libavcodec/mpeg12.c:2328: error: Integer Overflow L1
  ([1099511627520, +oo] + `*buf`):unsigned32 by call to `ff_find_start_code`.

libavcodec/mpeg12.c:2315:1: Parameter `*buf`
2313. }
2314. 
2315. static int decode_chunks(AVCodecContext *avctx,
      ^
2316.                              AVFrame *picture, int *data_size,
2317.                              const uint8_t *buf, int buf_size)

libavcodec/mpeg12.c:2328:19: Call
2326.         /* find next start code */
2327.         uint32_t start_code = -1;
2328.         buf_ptr = ff_find_start_code(buf_ptr,buf_end, &start_code);
                        ^
2329.         if (start_code > 0x1ff){
2330.             if(s2->pict_type != FF_B_TYPE || avctx->skip_frame <= AVDISCARD_DEFAULT){

libavcodec/mpegvideo.c:89:1: <LHS trace>
87. };
88. 
89. const uint8_t *ff_find_start_code(const uint8_t * restrict p, const uint8_t *end, uint32_t * restrict state){
    ^
90.     int i;
91. 

libavcodec/mpegvideo.c:89:1: Parameter `*state`
  87. };
  88. 
  89. const uint8_t *ff_find_start_code(const uint8_t * restrict p, const uint8_t *end, uint32_t * restrict state){
      ^
  90.     int i;
  91. 

libavcodec/mpegvideo.c:97:9: Assignment
  95. 
  96.     for(i=0; i<3; i++){
  97.         uint32_t tmp= *state << 8;
              ^
  98.         *state= tmp + *(p++);
  99.         if(tmp == 0x100 || p==end)

libavcodec/mpegvideo.c:89:1: <RHS trace>
87. };
88. 
89. const uint8_t *ff_find_start_code(const uint8_t * restrict p, const uint8_t *end, uint32_t * restrict state){
    ^
90.     int i;
91. 

libavcodec/mpegvideo.c:89:1: Parameter `*p`
  87. };
  88. 
  89. const uint8_t *ff_find_start_code(const uint8_t * restrict p, const uint8_t *end, uint32_t * restrict state){
      ^
  90.     int i;
  91. 

libavcodec/mpegvideo.c:98:9: Binary operation: ([1099511627520, +oo] + *buf):unsigned32 by call to `ff_find_start_code` 
   96.     for(i=0; i<3; i++){
   97.         uint32_t tmp= *state << 8;
   98.         *state= tmp + *(p++);
               ^
   99.         if(tmp == 0x100 || p==end)
  100.             return p;

const uint8_t *ff_find_start_code(const uint8_t * restrict p, const uint8_t *end, uint32_t * restrict state){
    int i;
    assert(p<=end);
    if(p>=end)
        return end;
    for(i=0; i<3; i++){
        uint32_t tmp= *state << 8;
        *state= tmp + *(p++);
        if(tmp == 0x100 || p==end)
            return p;
    }
    while(p<end){
        if     (p[-1] > 1      ) p+= 3;
        else if(p[-2]          ) p+= 2;
        else if(p[-3]|(p[-1]-1)) p++;
        else{
            p++;
            break;
        }
    }
    p= FFMIN(p, end)-4;
    *state= AV_RB32(p);
    return p+4;
}
['static int decode_chunks(AVCodecContext *avctx,\n                             AVFrame *picture, int *data_size,\n                             const uint8_t *buf, int buf_size)\n{\n    Mpeg1Context *s = avctx->priv_data;\n    MpegEncContext *s2 = &s->mpeg_enc_ctx;\n    const uint8_t *buf_ptr = buf;\n    const uint8_t *buf_end = buf + buf_size;\n    int ret, input_size;\n    for(;;) {\n        uint32_t start_code = -1;\n        buf_ptr = ff_find_start_code(buf_ptr,buf_end, &start_code);\n        if (start_code > 0x1ff){\n            if(s2->pict_type != FF_B_TYPE || avctx->skip_frame <= AVDISCARD_DEFAULT){\n                if(avctx->thread_count > 1){\n                    int i;\n                    avctx->execute(avctx, slice_decode_thread,  (void**)&(s2->thread_context[0]), NULL, s->slice_count, sizeof(void*));\n                    for(i=0; i<s->slice_count; i++)\n                        s2->error_count += s2->thread_context[i]->error_count;\n                }\n                if (CONFIG_MPEG_VDPAU_DECODER && avctx->codec->capabilities&CODEC_CAP_HWACCEL_VDPAU)\n                    ff_vdpau_mpeg_picture_complete(s2, buf, buf_size, s->slice_count);\n                if (slice_end(avctx, picture)) {\n                    if(s2->last_picture_ptr || s2->low_delay)\n                        *data_size = sizeof(AVPicture);\n                }\n            }\n            s2->pict_type= 0;\n            return FFMAX(0, buf_ptr - buf - s2->parse_context.last_index);\n        }\n        input_size = buf_end - buf_ptr;\n        if(avctx->debug & FF_DEBUG_STARTCODE){\n            av_log(avctx, AV_LOG_DEBUG, "%3X at %td left %d\\n", start_code, buf_ptr-buf, input_size);\n        }\n        switch(start_code) {\n        case SEQ_START_CODE:\n            mpeg1_decode_sequence(avctx, buf_ptr,\n                                    input_size);\n            break;\n        case PICTURE_START_CODE:\n            if(mpeg1_decode_picture(avctx,\n                                    buf_ptr, input_size) < 0)\n                s2->pict_type=0;\n            break;\n        case EXT_START_CODE:\n            mpeg_decode_extension(avctx,\n                                    buf_ptr, input_size);\n            break;\n        case USER_START_CODE:\n            mpeg_decode_user_data(avctx,\n                                    buf_ptr, input_size);\n            break;\n        case GOP_START_CODE:\n            s2->first_field=0;\n            mpeg_decode_gop(avctx,\n                                    buf_ptr, input_size);\n            break;\n        default:\n            if (start_code >= SLICE_MIN_START_CODE &&\n                start_code <= SLICE_MAX_START_CODE) {\n                int mb_y= start_code - SLICE_MIN_START_CODE;\n                if(s2->last_picture_ptr==NULL){\n                    if(s2->pict_type==FF_B_TYPE) break;\n                }\n                if(s2->next_picture_ptr==NULL){\n                    if(s2->pict_type==FF_P_TYPE && (s2->first_field || s2->picture_structure==PICT_FRAME)) break;\n                }\n                if(avctx->hurry_up && s2->pict_type==FF_B_TYPE) break;\n                if(  (avctx->skip_frame >= AVDISCARD_NONREF && s2->pict_type==FF_B_TYPE)\n                    ||(avctx->skip_frame >= AVDISCARD_NONKEY && s2->pict_type!=FF_I_TYPE)\n                    || avctx->skip_frame >= AVDISCARD_ALL)\n                    break;\n                if(avctx->hurry_up>=5) break;\n                if (!s->mpeg_enc_ctx_allocated) break;\n                if(s2->codec_id == CODEC_ID_MPEG2VIDEO){\n                    if(mb_y < avctx->skip_top || mb_y >= s2->mb_height - avctx->skip_bottom)\n                        break;\n                }\n                if(!s2->pict_type){\n                    av_log(avctx, AV_LOG_ERROR, "Missing picture start code\\n");\n                    break;\n                }\n                if(s2->first_slice){\n                    s2->first_slice=0;\n                    if(mpeg_field_start(s2, buf, buf_size) < 0)\n                        return -1;\n                }\n                if(!s2->current_picture_ptr){\n                    av_log(avctx, AV_LOG_ERROR, "current_picture not initialized\\n");\n                    return -1;\n                }\n                if (avctx->codec->capabilities&CODEC_CAP_HWACCEL_VDPAU) {\n                    s->slice_count++;\n                    break;\n                }\n                if(avctx->thread_count > 1){\n                    int threshold= (s2->mb_height*s->slice_count + avctx->thread_count/2) / avctx->thread_count;\n                    if(threshold <= mb_y){\n                        MpegEncContext *thread_context= s2->thread_context[s->slice_count];\n                        thread_context->start_mb_y= mb_y;\n                        thread_context->end_mb_y  = s2->mb_height;\n                        if(s->slice_count){\n                            s2->thread_context[s->slice_count-1]->end_mb_y= mb_y;\n                            ff_update_duplicate_context(thread_context, s2);\n                        }\n                        init_get_bits(&thread_context->gb, buf_ptr, input_size*8);\n                        s->slice_count++;\n                    }\n                    buf_ptr += 2;\n                }else{\n                    ret = mpeg_decode_slice(s, mb_y, &buf_ptr, input_size);\n                    emms_c();\n                    if(ret < 0){\n                        if(s2->resync_mb_x>=0 && s2->resync_mb_y>=0)\n                            ff_er_add_slice(s2, s2->resync_mb_x, s2->resync_mb_y, s2->mb_x, s2->mb_y, AC_ERROR|DC_ERROR|MV_ERROR);\n                    }else{\n                        ff_er_add_slice(s2, s2->resync_mb_x, s2->resync_mb_y, s2->mb_x-1, s2->mb_y, AC_END|DC_END|MV_END);\n                    }\n                }\n            }\n            break;\n        }\n    }\n}', 'const uint8_t *ff_find_start_code(const uint8_t * restrict p, const uint8_t *end, uint32_t * restrict state){\n    int i;\n    assert(p<=end);\n    if(p>=end)\n        return end;\n    for(i=0; i<3; i++){\n        uint32_t tmp= *state << 8;\n        *state= tmp + *(p++);\n        if(tmp == 0x100 || p==end)\n            return p;\n    }\n    while(p<end){\n        if     (p[-1] > 1      ) p+= 3;\n        else if(p[-2]          ) p+= 2;\n        else if(p[-3]|(p[-1]-1)) p++;\n        else{\n            p++;\n            break;\n        }\n    }\n    p= FFMIN(p, end)-4;\n    *state= AV_RB32(p);\n    return p+4;\n}']