libavcodec/h264_parser.c:242: error: Buffer Overrun L3
  Offset: [2, +oo] Size: [1, 2147483631] by call to `ff_h264_decode_sei`.

libavcodec/h264_parser.c:201:5: Call
199. 
200.     h->avctx = avctx;
201.     ff_h264_reset_sei(h);
         ^
202. 
203.     if (!buf_size)

libavcodec/h264_sei.c:47:5: Assignment
  45.     h->sei_reguserdata_afd_present  =  0;
  46. 
  47.     h->a53_caption_size = 0;
          ^
  48.     av_freep(&h->a53_caption);
  49. }

libavcodec/h264_parser.c:242:13: Call
240.             break;
241.         case NAL_SEI:
242.             ff_h264_decode_sei(h);
                 ^
243.             break;
244.         case NAL_IDR_SLICE:

libavcodec/h264_sei.c:308:1: Parameter `h->a53_caption_size`
  306. }
  307. 
  308. int ff_h264_decode_sei(H264Context *h)
       ^
  309. {
  310.     while (get_bits_left(&h->gb) > 16) {

libavcodec/h264_sei.c:340:19: Call
  338.             break;
  339.         case SEI_TYPE_USER_DATA_REGISTERED:
  340.             ret = decode_registered_user_data(h, size);
                         ^
  341.             break;
  342.         case SEI_TYPE_USER_DATA_UNREGISTERED:

libavcodec/h264_sei.c:109:1: <Offset trace>
107. }
108. 
109. static int decode_registered_user_data(H264Context *h, int size)
     ^
110. {
111.     uint32_t country_code;

libavcodec/h264_sei.c:109:1: Parameter `h->a53_caption_size`
    107. }
    108. 
    109. static int decode_registered_user_data(H264Context *h, int size)
         ^
    110. {
    111.     uint32_t country_code;

libavcodec/h264_sei.c:176:44: Assignment
    174. 
    175.                         for (i = 0; i < cc_count; i++) {
    176.                             h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
                                                    ^
    177.                             h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
    178.                             h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);

libavcodec/h264_sei.c:177:44: Assignment
    175.                         for (i = 0; i < cc_count; i++) {
    176.                             h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
    177.                             h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
                                                    ^
    178.                             h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
    179.                         }

libavcodec/h264_sei.c:157:32: <Length trace>
155.                 if (flag) {
156.                     skip_bits(&h->gb, 1);       // zero bit
157.                     cc_count = get_bits(&h->gb, 5);
                                    ^
158.                     skip_bits(&h->gb, 8);       // reserved
159.                     size -= 2;

libavcodec/h264_sei.c:157:32: Call
    155.                 if (flag) {
    156.                     skip_bits(&h->gb, 1);       // zero bit
    157.                     cc_count = get_bits(&h->gb, 5);
                                        ^
    158.                     skip_bits(&h->gb, 8);       // reserved
    159.                     size -= 2;

libavcodec/get_bits.h:245:5: Call
      243.     register int tmp;
      244.     OPEN_READER(re, s);
      245.     UPDATE_CACHE(re, s);
               ^
      246.     tmp = SHOW_UBITS(re, s, n);
      247.     LAST_SKIP_BITS(re, s, n);

libavutil/ppc/intreadwrite.h:63:5: Assignment
        61.     uint32_t v;
        62.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
        63.     return v;
                ^
        64. }
        65. 

libavcodec/get_bits.h:245:5: Assignment
      243.     register int tmp;
      244.     OPEN_READER(re, s);
      245.     UPDATE_CACHE(re, s);
               ^
      246.     tmp = SHOW_UBITS(re, s, n);
      247.     LAST_SKIP_BITS(re, s, n);

libavcodec/get_bits.h:246:5: Assignment
      244.     OPEN_READER(re, s);
      245.     UPDATE_CACHE(re, s);
      246.     tmp = SHOW_UBITS(re, s, n);
               ^
      247.     LAST_SKIP_BITS(re, s, n);
      248.     CLOSE_READER(re, s);

libavcodec/get_bits.h:249:5: Assignment
      247.     LAST_SKIP_BITS(re, s, n);
      248.     CLOSE_READER(re, s);
      249.     return tmp;
               ^
      250. }
      251. 

libavcodec/h264_sei.c:157:21: Assignment
    155.                 if (flag) {
    156.                     skip_bits(&h->gb, 1);       // zero bit
    157.                     cc_count = get_bits(&h->gb, 5);
                             ^
    158.                     skip_bits(&h->gb, 8);       // reserved
    159.                     size -= 2;

libavcodec/h264_sei.c:170:31: Call
    168. 
    169.                         /* Allow merging of the cc data from two fields. */
    170.                         ret = av_reallocp(&h->a53_caption,
                                       ^
    171.                                           h->a53_caption_size + cc_count * 3);
    172.                         if (ret < 0)

libavutil/mem.c:145:9: Call
      143. 
      144.     if (!size) {
      145.         av_freep(ptr);
                   ^
      146.         return 0;
      147.     }

libavutil/mem.c:207:26: Assignment
        205. 
        206.     memcpy(&val, arg, sizeof(val));
        207.     memcpy(arg, &(void *){ NULL }, sizeof(val));
                                      ^
        208.     av_free(val);
        209. }

libavcodec/h264_sei.c:178:29: Array access: Offset: [2, +oo] Size: [1, 2147483631] by call to `ff_h264_decode_sei` 
    176.                             h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
    177.                             h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
    178.                             h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
                                     ^
    179.                         }
    180. 

static int decode_registered_user_data(H264Context *h, int size)
{
    uint32_t country_code;
    uint32_t user_identifier;
    int flag, user_data_type_code, cc_count;
    if (size < 7)
        return AVERROR_INVALIDDATA;
    size -= 7;
    country_code = get_bits(&h->gb, 8);
    if (country_code == 0xFF) {
        skip_bits(&h->gb, 8);
        size--;
    }
    skip_bits(&h->gb, 8);
    skip_bits(&h->gb, 8);
    user_identifier = get_bits_long(&h->gb, 32);
    switch (user_identifier) {
        case MKBETAG('D', 'T', 'G', '1'):
            if (size-- < 1)
                return AVERROR_INVALIDDATA;
            skip_bits(&h->gb, 1);
            flag = get_bits(&h->gb, 1);
            skip_bits(&h->gb, 6);
            if (flag) {
                if (size-- < 1)
                    return AVERROR_INVALIDDATA;
                skip_bits(&h->gb, 4);
                h->active_format_description   = get_bits(&h->gb, 4);
                h->sei_reguserdata_afd_present = 1;
            }
            break;
        case MKBETAG('G', 'A', '9', '4'):
            if (size < 3)
                return AVERROR(EINVAL);
            user_data_type_code = get_bits(&h->gb, 8);
            if (user_data_type_code == 0x3) {
                skip_bits(&h->gb, 1);
                flag = get_bits(&h->gb, 1);
                if (flag) {
                    skip_bits(&h->gb, 1);
                    cc_count = get_bits(&h->gb, 5);
                    skip_bits(&h->gb, 8);
                    size -= 2;
                    if (cc_count && size >= cc_count * 3) {
                        int i, ret;
                        int new_size = (int64_t) h->a53_caption_size +
                                       (int64_t) cc_count * 3;
                        if (new_size > INT_MAX)
                            return AVERROR(EINVAL);
                        ret = av_reallocp(&h->a53_caption,
                                          h->a53_caption_size + cc_count * 3);
                        if (ret < 0)
                            return ret;
                        for (i = 0; i < cc_count; i++) {
                            h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
                            h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
                            h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);
                        }
                        skip_bits(&h->gb, 8);
                    }
                }
            }
            break;
        default:
            skip_bits(&h->gb, size * 8);
            break;
    }
    return 0;
}
['static inline int parse_nal_units(AVCodecParserContext *s,\n                                  AVCodecContext *avctx,\n                                  const uint8_t *buf, int buf_size)\n{\n    H264ParseContext *p = s->priv_data;\n    H264Context      *h = &p->h;\n    H264SliceContext *sl = &h->slice_ctx[0];\n    const uint8_t *buf_end = buf + buf_size;\n    unsigned int pps_id;\n    unsigned int slice_type;\n    int state = -1, got_reset = 0;\n    const uint8_t *ptr;\n    int field_poc[2];\n    s->pict_type         = AV_PICTURE_TYPE_I;\n    s->key_frame         = 0;\n    s->picture_structure = AV_PICTURE_STRUCTURE_UNKNOWN;\n    h->avctx = avctx;\n    ff_h264_reset_sei(h);\n    if (!buf_size)\n        return 0;\n    for (;;) {\n        int src_length, dst_length, consumed;\n        buf = avpriv_find_start_code(buf, buf_end, &state);\n        if (buf >= buf_end)\n            break;\n        --buf;\n        src_length = buf_end - buf;\n        switch (state & 0x1f) {\n        case NAL_SLICE:\n        case NAL_IDR_SLICE:\n            if ((state & 0x1f) == NAL_IDR_SLICE || ((state >> 5) & 0x3) == 0) {\n                if (src_length > 60)\n                    src_length = 60;\n            } else {\n                if (src_length > 1000)\n                    src_length = 1000;\n            }\n            break;\n        }\n        ptr = ff_h264_decode_nal(h, sl, buf, &dst_length, &consumed, src_length);\n        if (!ptr || dst_length < 0)\n            break;\n        init_get_bits(&h->gb, ptr, 8 * dst_length);\n        switch (h->nal_unit_type) {\n        case NAL_SPS:\n            ff_h264_decode_seq_parameter_set(h);\n            break;\n        case NAL_PPS:\n            ff_h264_decode_picture_parameter_set(h, h->gb.size_in_bits);\n            break;\n        case NAL_SEI:\n            ff_h264_decode_sei(h);\n            break;\n        case NAL_IDR_SLICE:\n            s->key_frame = 1;\n            h->prev_frame_num        = 0;\n            h->prev_frame_num_offset = 0;\n            h->prev_poc_msb          =\n            h->prev_poc_lsb          = 0;\n        case NAL_SLICE:\n            init_get_bits(&sl->gb, ptr, 8 * dst_length);\n            get_ue_golomb(&sl->gb);\n            slice_type   = get_ue_golomb_31(&sl->gb);\n            s->pict_type = golomb_to_pict_type[slice_type % 5];\n            if (h->sei_recovery_frame_cnt >= 0) {\n                s->key_frame = 1;\n            }\n            pps_id = get_ue_golomb(&sl->gb);\n            if (pps_id >= MAX_PPS_COUNT) {\n                av_log(h->avctx, AV_LOG_ERROR,\n                       "pps_id %u out of range\\n", pps_id);\n                return -1;\n            }\n            if (!h->pps_buffers[pps_id]) {\n                av_log(h->avctx, AV_LOG_ERROR,\n                       "non-existing PPS %u referenced\\n", pps_id);\n                return -1;\n            }\n            h->pps = *h->pps_buffers[pps_id];\n            if (!h->sps_buffers[h->pps.sps_id]) {\n                av_log(h->avctx, AV_LOG_ERROR,\n                       "non-existing SPS %u referenced\\n", h->pps.sps_id);\n                return -1;\n            }\n            h->sps       = *h->sps_buffers[h->pps.sps_id];\n            h->frame_num = get_bits(&sl->gb, h->sps.log2_max_frame_num);\n            s->coded_width  = 16 * h->sps.mb_width;\n            s->coded_height = 16 * h->sps.mb_height;\n            s->width        = s->coded_width  - (h->sps.crop_right + h->sps.crop_left);\n            s->height       = s->coded_height - (h->sps.crop_top   + h->sps.crop_bottom);\n            if (s->width <= 0 || s->height <= 0) {\n                s->width  = s->coded_width;\n                s->height = s->coded_height;\n            }\n            switch (h->sps.bit_depth_luma) {\n            case 9:\n                if (CHROMA444(h))      s->format = AV_PIX_FMT_YUV444P9;\n                else if (CHROMA422(h)) s->format = AV_PIX_FMT_YUV422P9;\n                else                   s->format = AV_PIX_FMT_YUV420P9;\n                break;\n            case 10:\n                if (CHROMA444(h))      s->format = AV_PIX_FMT_YUV444P10;\n                else if (CHROMA422(h)) s->format = AV_PIX_FMT_YUV422P10;\n                else                   s->format = AV_PIX_FMT_YUV420P10;\n                break;\n            case 8:\n                if (CHROMA444(h))      s->format = AV_PIX_FMT_YUV444P;\n                else if (CHROMA422(h)) s->format = AV_PIX_FMT_YUV422P;\n                else                   s->format = AV_PIX_FMT_YUV420P;\n                break;\n            default:\n                s->format = AV_PIX_FMT_NONE;\n            }\n            avctx->profile = ff_h264_get_profile(&h->sps);\n            avctx->level   = h->sps.level_idc;\n            if (h->sps.frame_mbs_only_flag) {\n                h->picture_structure = PICT_FRAME;\n            } else {\n                if (get_bits1(&sl->gb)) {\n                    h->picture_structure = PICT_TOP_FIELD + get_bits1(&sl->gb);\n                } else {\n                    h->picture_structure = PICT_FRAME;\n                }\n            }\n            if (h->nal_unit_type == NAL_IDR_SLICE)\n                get_ue_golomb(&sl->gb);\n            if (h->sps.poc_type == 0) {\n                h->poc_lsb = get_bits(&sl->gb, h->sps.log2_max_poc_lsb);\n                if (h->pps.pic_order_present == 1 &&\n                    h->picture_structure == PICT_FRAME)\n                    h->delta_poc_bottom = get_se_golomb(&sl->gb);\n            }\n            if (h->sps.poc_type == 1 &&\n                !h->sps.delta_pic_order_always_zero_flag) {\n                h->delta_poc[0] = get_se_golomb(&sl->gb);\n                if (h->pps.pic_order_present == 1 &&\n                    h->picture_structure == PICT_FRAME)\n                    h->delta_poc[1] = get_se_golomb(&sl->gb);\n            }\n            field_poc[0] = field_poc[1] = INT_MAX;\n            ff_init_poc(h, field_poc, &s->output_picture_number);\n            if (h->nal_ref_idc && h->nal_unit_type != NAL_IDR_SLICE) {\n                got_reset = scan_mmco_reset(s);\n                if (got_reset < 0)\n                    return got_reset;\n            }\n            h->prev_frame_num        = got_reset ? 0 : h->frame_num;\n            h->prev_frame_num_offset = got_reset ? 0 : h->frame_num_offset;\n            if (h->nal_ref_idc != 0) {\n                if (!got_reset) {\n                    h->prev_poc_msb = h->poc_msb;\n                    h->prev_poc_lsb = h->poc_lsb;\n                } else {\n                    h->prev_poc_msb = 0;\n                    h->prev_poc_lsb =\n                        h->picture_structure == PICT_BOTTOM_FIELD ? 0 : field_poc[0];\n                }\n            }\n            if (h->sps.pic_struct_present_flag) {\n                switch (h->sei_pic_struct) {\n                case SEI_PIC_STRUCT_TOP_FIELD:\n                case SEI_PIC_STRUCT_BOTTOM_FIELD:\n                    s->repeat_pict = 0;\n                    break;\n                case SEI_PIC_STRUCT_FRAME:\n                case SEI_PIC_STRUCT_TOP_BOTTOM:\n                case SEI_PIC_STRUCT_BOTTOM_TOP:\n                    s->repeat_pict = 1;\n                    break;\n                case SEI_PIC_STRUCT_TOP_BOTTOM_TOP:\n                case SEI_PIC_STRUCT_BOTTOM_TOP_BOTTOM:\n                    s->repeat_pict = 2;\n                    break;\n                case SEI_PIC_STRUCT_FRAME_DOUBLING:\n                    s->repeat_pict = 3;\n                    break;\n                case SEI_PIC_STRUCT_FRAME_TRIPLING:\n                    s->repeat_pict = 5;\n                    break;\n                default:\n                    s->repeat_pict = h->picture_structure == PICT_FRAME ? 1 : 0;\n                    break;\n                }\n            } else {\n                s->repeat_pict = h->picture_structure == PICT_FRAME ? 1 : 0;\n            }\n            if (h->picture_structure == PICT_FRAME) {\n                s->picture_structure = AV_PICTURE_STRUCTURE_FRAME;\n                if (h->sps.pic_struct_present_flag) {\n                    switch (h->sei_pic_struct) {\n                    case SEI_PIC_STRUCT_TOP_BOTTOM:\n                    case SEI_PIC_STRUCT_TOP_BOTTOM_TOP:\n                        s->field_order = AV_FIELD_TT;\n                        break;\n                    case SEI_PIC_STRUCT_BOTTOM_TOP:\n                    case SEI_PIC_STRUCT_BOTTOM_TOP_BOTTOM:\n                        s->field_order = AV_FIELD_BB;\n                        break;\n                    default:\n                        s->field_order = AV_FIELD_PROGRESSIVE;\n                        break;\n                    }\n                } else {\n                    if (field_poc[0] < field_poc[1])\n                        s->field_order = AV_FIELD_TT;\n                    else if (field_poc[0] > field_poc[1])\n                        s->field_order = AV_FIELD_BB;\n                    else\n                        s->field_order = AV_FIELD_PROGRESSIVE;\n                }\n            } else {\n                if (h->picture_structure == PICT_TOP_FIELD)\n                    s->picture_structure = AV_PICTURE_STRUCTURE_TOP_FIELD;\n                else\n                    s->picture_structure = AV_PICTURE_STRUCTURE_BOTTOM_FIELD;\n                s->field_order = AV_FIELD_UNKNOWN;\n            }\n            return 0;\n        }\n        buf += consumed;\n    }\n    av_log(h->avctx, AV_LOG_ERROR, "missing picture in access unit\\n");\n    return -1;\n}', 'void ff_h264_reset_sei(H264Context *h)\n{\n    h->sei_recovery_frame_cnt       = -1;\n    h->sei_dpb_output_delay         =  0;\n    h->sei_cpb_removal_delay        = -1;\n    h->sei_buffering_period_present =  0;\n    h->sei_frame_packing_present    =  0;\n    h->sei_display_orientation_present = 0;\n    h->sei_reguserdata_afd_present  =  0;\n    h->a53_caption_size = 0;\n    av_freep(&h->a53_caption);\n}', 'int ff_h264_decode_sei(H264Context *h)\n{\n    while (get_bits_left(&h->gb) > 16) {\n        int size = 0;\n        int type = 0;\n        int ret  = 0;\n        int last = 0;\n        while (get_bits_left(&h->gb) >= 8 &&\n               (last = get_bits(&h->gb, 8)) == 255) {\n            type += 255;\n        }\n        type += last;\n        last = 0;\n        while (get_bits_left(&h->gb) >= 8 &&\n               (last = get_bits(&h->gb, 8)) == 255) {\n            size += 255;\n        }\n        size += last;\n        if (size > get_bits_left(&h->gb) / 8) {\n            av_log(h->avctx, AV_LOG_ERROR, "SEI type %d truncated at %d\\n",\n                   type, get_bits_left(&h->gb));\n            return AVERROR_INVALIDDATA;\n        }\n        switch (type) {\n        case SEI_TYPE_PIC_TIMING:\n            ret = decode_picture_timing(h);\n            break;\n        case SEI_TYPE_USER_DATA_REGISTERED:\n            ret = decode_registered_user_data(h, size);\n            break;\n        case SEI_TYPE_USER_DATA_UNREGISTERED:\n            ret = decode_unregistered_user_data(h, size);\n            break;\n        case SEI_TYPE_RECOVERY_POINT:\n            ret = decode_recovery_point(h);\n            break;\n        case SEI_TYPE_BUFFERING_PERIOD:\n            ret = decode_buffering_period(h);\n            break;\n        case SEI_TYPE_FRAME_PACKING:\n            ret = decode_frame_packing_arrangement(h);\n            break;\n        case SEI_TYPE_DISPLAY_ORIENTATION:\n            ret = decode_display_orientation(h);\n            break;\n        default:\n            av_log(h->avctx, AV_LOG_DEBUG, "unknown SEI type %d\\n", type);\n            skip_bits(&h->gb, 8 * size);\n        }\n        if (ret < 0)\n            return ret;\n        align_get_bits(&h->gb);\n    }\n    return 0;\n}', "static int decode_registered_user_data(H264Context *h, int size)\n{\n    uint32_t country_code;\n    uint32_t user_identifier;\n    int flag, user_data_type_code, cc_count;\n    if (size < 7)\n        return AVERROR_INVALIDDATA;\n    size -= 7;\n    country_code = get_bits(&h->gb, 8);\n    if (country_code == 0xFF) {\n        skip_bits(&h->gb, 8);\n        size--;\n    }\n    skip_bits(&h->gb, 8);\n    skip_bits(&h->gb, 8);\n    user_identifier = get_bits_long(&h->gb, 32);\n    switch (user_identifier) {\n        case MKBETAG('D', 'T', 'G', '1'):\n            if (size-- < 1)\n                return AVERROR_INVALIDDATA;\n            skip_bits(&h->gb, 1);\n            flag = get_bits(&h->gb, 1);\n            skip_bits(&h->gb, 6);\n            if (flag) {\n                if (size-- < 1)\n                    return AVERROR_INVALIDDATA;\n                skip_bits(&h->gb, 4);\n                h->active_format_description   = get_bits(&h->gb, 4);\n                h->sei_reguserdata_afd_present = 1;\n            }\n            break;\n        case MKBETAG('G', 'A', '9', '4'):\n            if (size < 3)\n                return AVERROR(EINVAL);\n            user_data_type_code = get_bits(&h->gb, 8);\n            if (user_data_type_code == 0x3) {\n                skip_bits(&h->gb, 1);\n                flag = get_bits(&h->gb, 1);\n                if (flag) {\n                    skip_bits(&h->gb, 1);\n                    cc_count = get_bits(&h->gb, 5);\n                    skip_bits(&h->gb, 8);\n                    size -= 2;\n                    if (cc_count && size >= cc_count * 3) {\n                        int i, ret;\n                        int new_size = (int64_t) h->a53_caption_size +\n                                       (int64_t) cc_count * 3;\n                        if (new_size > INT_MAX)\n                            return AVERROR(EINVAL);\n                        ret = av_reallocp(&h->a53_caption,\n                                          h->a53_caption_size + cc_count * 3);\n                        if (ret < 0)\n                            return ret;\n                        for (i = 0; i < cc_count; i++) {\n                            h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);\n                            h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);\n                            h->a53_caption[h->a53_caption_size++] = get_bits(&h->gb, 8);\n                        }\n                        skip_bits(&h->gb, 8);\n                    }\n                }\n            }\n            break;\n        default:\n            skip_bits(&h->gb, size * 8);\n            break;\n    }\n    return 0;\n}", 'static inline unsigned int get_bits(GetBitContext *s, int n)\n{\n    register int tmp;\n    OPEN_READER(re, s);\n    UPDATE_CACHE(re, s);\n    tmp = SHOW_UBITS(re, s, n);\n    LAST_SKIP_BITS(re, s, n);\n    CLOSE_READER(re, s);\n    return tmp;\n}', 'int av_reallocp(void *ptr, size_t size)\n{\n    void *val;\n    if (!size) {\n        av_freep(ptr);\n        return 0;\n    }\n    memcpy(&val, ptr, sizeof(val));\n    val = av_realloc(val, size);\n    if (!val) {\n        av_freep(ptr);\n        return AVERROR(ENOMEM);\n    }\n    memcpy(ptr, &val, sizeof(val));\n    return 0;\n}', 'void av_freep(void *arg)\n{\n    void *val;\n    memcpy(&val, arg, sizeof(val));\n    memcpy(arg, &(void *){ NULL }, sizeof(val));\n    av_free(val);\n}']