libavcodec/mjpegdec.c:1528: error: Buffer Overrun L2
  Offset: [0, max(4, `avctx->priv_data->nb_components`)] Size: 4 by call to `ff_mjpeg_decode_sos`.

libavcodec/mjpegdec.c:1400:1: Parameter `avctx->priv_data->nb_components`
1398. }
1399. 
1400. int ff_mjpeg_decode_frame(AVCodecContext *avctx,
      ^
1401.                               void *data, int *data_size,
1402.                               AVPacket *avpkt)

libavcodec/mjpegdec.c:1528:25: Call
1526.                         break;
1527.                     }
1528.                     if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 &&
                              ^
1529.                         avctx->error_recognition >= FF_ER_EXPLODE)
1530.                       return AVERROR_INVALIDDATA;

libavcodec/mjpegdec.c:959:1: <Offset trace>
957. }
958. 
959. int ff_mjpeg_decode_sos(MJpegDecodeContext *s,
     ^
960.                         const uint8_t *mb_bitmask, const AVFrame *reference)
961. {

libavcodec/mjpegdec.c:959:1: Parameter `s->nb_components`
  957. }
  958. 
  959. int ff_mjpeg_decode_sos(MJpegDecodeContext *s,
       ^
  960.                         const uint8_t *mb_bitmask, const AVFrame *reference)
  961. {

libavcodec/mjpegdec.c:959:1: <Length trace>
957. }
958. 
959. int ff_mjpeg_decode_sos(MJpegDecodeContext *s,
     ^
960.                         const uint8_t *mb_bitmask, const AVFrame *reference)
961. {

libavcodec/mjpegdec.c:959:1: Parameter `s->h_count[*]`
  957. }
  958. 
  959. int ff_mjpeg_decode_sos(MJpegDecodeContext *s,
       ^
  960.                         const uint8_t *mb_bitmask, const AVFrame *reference)
  961. {

libavcodec/mjpegdec.c:998:27: Array access: Offset: [0, max(4, avctx->priv_data->nb_components)] Size: 4 by call to `ff_mjpeg_decode_sos` 
   996.         s->comp_index[i] = index;
   997. 
   998.         s->nb_blocks[i] = s->h_count[index] * s->v_count[index];
                                  ^
   999.         s->h_scount[i] = s->h_count[index];
  1000.         s->v_scount[i] = s->v_count[index];

int ff_mjpeg_decode_sos(MJpegDecodeContext *s,
                        const uint8_t *mb_bitmask, const AVFrame *reference)
{
    int len, nb_components, i, h, v, predictor, point_transform;
    int index, id;
    const int block_size= s->lossless ? 1 : 8;
    int ilv, prev_shift;
    len = get_bits(&s->gb, 16);
    nb_components = get_bits(&s->gb, 8);
    if (nb_components == 0 || nb_components > MAX_COMPONENTS){
        av_log(s->avctx, AV_LOG_ERROR, "decode_sos: nb_components (%d) unsupported\n", nb_components);
        return -1;
    }
    if (len != 6+2*nb_components)
    {
        av_log(s->avctx, AV_LOG_ERROR, "decode_sos: invalid len (%d)\n", len);
        return -1;
    }
    for(i=0;i<nb_components;i++) {
        id = get_bits(&s->gb, 8) - 1;
        av_log(s->avctx, AV_LOG_DEBUG, "component: %d\n", id);
        for(index=0;index<s->nb_components;index++)
            if (id == s->component_id[index])
                break;
        if (index == s->nb_components)
        {
            av_log(s->avctx, AV_LOG_ERROR, "decode_sos: index(%d) out of components\n", index);
            return -1;
        }
        if (s->avctx->codec_tag == MKTAG('M', 'T', 'S', 'J')
            && nb_components == 3 && s->nb_components == 3 && i)
            index = 3 - i;
        s->comp_index[i] = index;
        s->nb_blocks[i] = s->h_count[index] * s->v_count[index];
        s->h_scount[i] = s->h_count[index];
        s->v_scount[i] = s->v_count[index];
        s->dc_index[i] = get_bits(&s->gb, 4);
        s->ac_index[i] = get_bits(&s->gb, 4);
        if (s->dc_index[i] <  0 || s->ac_index[i] < 0 ||
            s->dc_index[i] >= 4 || s->ac_index[i] >= 4)
            goto out_of_range;
        if (!s->vlcs[0][s->dc_index[i]].table || !s->vlcs[1][s->ac_index[i]].table)
            goto out_of_range;
    }
    predictor= get_bits(&s->gb, 8);
    ilv= get_bits(&s->gb, 8);
    prev_shift = get_bits(&s->gb, 4);
    point_transform= get_bits(&s->gb, 4);
    for(i=0;i<nb_components;i++)
        s->last_dc[i] = 1024;
    if (nb_components > 1) {
        s->mb_width  = (s->width  + s->h_max * block_size - 1) / (s->h_max * block_size);
        s->mb_height = (s->height + s->v_max * block_size - 1) / (s->v_max * block_size);
    } else if(!s->ls) {
        h = s->h_max / s->h_scount[0];
        v = s->v_max / s->v_scount[0];
        s->mb_width  = (s->width  + h * block_size - 1) / (h * block_size);
        s->mb_height = (s->height + v * block_size - 1) / (v * block_size);
        s->nb_blocks[0] = 1;
        s->h_scount[0] = 1;
        s->v_scount[0] = 1;
    }
    if(s->avctx->debug & FF_DEBUG_PICT_INFO)
        av_log(s->avctx, AV_LOG_DEBUG, "%s %s p:%d >>:%d ilv:%d bits:%d %s\n", s->lossless ? "lossless" : "sequential DCT", s->rgb ? "RGB" : "",
               predictor, point_transform, ilv, s->bits,
               s->pegasus_rct ? "PRCT" : (s->rct ? "RCT" : ""));
    for (i = s->mjpb_skiptosod; i > 0; i--)
        skip_bits(&s->gb, 8);
    if(s->lossless){
        if(CONFIG_JPEGLS_DECODER && s->ls){
            if(ff_jpegls_decode_picture(s, predictor, point_transform, ilv) < 0)
                return -1;
        }else{
            if(s->rgb){
                if(ljpeg_decode_rgb_scan(s, predictor, point_transform) < 0)
                    return -1;
            }else{
                if(ljpeg_decode_yuv_scan(s, predictor, point_transform) < 0)
                    return -1;
            }
        }
    }else{
        if(s->progressive && predictor) {
            if(mjpeg_decode_scan_progressive_ac(s, predictor, ilv, prev_shift, point_transform,
                                                mb_bitmask, reference) < 0)
                return -1;
        } else {
            if(mjpeg_decode_scan(s, nb_components, prev_shift, point_transform,
                                 mb_bitmask, reference) < 0)
                return -1;
        }
    }
    emms_c();
    return 0;
 out_of_range:
    av_log(s->avctx, AV_LOG_ERROR, "decode_sos: ac/dc index out of range\n");
    return -1;
}
['int ff_mjpeg_decode_frame(AVCodecContext *avctx,\n                              void *data, int *data_size,\n                              AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    MJpegDecodeContext *s = avctx->priv_data;\n    const uint8_t *buf_end, *buf_ptr;\n    const uint8_t *unescaped_buf_ptr;\n    int unescaped_buf_size;\n    int start_code;\n    AVFrame *picture = data;\n    s->got_picture = 0;\n    buf_ptr = buf;\n    buf_end = buf + buf_size;\n    while (buf_ptr < buf_end) {\n        start_code = ff_mjpeg_find_marker(s, &buf_ptr, buf_end,\n                                          &unescaped_buf_ptr, &unescaped_buf_size);\n        {\n            if (start_code < 0) {\n                goto the_end;\n            } else {\n                av_log(avctx, AV_LOG_DEBUG, "marker=%x avail_size_in_buf=%td\\n", start_code, buf_end - buf_ptr);\n                init_get_bits(&s->gb, unescaped_buf_ptr, unescaped_buf_size*8);\n                s->start_code = start_code;\n                if(s->avctx->debug & FF_DEBUG_STARTCODE){\n                    av_log(avctx, AV_LOG_DEBUG, "startcode: %X\\n", start_code);\n                }\n                if (start_code >= 0xd0 && start_code <= 0xd7) {\n                    av_log(avctx, AV_LOG_DEBUG, "restart marker: %d\\n", start_code&0x0f);\n                } else if (start_code >= APP0 && start_code <= APP15) {\n                    mjpeg_decode_app(s);\n                } else if (start_code == COM){\n                    mjpeg_decode_com(s);\n                }\n                switch(start_code) {\n                case SOI:\n                    s->restart_interval = 0;\n                    s->restart_count = 0;\n                    break;\n                case DQT:\n                    ff_mjpeg_decode_dqt(s);\n                    break;\n                case DHT:\n                    if(ff_mjpeg_decode_dht(s) < 0){\n                        av_log(avctx, AV_LOG_ERROR, "huffman table decode error\\n");\n                        return -1;\n                    }\n                    break;\n                case SOF0:\n                case SOF1:\n                    s->lossless=0;\n                    s->ls=0;\n                    s->progressive=0;\n                    if (ff_mjpeg_decode_sof(s) < 0)\n                        return -1;\n                    break;\n                case SOF2:\n                    s->lossless=0;\n                    s->ls=0;\n                    s->progressive=1;\n                    if (ff_mjpeg_decode_sof(s) < 0)\n                        return -1;\n                    break;\n                case SOF3:\n                    s->lossless=1;\n                    s->ls=0;\n                    s->progressive=0;\n                    if (ff_mjpeg_decode_sof(s) < 0)\n                        return -1;\n                    break;\n                case SOF48:\n                    s->lossless=1;\n                    s->ls=1;\n                    s->progressive=0;\n                    if (ff_mjpeg_decode_sof(s) < 0)\n                        return -1;\n                    break;\n                case LSE:\n                    if (!CONFIG_JPEGLS_DECODER || ff_jpegls_decode_lse(s) < 0)\n                        return -1;\n                    break;\n                case EOI:\n                    s->cur_scan = 0;\n                    if ((s->buggy_avid && !s->interlaced) || s->restart_interval)\n                        break;\neoi_parser:\n                    if (!s->got_picture) {\n                        av_log(avctx, AV_LOG_WARNING, "Found EOI before any SOF, ignoring\\n");\n                        break;\n                    }\n                    if (s->interlaced) {\n                        s->bottom_field ^= 1;\n                        if (s->bottom_field == !s->interlace_polarity)\n                            goto not_the_end;\n                    }\n                    *picture = *s->picture_ptr;\n                    *data_size = sizeof(AVFrame);\n                    if(!s->lossless){\n                        picture->quality= FFMAX3(s->qscale[0], s->qscale[1], s->qscale[2]);\n                        picture->qstride= 0;\n                        picture->qscale_table= s->qscale_table;\n                        memset(picture->qscale_table, picture->quality, (s->width+15)/16);\n                        if(avctx->debug & FF_DEBUG_QP)\n                            av_log(avctx, AV_LOG_DEBUG, "QP: %d\\n", picture->quality);\n                        picture->quality*= FF_QP2LAMBDA;\n                    }\n                    goto the_end;\n                case SOS:\n                    if (!s->got_picture) {\n                        av_log(avctx, AV_LOG_WARNING, "Can not process SOS before SOF, skipping\\n");\n                        break;\n                    }\n                    if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 &&\n                        avctx->error_recognition >= FF_ER_EXPLODE)\n                      return AVERROR_INVALIDDATA;\n                    if ((s->buggy_avid && !s->interlaced) || s->restart_interval)\n                        goto eoi_parser;\n                    break;\n                case DRI:\n                    mjpeg_decode_dri(s);\n                    break;\n                case SOF5:\n                case SOF6:\n                case SOF7:\n                case SOF9:\n                case SOF10:\n                case SOF11:\n                case SOF13:\n                case SOF14:\n                case SOF15:\n                case JPG:\n                    av_log(avctx, AV_LOG_ERROR, "mjpeg: unsupported coding type (%x)\\n", start_code);\n                    break;\n                }\nnot_the_end:\n                buf_ptr += (get_bits_count(&s->gb)+7)/8;\n                av_log(avctx, AV_LOG_DEBUG, "marker parser used %d bytes (%d bits)\\n",\n                       (get_bits_count(&s->gb)+7)/8, get_bits_count(&s->gb));\n            }\n        }\n    }\n    if (s->got_picture) {\n        av_log(avctx, AV_LOG_WARNING, "EOI missing, emulating\\n");\n        goto eoi_parser;\n    }\n    av_log(avctx, AV_LOG_FATAL, "No JPEG data found in image\\n");\n    return -1;\nthe_end:\n    av_log(avctx, AV_LOG_DEBUG, "mjpeg decode frame unused %td bytes\\n", buf_end - buf_ptr);\n    return buf_ptr - buf;\n}', 'int ff_mjpeg_decode_sos(MJpegDecodeContext *s,\n                        const uint8_t *mb_bitmask, const AVFrame *reference)\n{\n    int len, nb_components, i, h, v, predictor, point_transform;\n    int index, id;\n    const int block_size= s->lossless ? 1 : 8;\n    int ilv, prev_shift;\n    len = get_bits(&s->gb, 16);\n    nb_components = get_bits(&s->gb, 8);\n    if (nb_components == 0 || nb_components > MAX_COMPONENTS){\n        av_log(s->avctx, AV_LOG_ERROR, "decode_sos: nb_components (%d) unsupported\\n", nb_components);\n        return -1;\n    }\n    if (len != 6+2*nb_components)\n    {\n        av_log(s->avctx, AV_LOG_ERROR, "decode_sos: invalid len (%d)\\n", len);\n        return -1;\n    }\n    for(i=0;i<nb_components;i++) {\n        id = get_bits(&s->gb, 8) - 1;\n        av_log(s->avctx, AV_LOG_DEBUG, "component: %d\\n", id);\n        for(index=0;index<s->nb_components;index++)\n            if (id == s->component_id[index])\n                break;\n        if (index == s->nb_components)\n        {\n            av_log(s->avctx, AV_LOG_ERROR, "decode_sos: index(%d) out of components\\n", index);\n            return -1;\n        }\n        if (s->avctx->codec_tag == MKTAG(\'M\', \'T\', \'S\', \'J\')\n            && nb_components == 3 && s->nb_components == 3 && i)\n            index = 3 - i;\n        s->comp_index[i] = index;\n        s->nb_blocks[i] = s->h_count[index] * s->v_count[index];\n        s->h_scount[i] = s->h_count[index];\n        s->v_scount[i] = s->v_count[index];\n        s->dc_index[i] = get_bits(&s->gb, 4);\n        s->ac_index[i] = get_bits(&s->gb, 4);\n        if (s->dc_index[i] <  0 || s->ac_index[i] < 0 ||\n            s->dc_index[i] >= 4 || s->ac_index[i] >= 4)\n            goto out_of_range;\n        if (!s->vlcs[0][s->dc_index[i]].table || !s->vlcs[1][s->ac_index[i]].table)\n            goto out_of_range;\n    }\n    predictor= get_bits(&s->gb, 8);\n    ilv= get_bits(&s->gb, 8);\n    prev_shift = get_bits(&s->gb, 4);\n    point_transform= get_bits(&s->gb, 4);\n    for(i=0;i<nb_components;i++)\n        s->last_dc[i] = 1024;\n    if (nb_components > 1) {\n        s->mb_width  = (s->width  + s->h_max * block_size - 1) / (s->h_max * block_size);\n        s->mb_height = (s->height + s->v_max * block_size - 1) / (s->v_max * block_size);\n    } else if(!s->ls) {\n        h = s->h_max / s->h_scount[0];\n        v = s->v_max / s->v_scount[0];\n        s->mb_width  = (s->width  + h * block_size - 1) / (h * block_size);\n        s->mb_height = (s->height + v * block_size - 1) / (v * block_size);\n        s->nb_blocks[0] = 1;\n        s->h_scount[0] = 1;\n        s->v_scount[0] = 1;\n    }\n    if(s->avctx->debug & FF_DEBUG_PICT_INFO)\n        av_log(s->avctx, AV_LOG_DEBUG, "%s %s p:%d >>:%d ilv:%d bits:%d %s\\n", s->lossless ? "lossless" : "sequential DCT", s->rgb ? "RGB" : "",\n               predictor, point_transform, ilv, s->bits,\n               s->pegasus_rct ? "PRCT" : (s->rct ? "RCT" : ""));\n    for (i = s->mjpb_skiptosod; i > 0; i--)\n        skip_bits(&s->gb, 8);\n    if(s->lossless){\n        if(CONFIG_JPEGLS_DECODER && s->ls){\n            if(ff_jpegls_decode_picture(s, predictor, point_transform, ilv) < 0)\n                return -1;\n        }else{\n            if(s->rgb){\n                if(ljpeg_decode_rgb_scan(s, predictor, point_transform) < 0)\n                    return -1;\n            }else{\n                if(ljpeg_decode_yuv_scan(s, predictor, point_transform) < 0)\n                    return -1;\n            }\n        }\n    }else{\n        if(s->progressive && predictor) {\n            if(mjpeg_decode_scan_progressive_ac(s, predictor, ilv, prev_shift, point_transform,\n                                                mb_bitmask, reference) < 0)\n                return -1;\n        } else {\n            if(mjpeg_decode_scan(s, nb_components, prev_shift, point_transform,\n                                 mb_bitmask, reference) < 0)\n                return -1;\n        }\n    }\n    emms_c();\n    return 0;\n out_of_range:\n    av_log(s->avctx, AV_LOG_ERROR, "decode_sos: ac/dc index out of range\\n");\n    return -1;\n}']