libavcodec/cbs_mpeg2.c:130: error: Integer Overflow L1
  ([1099511627520, +oo] + `*frag->data`):unsigned32 by call to `avpriv_find_start_code`.

libavcodec/cbs_mpeg2.c:120:1: Parameter `*frag->data`
118. }
119. 
120. static int cbs_mpeg2_split_fragment(CodedBitstreamContext *ctx,
     ^
121.                                     CodedBitstreamFragment *frag,
122.                                     int header)

libavcodec/cbs_mpeg2.c:130:13: Call
128.     int err, i, unit_type;
129. 
130.     start = avpriv_find_start_code(frag->data, frag->data + frag->data_size,
                 ^
131.                                    &start_code);
132.     for (i = 0;; i++) {

libavcodec/utils.c:1471:1: <LHS trace>
1469. }
1470. 
1471. const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,
      ^
1472.                                       const uint8_t *end,
1473.                                       uint32_t * restrict state)

libavcodec/utils.c:1471:1: Parameter `*state`
  1469. }
  1470. 
  1471. const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,
        ^
  1472.                                       const uint8_t *end,
  1473.                                       uint32_t * restrict state)

libavcodec/utils.c:1482:9: Assignment
  1480. 
  1481.     for (i = 0; i < 3; i++) {
  1482.         uint32_t tmp = *state << 8;
                ^
  1483.         *state = tmp + *(p++);
  1484.         if (tmp == 0x100 || p == end)

libavcodec/utils.c:1471:1: <RHS trace>
1469. }
1470. 
1471. const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,
      ^
1472.                                       const uint8_t *end,
1473.                                       uint32_t * restrict state)

libavcodec/utils.c:1471:1: Parameter `*p`
  1469. }
  1470. 
  1471. const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,
        ^
  1472.                                       const uint8_t *end,
  1473.                                       uint32_t * restrict state)

libavcodec/utils.c:1483:9: Binary operation: ([1099511627520, +oo] + *frag->data):unsigned32 by call to `avpriv_find_start_code` 
  1481.     for (i = 0; i < 3; i++) {
  1482.         uint32_t tmp = *state << 8;
  1483.         *state = tmp + *(p++);
                ^
  1484.         if (tmp == 0x100 || p == end)
  1485.             return p;

const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,
                                      const uint8_t *end,
                                      uint32_t * restrict state)
{
    int i;
    assert(p <= end);
    if (p >= end)
        return end;
    for (i = 0; i < 3; i++) {
        uint32_t tmp = *state << 8;
        *state = tmp + *(p++);
        if (tmp == 0x100 || p == end)
            return p;
    }
    while (p < end) {
        if      (p[-1] > 1      ) p += 3;
        else if (p[-2]          ) p += 2;
        else if (p[-3]|(p[-1]-1)) p++;
        else {
            p++;
            break;
        }
    }
    p = FFMIN(p, end) - 4;
    *state = AV_RB32(p);
    return p + 4;
}
['static int cbs_mpeg2_split_fragment(CodedBitstreamContext *ctx,\n                                    CodedBitstreamFragment *frag,\n                                    int header)\n{\n    const uint8_t *start, *end;\n    uint8_t *unit_data;\n    uint32_t start_code = -1, next_start_code = -1;\n    size_t unit_size;\n    int err, i, unit_type;\n    start = avpriv_find_start_code(frag->data, frag->data + frag->data_size,\n                                   &start_code);\n    for (i = 0;; i++) {\n        end = avpriv_find_start_code(start, frag->data + frag->data_size,\n                                     &next_start_code);\n        unit_type = start_code & 0xff;\n        if (end == frag->data + frag->data_size) {\n            unit_size = end - (start - 1);\n        } else {\n            unit_size = (end - 4) - (start - 1);\n        }\n        unit_data = av_malloc(unit_size + AV_INPUT_BUFFER_PADDING_SIZE);\n        if (!unit_data)\n            return AVERROR(ENOMEM);\n        memcpy(unit_data, start - 1, unit_size);\n        memset(unit_data + unit_size, 0, AV_INPUT_BUFFER_PADDING_SIZE);\n        err = ff_cbs_insert_unit_data(ctx, frag, i, unit_type,\n                                      unit_data, unit_size, NULL);\n        if (err < 0) {\n            av_freep(&unit_data);\n            return err;\n        }\n        if (end == frag->data + frag->data_size)\n            break;\n        start_code = next_start_code;\n        start = end;\n    }\n    return 0;\n}', 'const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,\n                                      const uint8_t *end,\n                                      uint32_t * restrict state)\n{\n    int i;\n    assert(p <= end);\n    if (p >= end)\n        return end;\n    for (i = 0; i < 3; i++) {\n        uint32_t tmp = *state << 8;\n        *state = tmp + *(p++);\n        if (tmp == 0x100 || p == end)\n            return p;\n    }\n    while (p < end) {\n        if      (p[-1] > 1      ) p += 3;\n        else if (p[-2]          ) p += 2;\n        else if (p[-3]|(p[-1]-1)) p++;\n        else {\n            p++;\n            break;\n        }\n    }\n    p = FFMIN(p, end) - 4;\n    *state = AV_RB32(p);\n    return p + 4;\n}']