libavcodec/mjpegdec.c:1591: error: Buffer Overrun L2
  Offset: [0, max(4, `avctx->priv_data->nb_components`)] Size: 4 by call to `ff_mjpeg_decode_sos`.

libavcodec/mjpegdec.c:1452:1: Parameter `avctx->priv_data->nb_components`
1450. }
1451. 
1452. int ff_mjpeg_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
      ^
1453.                           AVPacket *avpkt)
1454. {

libavcodec/mjpegdec.c:1591:24: Call
1589.                 break;
1590.                 }
1591.             if ((ret = ff_mjpeg_decode_sos(s, NULL, NULL)) < 0 &&
                             ^
1592.                 (avctx->err_recognition & AV_EF_EXPLODE))
1593.                 return ret;

libavcodec/mjpegdec.c:1002:1: <Offset trace>
1000. }
1001. 
1002. int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
      ^
1003.                         const AVFrame *reference)
1004. {

libavcodec/mjpegdec.c:1002:1: Parameter `s->nb_components`
  1000. }
  1001. 
  1002. int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
        ^
  1003.                         const AVFrame *reference)
  1004. {

libavcodec/mjpegdec.c:1002:1: <Length trace>
1000. }
1001. 
1002. int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
      ^
1003.                         const AVFrame *reference)
1004. {

libavcodec/mjpegdec.c:1002:1: Parameter `s->h_count[*]`
  1000. }
  1001. 
  1002. int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
        ^
  1003.                         const AVFrame *reference)
  1004. {

libavcodec/mjpegdec.c:1041:27: Array access: Offset: [0, max(4, avctx->priv_data->nb_components)] Size: 4 by call to `ff_mjpeg_decode_sos` 
  1039.         s->comp_index[i] = index;
  1040. 
  1041.         s->nb_blocks[i] = s->h_count[index] * s->v_count[index];
                                  ^
  1042.         s->h_scount[i]  = s->h_count[index];
  1043.         s->v_scount[i]  = s->v_count[index];

int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
                        const AVFrame *reference)
{
    int len, nb_components, i, h, v, predictor, point_transform;
    int index, id, ret;
    const int block_size = s->lossless ? 1 : 8;
    int ilv, prev_shift;
    len = get_bits(&s->gb, 16);
    nb_components = get_bits(&s->gb, 8);
    if (nb_components == 0 || nb_components > MAX_COMPONENTS) {
        av_log(s->avctx, AV_LOG_ERROR,
               "decode_sos: nb_components (%d) unsupported\n", nb_components);
        return AVERROR_PATCHWELCOME;
    }
    if (len != 6 + 2 * nb_components) {
        av_log(s->avctx, AV_LOG_ERROR, "decode_sos: invalid len (%d)\n", len);
        return AVERROR_INVALIDDATA;
    }
    for (i = 0; i < nb_components; i++) {
        id = get_bits(&s->gb, 8) - 1;
        av_log(s->avctx, AV_LOG_DEBUG, "component: %d\n", id);
        for (index = 0; index < s->nb_components; index++)
            if (id == s->component_id[index])
                break;
        if (index == s->nb_components) {
            av_log(s->avctx, AV_LOG_ERROR,
                   "decode_sos: index(%d) out of components\n", index);
            return AVERROR_INVALIDDATA;
        }
        if (s->avctx->codec_tag == MKTAG('M', 'T', 'S', 'J')
            && nb_components == 3 && s->nb_components == 3 && i)
            index = 3 - i;
        s->comp_index[i] = index;
        s->nb_blocks[i] = s->h_count[index] * s->v_count[index];
        s->h_scount[i]  = s->h_count[index];
        s->v_scount[i]  = s->v_count[index];
        s->dc_index[i] = get_bits(&s->gb, 4);
        s->ac_index[i] = get_bits(&s->gb, 4);
        if (s->dc_index[i] <  0 || s->ac_index[i] < 0 ||
            s->dc_index[i] >= 4 || s->ac_index[i] >= 4)
            goto out_of_range;
        if (!s->vlcs[0][s->dc_index[i]].table ||
            !s->vlcs[1][s->ac_index[i]].table)
            goto out_of_range;
    }
    predictor = get_bits(&s->gb, 8);
    ilv = get_bits(&s->gb, 8);
    prev_shift      = get_bits(&s->gb, 4);
    point_transform = get_bits(&s->gb, 4);
    if (nb_components > 1) {
        s->mb_width  = (s->width  + s->h_max * block_size - 1) / (s->h_max * block_size);
        s->mb_height = (s->height + s->v_max * block_size - 1) / (s->v_max * block_size);
    } else if (!s->ls) {
        h = s->h_max / s->h_scount[0];
        v = s->v_max / s->v_scount[0];
        s->mb_width     = (s->width  + h * block_size - 1) / (h * block_size);
        s->mb_height    = (s->height + v * block_size - 1) / (v * block_size);
        s->nb_blocks[0] = 1;
        s->h_scount[0]  = 1;
        s->v_scount[0]  = 1;
    }
    if (s->avctx->debug & FF_DEBUG_PICT_INFO)
        av_log(s->avctx, AV_LOG_DEBUG, "%s %s p:%d >>:%d ilv:%d bits:%d %s\n",
               s->lossless ? "lossless" : "sequential DCT", s->rgb ? "RGB" : "",
               predictor, point_transform, ilv, s->bits,
               s->pegasus_rct ? "PRCT" : (s->rct ? "RCT" : ""));
    for (i = s->mjpb_skiptosod; i > 0; i--)
        skip_bits(&s->gb, 8);
next_field:
    for (i = 0; i < nb_components; i++)
        s->last_dc[i] = 1024;
    if (s->lossless) {
        if (CONFIG_JPEGLS_DECODER && s->ls) {
            if ((ret = ff_jpegls_decode_picture(s, predictor,
                                                point_transform, ilv)) < 0)
                return ret;
        } else {
            if (s->rgb) {
                if ((ret = ljpeg_decode_rgb_scan(s, predictor,
                                                 point_transform)) < 0)
                    return ret;
            } else {
                if ((ret = ljpeg_decode_yuv_scan(s, predictor,
                                                 point_transform,
                                                 nb_components)) < 0)
                    return ret;
            }
        }
    } else {
        if (s->progressive && predictor) {
            if ((ret = mjpeg_decode_scan_progressive_ac(s, predictor,
                                                        ilv, prev_shift,
                                                        point_transform,
                                                        mb_bitmask,
                                                        reference)) < 0)
                return ret;
        } else {
            if ((ret = mjpeg_decode_scan(s, nb_components,
                                         prev_shift, point_transform,
                                         mb_bitmask, reference)) < 0)
                return ret;
        }
    }
    if (s->interlaced &&
        get_bits_left(&s->gb) > 32 &&
        show_bits(&s->gb, 8) == 0xFF) {
        GetBitContext bak = s->gb;
        align_get_bits(&bak);
        if (show_bits(&bak, 16) == 0xFFD1) {
            av_dlog(s->avctx, "AVRn interlaced picture marker found\n");
            s->gb = bak;
            skip_bits(&s->gb, 16);
            s->bottom_field ^= 1;
            goto next_field;
        }
    }
    emms_c();
    return 0;
 out_of_range:
    av_log(s->avctx, AV_LOG_ERROR, "decode_sos: ac/dc index out of range\n");
    return AVERROR_INVALIDDATA;
}
['int ff_mjpeg_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,\n                          AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size       = avpkt->size;\n    MJpegDecodeContext *s = avctx->priv_data;\n    const uint8_t *buf_end, *buf_ptr;\n    const uint8_t *unescaped_buf_ptr;\n    int unescaped_buf_size;\n    int start_code;\n    int ret = 0;\n    s->got_picture = 0;\n    buf_ptr = buf;\n    buf_end = buf + buf_size;\n    while (buf_ptr < buf_end) {\n        start_code = ff_mjpeg_find_marker(s, &buf_ptr, buf_end,\n                                          &unescaped_buf_ptr,\n                                          &unescaped_buf_size);\n        if (start_code < 0) {\n            goto the_end;\n        } else if (unescaped_buf_size > (1U<<29)) {\n            av_log(avctx, AV_LOG_ERROR, "MJPEG packet 0x%x too big (0x%x/0x%x), corrupt data?\\n",\n                   start_code, unescaped_buf_size, buf_size);\n            return AVERROR_INVALIDDATA;\n        }\n        av_log(avctx, AV_LOG_DEBUG, "marker=%x avail_size_in_buf=%td\\n",\n               start_code, buf_end - buf_ptr);\n        init_get_bits(&s->gb, unescaped_buf_ptr, unescaped_buf_size * 8);\n        s->start_code = start_code;\n        if (s->avctx->debug & FF_DEBUG_STARTCODE)\n            av_log(avctx, AV_LOG_DEBUG, "startcode: %X\\n", start_code);\n        if (start_code >= 0xd0 && start_code <= 0xd7)\n            av_log(avctx, AV_LOG_DEBUG,\n                   "restart marker: %d\\n", start_code & 0x0f);\n        else if (start_code >= APP0 && start_code <= APP15)\n            mjpeg_decode_app(s);\n        else if (start_code == COM)\n            mjpeg_decode_com(s);\n        if (!CONFIG_JPEGLS_DECODER &&\n            (start_code == SOF48 || start_code == LSE)) {\n            av_log(avctx, AV_LOG_ERROR, "JPEG-LS support not enabled.\\n");\n            return AVERROR(ENOSYS);\n        }\n        switch (start_code) {\n        case SOI:\n            s->restart_interval = 0;\n            s->restart_count    = 0;\n            break;\n        case DQT:\n            ff_mjpeg_decode_dqt(s);\n            break;\n        case DHT:\n            if ((ret = ff_mjpeg_decode_dht(s)) < 0) {\n                av_log(avctx, AV_LOG_ERROR, "huffman table decode error\\n");\n                return ret;\n            }\n            break;\n        case SOF0:\n        case SOF1:\n            s->lossless    = 0;\n            s->ls          = 0;\n            s->progressive = 0;\n            if ((ret = ff_mjpeg_decode_sof(s)) < 0)\n                return ret;\n            break;\n        case SOF2:\n            s->lossless    = 0;\n            s->ls          = 0;\n            s->progressive = 1;\n            if ((ret = ff_mjpeg_decode_sof(s)) < 0)\n                return ret;\n            break;\n        case SOF3:\n            s->lossless    = 1;\n            s->ls          = 0;\n            s->progressive = 0;\n            if ((ret = ff_mjpeg_decode_sof(s)) < 0)\n                return ret;\n            break;\n        case SOF48:\n            s->lossless    = 1;\n            s->ls          = 1;\n            s->progressive = 0;\n            if ((ret = ff_mjpeg_decode_sof(s)) < 0)\n                return ret;\n            break;\n        case LSE:\n            if (!CONFIG_JPEGLS_DECODER ||\n                (ret = ff_jpegls_decode_lse(s)) < 0)\n                return ret;\n            break;\n        case EOI:\n            s->cur_scan = 0;\n            if ((s->buggy_avid && !s->interlaced) || s->restart_interval)\n                break;\neoi_parser:\n            if (!s->got_picture) {\n                av_log(avctx, AV_LOG_WARNING,\n                       "Found EOI before any SOF, ignoring\\n");\n                break;\n            }\n            if (s->interlaced) {\n                s->bottom_field ^= 1;\n                if (s->bottom_field == !s->interlace_polarity)\n                    goto not_the_end;\n            }\n            if ((ret = av_frame_ref(data, s->picture_ptr)) < 0)\n                return ret;\n            *got_frame = 1;\n            if (!s->lossless &&\n                avctx->debug & FF_DEBUG_QP) {\n                av_log(avctx, AV_LOG_DEBUG,\n                       "QP: %d\\n", FFMAX3(s->qscale[0],\n                                          s->qscale[1],\n                                          s->qscale[2]));\n            }\n            goto the_end;\n        case SOS:\n            if (!s->got_picture) {\n                av_log(avctx, AV_LOG_WARNING,\n                       "Can not process SOS before SOF, skipping\\n");\n                break;\n                }\n            if ((ret = ff_mjpeg_decode_sos(s, NULL, NULL)) < 0 &&\n                (avctx->err_recognition & AV_EF_EXPLODE))\n                return ret;\n            if ((s->buggy_avid && !s->interlaced) || s->restart_interval)\n                goto eoi_parser;\n            break;\n        case DRI:\n            mjpeg_decode_dri(s);\n            break;\n        case SOF5:\n        case SOF6:\n        case SOF7:\n        case SOF9:\n        case SOF10:\n        case SOF11:\n        case SOF13:\n        case SOF14:\n        case SOF15:\n        case JPG:\n            av_log(avctx, AV_LOG_ERROR,\n                   "mjpeg: unsupported coding type (%x)\\n", start_code);\n            break;\n        }\nnot_the_end:\n        buf_ptr += (get_bits_count(&s->gb) + 7) / 8;\n        av_log(avctx, AV_LOG_DEBUG,\n               "marker parser used %d bytes (%d bits)\\n",\n               (get_bits_count(&s->gb) + 7) / 8, get_bits_count(&s->gb));\n    }\n    if (s->got_picture) {\n        av_log(avctx, AV_LOG_WARNING, "EOI missing, emulating\\n");\n        goto eoi_parser;\n    }\n    av_log(avctx, AV_LOG_FATAL, "No JPEG data found in image\\n");\n    return AVERROR_INVALIDDATA;\nthe_end:\n    av_log(avctx, AV_LOG_DEBUG, "mjpeg decode frame unused %td bytes\\n",\n           buf_end - buf_ptr);\n    return buf_ptr - buf;\n}', 'int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,\n                        const AVFrame *reference)\n{\n    int len, nb_components, i, h, v, predictor, point_transform;\n    int index, id, ret;\n    const int block_size = s->lossless ? 1 : 8;\n    int ilv, prev_shift;\n    len = get_bits(&s->gb, 16);\n    nb_components = get_bits(&s->gb, 8);\n    if (nb_components == 0 || nb_components > MAX_COMPONENTS) {\n        av_log(s->avctx, AV_LOG_ERROR,\n               "decode_sos: nb_components (%d) unsupported\\n", nb_components);\n        return AVERROR_PATCHWELCOME;\n    }\n    if (len != 6 + 2 * nb_components) {\n        av_log(s->avctx, AV_LOG_ERROR, "decode_sos: invalid len (%d)\\n", len);\n        return AVERROR_INVALIDDATA;\n    }\n    for (i = 0; i < nb_components; i++) {\n        id = get_bits(&s->gb, 8) - 1;\n        av_log(s->avctx, AV_LOG_DEBUG, "component: %d\\n", id);\n        for (index = 0; index < s->nb_components; index++)\n            if (id == s->component_id[index])\n                break;\n        if (index == s->nb_components) {\n            av_log(s->avctx, AV_LOG_ERROR,\n                   "decode_sos: index(%d) out of components\\n", index);\n            return AVERROR_INVALIDDATA;\n        }\n        if (s->avctx->codec_tag == MKTAG(\'M\', \'T\', \'S\', \'J\')\n            && nb_components == 3 && s->nb_components == 3 && i)\n            index = 3 - i;\n        s->comp_index[i] = index;\n        s->nb_blocks[i] = s->h_count[index] * s->v_count[index];\n        s->h_scount[i]  = s->h_count[index];\n        s->v_scount[i]  = s->v_count[index];\n        s->dc_index[i] = get_bits(&s->gb, 4);\n        s->ac_index[i] = get_bits(&s->gb, 4);\n        if (s->dc_index[i] <  0 || s->ac_index[i] < 0 ||\n            s->dc_index[i] >= 4 || s->ac_index[i] >= 4)\n            goto out_of_range;\n        if (!s->vlcs[0][s->dc_index[i]].table ||\n            !s->vlcs[1][s->ac_index[i]].table)\n            goto out_of_range;\n    }\n    predictor = get_bits(&s->gb, 8);\n    ilv = get_bits(&s->gb, 8);\n    prev_shift      = get_bits(&s->gb, 4);\n    point_transform = get_bits(&s->gb, 4);\n    if (nb_components > 1) {\n        s->mb_width  = (s->width  + s->h_max * block_size - 1) / (s->h_max * block_size);\n        s->mb_height = (s->height + s->v_max * block_size - 1) / (s->v_max * block_size);\n    } else if (!s->ls) {\n        h = s->h_max / s->h_scount[0];\n        v = s->v_max / s->v_scount[0];\n        s->mb_width     = (s->width  + h * block_size - 1) / (h * block_size);\n        s->mb_height    = (s->height + v * block_size - 1) / (v * block_size);\n        s->nb_blocks[0] = 1;\n        s->h_scount[0]  = 1;\n        s->v_scount[0]  = 1;\n    }\n    if (s->avctx->debug & FF_DEBUG_PICT_INFO)\n        av_log(s->avctx, AV_LOG_DEBUG, "%s %s p:%d >>:%d ilv:%d bits:%d %s\\n",\n               s->lossless ? "lossless" : "sequential DCT", s->rgb ? "RGB" : "",\n               predictor, point_transform, ilv, s->bits,\n               s->pegasus_rct ? "PRCT" : (s->rct ? "RCT" : ""));\n    for (i = s->mjpb_skiptosod; i > 0; i--)\n        skip_bits(&s->gb, 8);\nnext_field:\n    for (i = 0; i < nb_components; i++)\n        s->last_dc[i] = 1024;\n    if (s->lossless) {\n        if (CONFIG_JPEGLS_DECODER && s->ls) {\n            if ((ret = ff_jpegls_decode_picture(s, predictor,\n                                                point_transform, ilv)) < 0)\n                return ret;\n        } else {\n            if (s->rgb) {\n                if ((ret = ljpeg_decode_rgb_scan(s, predictor,\n                                                 point_transform)) < 0)\n                    return ret;\n            } else {\n                if ((ret = ljpeg_decode_yuv_scan(s, predictor,\n                                                 point_transform,\n                                                 nb_components)) < 0)\n                    return ret;\n            }\n        }\n    } else {\n        if (s->progressive && predictor) {\n            if ((ret = mjpeg_decode_scan_progressive_ac(s, predictor,\n                                                        ilv, prev_shift,\n                                                        point_transform,\n                                                        mb_bitmask,\n                                                        reference)) < 0)\n                return ret;\n        } else {\n            if ((ret = mjpeg_decode_scan(s, nb_components,\n                                         prev_shift, point_transform,\n                                         mb_bitmask, reference)) < 0)\n                return ret;\n        }\n    }\n    if (s->interlaced &&\n        get_bits_left(&s->gb) > 32 &&\n        show_bits(&s->gb, 8) == 0xFF) {\n        GetBitContext bak = s->gb;\n        align_get_bits(&bak);\n        if (show_bits(&bak, 16) == 0xFFD1) {\n            av_dlog(s->avctx, "AVRn interlaced picture marker found\\n");\n            s->gb = bak;\n            skip_bits(&s->gb, 16);\n            s->bottom_field ^= 1;\n            goto next_field;\n        }\n    }\n    emms_c();\n    return 0;\n out_of_range:\n    av_log(s->avctx, AV_LOG_ERROR, "decode_sos: ac/dc index out of range\\n");\n    return AVERROR_INVALIDDATA;\n}']