libavcodec/mpeg12dec.c:2067: error: Integer Overflow L1
  ([1099511627520, +oo] + `*buf`):unsigned32 by call to `avpriv_find_start_code`.

libavcodec/mpeg12dec.c:2053:1: Parameter `*buf`
2051. }
2052. 
2053. static int decode_chunks(AVCodecContext *avctx,
      ^
2054.                          AVFrame *picture, int *got_output,
2055.                          const uint8_t *buf, int buf_size)

libavcodec/mpeg12dec.c:2067:19: Call
2065.         /* find next start code */
2066.         uint32_t start_code = -1;
2067.         buf_ptr = avpriv_find_start_code(buf_ptr, buf_end, &start_code);
                        ^
2068.         if (start_code > 0x1ff) {
2069.             if (!skip_frame) {

libavcodec/utils.c:2218:1: <LHS trace>
2216. }
2217. 
2218. const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,
      ^
2219.                                       const uint8_t *end,
2220.                                       uint32_t * restrict state)

libavcodec/utils.c:2218:1: Parameter `*state`
  2216. }
  2217. 
  2218. const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,
        ^
  2219.                                       const uint8_t *end,
  2220.                                       uint32_t * restrict state)

libavcodec/utils.c:2229:9: Assignment
  2227. 
  2228.     for (i = 0; i < 3; i++) {
  2229.         uint32_t tmp = *state << 8;
                ^
  2230.         *state = tmp + *(p++);
  2231.         if (tmp == 0x100 || p == end)

libavcodec/utils.c:2218:1: <RHS trace>
2216. }
2217. 
2218. const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,
      ^
2219.                                       const uint8_t *end,
2220.                                       uint32_t * restrict state)

libavcodec/utils.c:2218:1: Parameter `*p`
  2216. }
  2217. 
  2218. const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,
        ^
  2219.                                       const uint8_t *end,
  2220.                                       uint32_t * restrict state)

libavcodec/utils.c:2230:9: Binary operation: ([1099511627520, +oo] + *buf):unsigned32 by call to `avpriv_find_start_code` 
  2228.     for (i = 0; i < 3; i++) {
  2229.         uint32_t tmp = *state << 8;
  2230.         *state = tmp + *(p++);
                ^
  2231.         if (tmp == 0x100 || p == end)
  2232.             return p;

const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,
                                      const uint8_t *end,
                                      uint32_t * restrict state)
{
    int i;
    assert(p <= end);
    if (p >= end)
        return end;
    for (i = 0; i < 3; i++) {
        uint32_t tmp = *state << 8;
        *state = tmp + *(p++);
        if (tmp == 0x100 || p == end)
            return p;
    }
    while (p < end) {
        if      (p[-1] > 1      ) p += 3;
        else if (p[-2]          ) p += 2;
        else if (p[-3]|(p[-1]-1)) p++;
        else {
            p++;
            break;
        }
    }
    p = FFMIN(p, end) - 4;
    *state = AV_RB32(p);
    return p + 4;
}
['static int decode_chunks(AVCodecContext *avctx,\n                         AVFrame *picture, int *got_output,\n                         const uint8_t *buf, int buf_size)\n{\n    Mpeg1Context *s = avctx->priv_data;\n    MpegEncContext *s2 = &s->mpeg_enc_ctx;\n    const uint8_t *buf_ptr = buf;\n    const uint8_t *buf_end = buf + buf_size;\n    int ret, input_size;\n    int last_code = 0, skip_frame = 0;\n    for (;;) {\n        uint32_t start_code = -1;\n        buf_ptr = avpriv_find_start_code(buf_ptr, buf_end, &start_code);\n        if (start_code > 0x1ff) {\n            if (!skip_frame) {\n                if (HAVE_THREADS && (avctx->active_thread_type & FF_THREAD_SLICE)) {\n                    int i;\n                    avctx->execute(avctx, slice_decode_thread,  &s2->thread_context[0], NULL, s->slice_count, sizeof(void*));\n                    for (i = 0; i < s->slice_count; i++)\n                        s2->er.error_count += s2->thread_context[i]->er.error_count;\n                }\n                if ((CONFIG_MPEG_VDPAU_DECODER || CONFIG_MPEG1_VDPAU_DECODER)\n                    && avctx->codec->capabilities & CODEC_CAP_HWACCEL_VDPAU)\n                    ff_vdpau_mpeg_picture_complete(s2, buf, buf_size, s->slice_count);\n                ret = slice_end(avctx, picture);\n                if (ret < 0)\n                    return ret;\n                else if (ret) {\n                    if (s2->last_picture_ptr || s2->low_delay)\n                        *got_output = 1;\n                }\n            }\n            s2->pict_type = 0;\n            return FFMAX(0, buf_ptr - buf - s2->parse_context.last_index);\n        }\n        input_size = buf_end - buf_ptr;\n        if (avctx->debug & FF_DEBUG_STARTCODE) {\n            av_log(avctx, AV_LOG_DEBUG, "%3X at %td left %d\\n", start_code, buf_ptr-buf, input_size);\n        }\n        switch (start_code) {\n        case SEQ_START_CODE:\n            if (last_code == 0) {\n                mpeg1_decode_sequence(avctx, buf_ptr, input_size);\n                s->sync=1;\n            } else {\n                av_log(avctx, AV_LOG_ERROR, "ignoring SEQ_START_CODE after %X\\n", last_code);\n                if (avctx->err_recognition & AV_EF_EXPLODE)\n                    return AVERROR_INVALIDDATA;\n            }\n            break;\n        case PICTURE_START_CODE:\n            if (s2->width <= 0 || s2->height <= 0) {\n                av_log(avctx, AV_LOG_ERROR, "Invalid frame dimensions %dx%d.\\n",\n                       s2->width, s2->height);\n                return AVERROR_INVALIDDATA;\n            }\n            if (HAVE_THREADS && (avctx->active_thread_type & FF_THREAD_SLICE) && s->slice_count) {\n                int i;\n                avctx->execute(avctx, slice_decode_thread,\n                               s2->thread_context, NULL,\n                               s->slice_count, sizeof(void*));\n                for (i = 0; i < s->slice_count; i++)\n                    s2->er.error_count += s2->thread_context[i]->er.error_count;\n                s->slice_count = 0;\n            }\n            if (last_code == 0 || last_code == SLICE_MIN_START_CODE) {\n                ret = mpeg_decode_postinit(avctx);\n                if (ret < 0) {\n                    av_log(avctx, AV_LOG_ERROR, "mpeg_decode_postinit() failure\\n");\n                    return ret;\n                }\n                if (mpeg1_decode_picture(avctx, buf_ptr, input_size) < 0)\n                    s2->pict_type = 0;\n                s2->first_slice = 1;\n                last_code = PICTURE_START_CODE;\n            } else {\n                av_log(avctx, AV_LOG_ERROR, "ignoring pic after %X\\n", last_code);\n                if (avctx->err_recognition & AV_EF_EXPLODE)\n                    return AVERROR_INVALIDDATA;\n            }\n            break;\n        case EXT_START_CODE:\n            init_get_bits(&s2->gb, buf_ptr, input_size*8);\n            switch (get_bits(&s2->gb, 4)) {\n            case 0x1:\n                if (last_code == 0) {\n                mpeg_decode_sequence_extension(s);\n                } else {\n                    av_log(avctx, AV_LOG_ERROR, "ignoring seq ext after %X\\n", last_code);\n                    if (avctx->err_recognition & AV_EF_EXPLODE)\n                        return AVERROR_INVALIDDATA;\n                }\n                break;\n            case 0x2:\n                mpeg_decode_sequence_display_extension(s);\n                break;\n            case 0x3:\n                mpeg_decode_quant_matrix_extension(s2);\n                break;\n            case 0x7:\n                mpeg_decode_picture_display_extension(s);\n                break;\n            case 0x8:\n                if (last_code == PICTURE_START_CODE) {\n                    mpeg_decode_picture_coding_extension(s);\n                } else {\n                    av_log(avctx, AV_LOG_ERROR, "ignoring pic cod ext after %X\\n", last_code);\n                    if (avctx->err_recognition & AV_EF_EXPLODE)\n                        return AVERROR_INVALIDDATA;\n                }\n                break;\n            }\n            break;\n        case USER_START_CODE:\n            mpeg_decode_user_data(avctx, buf_ptr, input_size);\n            break;\n        case GOP_START_CODE:\n            if (last_code == 0) {\n                s2->first_field=0;\n                mpeg_decode_gop(avctx, buf_ptr, input_size);\n                s->sync=1;\n            } else {\n                av_log(avctx, AV_LOG_ERROR, "ignoring GOP_START_CODE after %X\\n", last_code);\n                if (avctx->err_recognition & AV_EF_EXPLODE)\n                    return AVERROR_INVALIDDATA;\n            }\n            break;\n        default:\n            if (start_code >= SLICE_MIN_START_CODE &&\n                start_code <= SLICE_MAX_START_CODE && last_code != 0) {\n                const int field_pic = s2->picture_structure != PICT_FRAME;\n                int mb_y = (start_code - SLICE_MIN_START_CODE) << field_pic;\n                last_code = SLICE_MIN_START_CODE;\n                if (s2->picture_structure == PICT_BOTTOM_FIELD)\n                    mb_y++;\n                if (mb_y >= s2->mb_height) {\n                    av_log(s2->avctx, AV_LOG_ERROR, "slice below image (%d >= %d)\\n", mb_y, s2->mb_height);\n                    return -1;\n                }\n                if (s2->last_picture_ptr == NULL) {\n                    if (s2->pict_type == AV_PICTURE_TYPE_B) {\n                        if (!s->closed_gop) {\n                            skip_frame = 1;\n                            break;\n                        }\n                    }\n                }\n                if (s2->pict_type == AV_PICTURE_TYPE_I)\n                    s->sync=1;\n                if (s2->next_picture_ptr == NULL) {\n                    if (s2->pict_type == AV_PICTURE_TYPE_P && !s->sync) {\n                        skip_frame = 1;\n                        break;\n                    }\n                }\n                if ((avctx->skip_frame >= AVDISCARD_NONREF && s2->pict_type == AV_PICTURE_TYPE_B) ||\n                    (avctx->skip_frame >= AVDISCARD_NONKEY && s2->pict_type != AV_PICTURE_TYPE_I) ||\n                     avctx->skip_frame >= AVDISCARD_ALL) {\n                    skip_frame = 1;\n                    break;\n                }\n                if (!s->mpeg_enc_ctx_allocated)\n                    break;\n                if (s2->codec_id == AV_CODEC_ID_MPEG2VIDEO) {\n                    if (mb_y < avctx->skip_top || mb_y >= s2->mb_height - avctx->skip_bottom)\n                        break;\n                }\n                if (!s2->pict_type) {\n                    av_log(avctx, AV_LOG_ERROR, "Missing picture start code\\n");\n                    if (avctx->err_recognition & AV_EF_EXPLODE)\n                        return AVERROR_INVALIDDATA;\n                    break;\n                }\n                if (s2->first_slice) {\n                    skip_frame = 0;\n                    s2->first_slice = 0;\n                    if (mpeg_field_start(s2, buf, buf_size) < 0)\n                        return -1;\n                }\n                if (!s2->current_picture_ptr) {\n                    av_log(avctx, AV_LOG_ERROR, "current_picture not initialized\\n");\n                    return AVERROR_INVALIDDATA;\n                }\n                if (avctx->codec->capabilities & CODEC_CAP_HWACCEL_VDPAU) {\n                    s->slice_count++;\n                    break;\n                }\n                if (HAVE_THREADS && (avctx->active_thread_type & FF_THREAD_SLICE)) {\n                    int threshold = (s2->mb_height * s->slice_count +\n                                     s2->slice_context_count / 2) /\n                                    s2->slice_context_count;\n                    if (threshold <= mb_y) {\n                        MpegEncContext *thread_context = s2->thread_context[s->slice_count];\n                        thread_context->start_mb_y = mb_y;\n                        thread_context->end_mb_y   = s2->mb_height;\n                        if (s->slice_count) {\n                            s2->thread_context[s->slice_count-1]->end_mb_y = mb_y;\n                            ret = ff_update_duplicate_context(thread_context,\n                                                              s2);\n                            if (ret < 0)\n                                return ret;\n                        }\n                        init_get_bits(&thread_context->gb, buf_ptr, input_size*8);\n                        s->slice_count++;\n                    }\n                    buf_ptr += 2;\n                } else {\n                    ret = mpeg_decode_slice(s2, mb_y, &buf_ptr, input_size);\n                    emms_c();\n                    if (ret < 0) {\n                        if (avctx->err_recognition & AV_EF_EXPLODE)\n                            return ret;\n                        if (s2->resync_mb_x >= 0 && s2->resync_mb_y >= 0)\n                            ff_er_add_slice(&s2->er, s2->resync_mb_x, s2->resync_mb_y, s2->mb_x, s2->mb_y, ER_AC_ERROR | ER_DC_ERROR | ER_MV_ERROR);\n                    } else {\n                        ff_er_add_slice(&s2->er, s2->resync_mb_x, s2->resync_mb_y, s2->mb_x-1, s2->mb_y, ER_AC_END | ER_DC_END | ER_MV_END);\n                    }\n                }\n            }\n            break;\n        }\n    }\n}', 'const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,\n                                      const uint8_t *end,\n                                      uint32_t * restrict state)\n{\n    int i;\n    assert(p <= end);\n    if (p >= end)\n        return end;\n    for (i = 0; i < 3; i++) {\n        uint32_t tmp = *state << 8;\n        *state = tmp + *(p++);\n        if (tmp == 0x100 || p == end)\n            return p;\n    }\n    while (p < end) {\n        if      (p[-1] > 1      ) p += 3;\n        else if (p[-2]          ) p += 2;\n        else if (p[-3]|(p[-1]-1)) p++;\n        else {\n            p++;\n            break;\n        }\n    }\n    p = FFMIN(p, end) - 4;\n    *state = AV_RB32(p);\n    return p + 4;\n}']