, size);
    200.         case MKBETAG('G', 'A', '9', '4'):       // closed captions
    201.             return decode_registered_user_data_closed_caption(h, size);
                            ^
    202.         default:
    203.             skip_bits(&h->gb, size * 8);

libavcodec/h264_sei.c:130:1: <Offset trace>
128. }
129. 
130. static int decode_registered_user_data_closed_caption(H264Context *h, int size)
     ^
131. {
132.     int flag;

libavcodec/h264_sei.c:130:1: Parameter `h->a53_caption_size`
      128. }
      129. 
      130. static int decode_registered_user_data_closed_caption(H264Context *h, int size)
           ^
      131. {
      132.     int flag;

libavcodec/h264_sei.c:164:36: Assignment
      162. 
      163.                 for (i = 0; i < cc_count; i++) {
      164.                     h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
                                              ^
      165.                     h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
      166.                     h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);

libavcodec/h264_sei.c:165:36: Assignment
      163.                 for (i = 0; i < cc_count; i++) {
      164.                     h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
      165.                     h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
                                              ^
      166.                     h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
      167.                 }

libavcodec/h264_sei.c:146:24: <Length trace>
144.         if (flag) {
145.             skip_bits(&h->gb, 1);       // zero bit
146.             cc_count = get_bits(&h->gb, 5);
                            ^
147.             skip_bits(&h->gb, 8);       // reserved
148.             size -= 2;

libavcodec/h264_sei.c:146:24: Call
      144.         if (flag) {
      145.             skip_bits(&h->gb, 1);       // zero bit
      146.             cc_count = get_bits(&h->gb, 5);
                                  ^
      147.             skip_bits(&h->gb, 8);       // reserved
      148.             size -= 2;

libavcodec/get_bits.h:245:5: Call
        243.     register int tmp;
        244.     OPEN_READER(re, s);
        245.     UPDATE_CACHE(re, s);
                 ^
        246.     tmp = SHOW_UBITS(re, s, n);
        247.     LAST_SKIP_BITS(re, s, n);

libavutil/ppc/intreadwrite.h:63:5: Assignment
          61.     uint32_t v;
          62.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
          63.     return v;
                  ^
          64. }
          65. 

libavcodec/get_bits.h:245:5: Assignment
        243.     register int tmp;
        244.     OPEN_READER(re, s);
        245.     UPDATE_CACHE(re, s);
                 ^
        246.     tmp = SHOW_UBITS(re, s, n);
        247.     LAST_SKIP_BITS(re, s, n);

libavcodec/get_bits.h:246:5: Assignment
        244.     OPEN_READER(re, s);
        245.     UPDATE_CACHE(re, s);
        246.     tmp = SHOW_UBITS(re, s, n);
                 ^
        247.     LAST_SKIP_BITS(re, s, n);
        248.     CLOSE_READER(re, s);

libavcodec/get_bits.h:249:5: Assignment
        247.     LAST_SKIP_BITS(re, s, n);
        248.     CLOSE_READER(re, s);
        249.     return tmp;
                 ^
        250. }
        251. 

libavcodec/h264_sei.c:146:13: Assignment
      144.         if (flag) {
      145.             skip_bits(&h->gb, 1);       // zero bit
      146.             cc_count = get_bits(&h->gb, 5);
                       ^
      147.             skip_bits(&h->gb, 8);       // reserved
      148.             size -= 2;

libavcodec/h264_sei.c:151:17: Assignment
      149. 
      150.             if (cc_count && size >= cc_count * 3) {
      151.                 const uint64_t new_size = (h->a53_caption_size + cc_count
                           ^
      152.                                            * UINT64_C(3));
      153.                 int i, ret;

libavcodec/h264_sei.c:159:23: Call
      157. 
      158.                 /* Allow merging of the cc data from two fields. */
      159.                 ret = av_reallocp(&h->a53_caption, new_size);
                                 ^
      160.                 if (ret < 0)
      161.                     return ret;

libavutil/mem.c:145:9: Call
        143. 
        144.     if (!size) {
        145.         av_freep(ptr);
                     ^
        146.         return 0;
        147.     }

libavutil/mem.c:207:26: Assignment
          205. 
          206.     memcpy(&val, arg, sizeof(val));
          207.     memcpy(arg, &(void *){ NULL }, sizeof(val));
                                        ^
          208.     av_free(val);
          209. }

libavcodec/h264_sei.c:166:21: Array access: Offset: [2, +oo] Size: [1, 2147483631] by call to `ff_h264_decode_sei` 
      164.                     h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
      165.                     h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
      166.                     h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
                               ^
      167.                 }
      168. 

static int decode_registered_user_data_closed_caption(H264Context *h, int size)
{
    int flag;
    int user_data_type_code;
    int cc_count;
    if (size < 3)
        return AVERROR(EINVAL);
    user_data_type_code = get_bits(&h->gb, 8);
    if (user_data_type_code == 0x3) {
        skip_bits(&h->gb, 1);
        flag = get_bits(&h->gb, 1);
        if (flag) {
            skip_bits(&h->gb, 1);
            cc_count = get_bits(&h->gb, 5);
            skip_bits(&h->gb, 8);
            size -= 2;
            if (cc_count && size >= cc_count * 3) {
                const uint64_t new_size = (h->a53_caption_size + cc_count
                                           * UINT64_C(3));
                int i, ret;
                if (new_size > INT_MAX)
                    return AVERROR(EINVAL);
                ret = av_reallocp(&h->a53_caption, new_size);
                if (ret < 0)
                    return ret;
                for (i = 0; i < cc_count; i++) {
                    h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
                    h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
                    h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
                }
                skip_bits(&h->gb, 8);
            }
        }
    }
    return 0;
}
['static inline int parse_nal_units(AVCodecParserContext *s,\n                                  AVCodecContext *avctx,\n                                  const uint8_t *buf, int buf_size)\n{\n    H264ParseContext *p = s->priv_data;\n    H264Context      *h = &p->h;\n    H264SliceContext *sl = &h->slice_ctx[0];\n    const uint8_t *buf_end = buf + buf_size;\n    unsigned int pps_id;\n    unsigned int slice_type;\n    int state = -1, got_reset = 0;\n    const uint8_t *ptr;\n    int field_poc[2];\n    s->pict_type         = AV_PICTURE_TYPE_I;\n    s->key_frame         = 0;\n    s->picture_structure = AV_PICTURE_STRUCTURE_UNKNOWN;\n    h->avctx = avctx;\n    ff_h264_reset_sei(h);\n    if (!buf_size)\n        return 0;\n    for (;;) {\n        int src_length, dst_length, consumed;\n        buf = avpriv_find_start_code(buf, buf_end, &state);\n        if (buf >= buf_end)\n            break;\n        --buf;\n        src_length = buf_end - buf;\n        switch (state & 0x1f) {\n        case NAL_SLICE:\n        case NAL_IDR_SLICE:\n            if ((state & 0x1f) == NAL_IDR_SLICE || ((state >> 5) & 0x3) == 0) {\n                if (src_length > 60)\n                    src_length = 60;\n            } else {\n                if (src_length > 1000)\n                    src_length = 1000;\n            }\n            break;\n        }\n        ptr = ff_h264_decode_nal(h, sl, buf, &dst_length, &consumed, src_length);\n        if (!ptr || dst_length < 0)\n            break;\n        init_get_bits(&h->gb, ptr, 8 * dst_length);\n        switch (h->nal_unit_type) {\n        case NAL_SPS:\n            ff_h264_decode_seq_parameter_set(h);\n            break;\n        case NAL_PPS:\n            ff_h264_decode_picture_parameter_set(h, h->gb.size_in_bits);\n            break;\n        case NAL_SEI:\n            ff_h264_decode_sei(h);\n            break;\n        case NAL_IDR_SLICE:\n            s->key_frame = 1;\n            h->prev_frame_num        = 0;\n            h->prev_frame_num_offset = 0;\n            h->prev_poc_msb          =\n            h->prev_poc_lsb          = 0;\n        case NAL_SLICE:\n            init_get_bits(&sl->gb, ptr, 8 * dst_length);\n            get_ue_golomb(&sl->gb);\n            slice_type   = get_ue_golomb_31(&sl->gb);\n            s->pict_type = golomb_to_pict_type[slice_type % 5];\n            if (h->sei_recovery_frame_cnt >= 0) {\n                s->key_frame = 1;\n            }\n            pps_id = get_ue_golomb(&sl->gb);\n            if (pps_id >= MAX_PPS_COUNT) {\n                av_log(h->avctx, AV_LOG_ERROR,\n                       "pps_id %u out of range\\n", pps_id);\n                return -1;\n            }\n            if (!h->pps_buffers[pps_id]) {\n                av_log(h->avctx, AV_LOG_ERROR,\n                       "non-existing PPS %u referenced\\n", pps_id);\n                return -1;\n            }\n            h->pps = *h->pps_buffers[pps_id];\n            if (!h->sps_buffers[h->pps.sps_id]) {\n                av_log(h->avctx, AV_LOG_ERROR,\n                       "non-existing SPS %u referenced\\n", h->pps.sps_id);\n                return -1;\n            }\n            h->sps       = *h->sps_buffers[h->pps.sps_id];\n            h->frame_num = get_bits(&sl->gb, h->sps.log2_max_frame_num);\n            s->coded_width  = 16 * h->sps.mb_width;\n            s->coded_height = 16 * h->sps.mb_height;\n            s->width        = s->coded_width  - (h->sps.crop_right + h->sps.crop_left);\n            s->height       = s->coded_height - (h->sps.crop_top   + h->sps.crop_bottom);\n            if (s->width <= 0 || s->height <= 0) {\n                s->width  = s->coded_width;\n                s->height = s->coded_height;\n            }\n            switch (h->sps.bit_depth_luma) {\n            case 9:\n                if (CHROMA444(h))      s->format = AV_PIX_FMT_YUV444P9;\n                else if (CHROMA422(h)) s->format = AV_PIX_FMT_YUV422P9;\n                else                   s->format = AV_PIX_FMT_YUV420P9;\n                break;\n            case 10:\n                if (CHROMA444(h))      s->format = AV_PIX_FMT_YUV444P10;\n                else if (CHROMA422(h)) s->format = AV_PIX_FMT_YUV422P10;\n                else                   s->format = AV_PIX_FMT_YUV420P10;\n                break;\n            case 8:\n                if (CHROMA444(h))      s->format = AV_PIX_FMT_YUV444P;\n                else if (CHROMA422(h)) s->format = AV_PIX_FMT_YUV422P;\n                else                   s->format = AV_PIX_FMT_YUV420P;\n                break;\n            default:\n                s->format = AV_PIX_FMT_NONE;\n            }\n            avctx->profile = ff_h264_get_profile(&h->sps);\n            avctx->level   = h->sps.level_idc;\n            if (h->sps.frame_mbs_only_flag) {\n                h->picture_structure = PICT_FRAME;\n            } else {\n                if (get_bits1(&sl->gb)) {\n                    h->picture_structure = PICT_TOP_FIELD + get_bits1(&sl->gb);\n                } else {\n                    h->picture_structure = PICT_FRAME;\n                }\n            }\n            if (h->nal_unit_type == NAL_IDR_SLICE)\n                get_ue_golomb(&sl->gb);\n            if (h->sps.poc_type == 0) {\n                h->poc_lsb = get_bits(&sl->gb, h->sps.log2_max_poc_lsb);\n                if (h->pps.pic_order_present == 1 &&\n                    h->picture_structure == PICT_FRAME)\n                    h->delta_poc_bottom = get_se_golomb(&sl->gb);\n            }\n            if (h->sps.poc_type == 1 &&\n                !h->sps.delta_pic_order_always_zero_flag) {\n                h->delta_poc[0] = get_se_golomb(&sl->gb);\n                if (h->pps.pic_order_present == 1 &&\n                    h->picture_structure == PICT_FRAME)\n                    h->delta_poc[1] = get_se_golomb(&sl->gb);\n            }\n            field_poc[0] = field_poc[1] = INT_MAX;\n            ff_init_poc(h, field_poc, &s->output_picture_number);\n            if (h->nal_ref_idc && h->nal_unit_type != NAL_IDR_SLICE) {\n                got_reset = scan_mmco_reset(s);\n                if (got_reset < 0)\n                    return got_reset;\n            }\n            h->prev_frame_num        = got_reset ? 0 : h->frame_num;\n            h->prev_frame_num_offset = got_reset ? 0 : h->frame_num_offset;\n            if (h->nal_ref_idc != 0) {\n                if (!got_reset) {\n                    h->prev_poc_msb = h->poc_msb;\n                    h->prev_poc_lsb = h->poc_lsb;\n                } else {\n                    h->prev_poc_msb = 0;\n                    h->prev_poc_lsb =\n                        h->picture_structure == PICT_BOTTOM_FIELD ? 0 : field_poc[0];\n                }\n            }\n            if (h->sps.pic_struct_present_flag) {\n                switch (h->sei_pic_struct) {\n                case SEI_PIC_STRUCT_TOP_FIELD:\n                case SEI_PIC_STRUCT_BOTTOM_FIELD:\n                    s->repeat_pict = 0;\n                    break;\n                case SEI_PIC_STRUCT_FRAME:\n                case SEI_PIC_STRUCT_TOP_BOTTOM:\n                case SEI_PIC_STRUCT_BOTTOM_TOP:\n                    s->repeat_pict = 1;\n                    break;\n                case SEI_PIC_STRUCT_TOP_BOTTOM_TOP:\n                case SEI_PIC_STRUCT_BOTTOM_TOP_BOTTOM:\n                    s->repeat_pict = 2;\n                    break;\n                case SEI_PIC_STRUCT_FRAME_DOUBLING:\n                    s->repeat_pict = 3;\n                    break;\n                case SEI_PIC_STRUCT_FRAME_TRIPLING:\n                    s->repeat_pict = 5;\n                    break;\n                default:\n                    s->repeat_pict = h->picture_structure == PICT_FRAME ? 1 : 0;\n                    break;\n                }\n            } else {\n                s->repeat_pict = h->picture_structure == PICT_FRAME ? 1 : 0;\n            }\n            if (h->picture_structure == PICT_FRAME) {\n                s->picture_structure = AV_PICTURE_STRUCTURE_FRAME;\n                if (h->sps.pic_struct_present_flag) {\n                    switch (h->sei_pic_struct) {\n                    case SEI_PIC_STRUCT_TOP_BOTTOM:\n                    case SEI_PIC_STRUCT_TOP_BOTTOM_TOP:\n                        s->field_order = AV_FIELD_TT;\n                        break;\n                    case SEI_PIC_STRUCT_BOTTOM_TOP:\n                    case SEI_PIC_STRUCT_BOTTOM_TOP_BOTTOM:\n                        s->field_order = AV_FIELD_BB;\n                        break;\n                    default:\n                        s->field_order = AV_FIELD_PROGRESSIVE;\n                        break;\n                    }\n                } else {\n                    if (field_poc[0] < field_poc[1])\n                        s->field_order = AV_FIELD_TT;\n                    else if (field_poc[0] > field_poc[1])\n                        s->field_order = AV_FIELD_BB;\n                    else\n                        s->field_order = AV_FIELD_PROGRESSIVE;\n                }\n            } else {\n                if (h->picture_structure == PICT_TOP_FIELD)\n                    s->picture_structure = AV_PICTURE_STRUCTURE_TOP_FIELD;\n                else\n                    s->picture_structure = AV_PICTURE_STRUCTURE_BOTTOM_FIELD;\n                s->field_order = AV_FIELD_UNKNOWN;\n            }\n            return 0;\n        }\n        buf += consumed;\n    }\n    av_log(h->avctx, AV_LOG_ERROR, "missing picture in access unit\\n");\n    return -1;\n}', 'void ff_h264_reset_sei(H264Context *h)\n{\n    h->sei_recovery_frame_cnt       = -1;\n    h->sei_dpb_output_delay         =  0;\n    h->sei_cpb_removal_delay        = -1;\n    h->sei_buffering_period_present =  0;\n    h->sei_frame_packing_present    =  0;\n    h->sei_display_orientation_present = 0;\n    h->sei_reguserdata_afd_present  =  0;\n    h->a53_caption_size = 0;\n    av_freep(&h->a53_caption);\n}', 'int ff_h264_decode_sei(H264Context *h)\n{\n    while (get_bits_left(&h->gb) > 16) {\n        int size = 0;\n        int type = 0;\n        int ret  = 0;\n        int last = 0;\n        while (get_bits_left(&h->gb) >= 8 &&\n               (last = get_bits(&h->gb, 8)) == 255) {\n            type += 255;\n        }\n        type += last;\n        last = 0;\n        while (get_bits_left(&h->gb) >= 8 &&\n               (last = get_bits(&h->gb, 8)) == 255) {\n            size += 255;\n        }\n        size += last;\n        if (size > get_bits_left(&h->gb) / 8) {\n            av_log(h->avctx, AV_LOG_ERROR, "SEI type %d truncated at %d\\n",\n                   type, get_bits_left(&h->gb));\n            return AVERROR_INVALIDDATA;\n        }\n        switch (type) {\n        case SEI_TYPE_PIC_TIMING:\n            ret = decode_picture_timing(h);\n            break;\n        case SEI_TYPE_USER_DATA_REGISTERED:\n            ret = decode_registered_user_data(h, size);\n            break;\n        case SEI_TYPE_USER_DATA_UNREGISTERED:\n            ret = decode_unregistered_user_data(h, size);\n            break;\n        case SEI_TYPE_RECOVERY_POINT:\n            ret = decode_recovery_point(h);\n            break;\n        case SEI_TYPE_BUFFERING_PERIOD:\n            ret = decode_buffering_period(h);\n            break;\n        case SEI_TYPE_FRAME_PACKING:\n            ret = decode_frame_packing_arrangement(h);\n            break;\n        case SEI_TYPE_DISPLAY_ORIENTATION:\n            ret = decode_display_orientation(h);\n            break;\n        default:\n            av_log(h->avctx, AV_LOG_DEBUG, "unknown SEI type %d\\n", type);\n            skip_bits(&h->gb, 8 * size);\n        }\n        if (ret < 0)\n            return ret;\n        align_get_bits(&h->gb);\n    }\n    return 0;\n}', "static int decode_registered_user_data(H264Context *h, int size)\n{\n    uint32_t country_code;\n    uint32_t user_identifier;\n    if (size < 7)\n        return AVERROR_INVALIDDATA;\n    size -= 7;\n    country_code = get_bits(&h->gb, 8);\n    if (country_code == 0xFF) {\n        skip_bits(&h->gb, 8);\n        size--;\n    }\n    skip_bits(&h->gb, 8);\n    skip_bits(&h->gb, 8);\n    user_identifier = get_bits_long(&h->gb, 32);\n    switch (user_identifier) {\n        case MKBETAG('D', 'T', 'G', '1'):\n            return decode_registered_user_data_afd(h, size);\n        case MKBETAG('G', 'A', '9', '4'):\n            return decode_registered_user_data_closed_caption(h, size);\n        default:\n            skip_bits(&h->gb, size * 8);\n            break;\n    }\n    return 0;\n}", 'static int decode_registered_user_data_closed_caption(H264Context *h, int size)\n{\n    int flag;\n    int user_data_type_code;\n    int cc_count;\n    if (size < 3)\n        return AVERROR(EINVAL);\n    user_data_type_code = get_bits(&h->gb, 8);\n    if (user_data_type_code == 0x3) {\n        skip_bits(&h->gb, 1);\n        flag = get_bits(&h->gb, 1);\n        if (flag) {\n            skip_bits(&h->gb, 1);\n            cc_count = get_bits(&h->gb, 5);\n            skip_bits(&h->gb, 8);\n            size -= 2;\n            if (cc_count && size >= cc_count * 3) {\n                const uint64_t new_size = (h->a53_caption_size + cc_count\n                                           * UINT64_C(3));\n                int i, ret;\n                if (new_size > INT_MAX)\n                    return AVERROR(EINVAL);\n                ret = av_reallocp(&h->a53_caption, new_size);\n                if (ret < 0)\n                    return ret;\n                for (i = 0; i < cc_count; i++) {\n                    h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);\n                    h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);\n                    h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);\n                }\n                skip_bits(&h->gb, 8);\n            }\n        }\n    }\n    return 0;\n}', 'static inline unsigned int get_bits(GetBitContext *s, int n)\n{\n    register int tmp;\n    OPEN_READER(re, s);\n    UPDATE_CACHE(re, s);\n    tmp = SHOW_UBITS(re, s, n);\n    LAST_SKIP_BITS(re, s, n);\n    CLOSE_READER(re, s);\n    return tmp;\n}', 'int av_reallocp(void *ptr, size_t size)\n{\n    void *val;\n    if (!size) {\n        av_freep(ptr);\n        return 0;\n    }\n    memcpy(&val, ptr, sizeof(val));\n    val = av_realloc(val, size);\n    if (!val) {\n        av_freep(ptr);\n        return AVERROR(ENOMEM);\n    }\n    memcpy(ptr, &val, sizeof(val));\n    return 0;\n}', 'void av_freep(void *arg)\n{\n    void *val;\n    memcpy(&val, arg, sizeof(val));\n    memcpy(arg, &(void *){ NULL }, sizeof(val));\n    av_free(val);\n}']