libavformat/mpegts.c:952: error: Integer Overflow L2
  ([-1, min(4093, `*section`)] - 2):unsigned8.

libavformat/mpegts.c:935:27: <LHS trace>
933.     dprintf(ts->stream, "pcr_pid=0x%x\n", pcr_pid);
934. 
935.     program_info_length = get16(&p, p_end) & 0xfff;
                               ^
936.     if (program_info_length < 0)
937.         return;

libavformat/mpegts.c:935:27: Call
933.     dprintf(ts->stream, "pcr_pid=0x%x\n", pcr_pid);
934. 
935.     program_info_length = get16(&p, p_end) & 0xfff;
                               ^
936.     if (program_info_length < 0)
937.         return;

libavformat/mpegts.c:429:9: Assignment
  427.     p = *pp;
  428.     if ((p + 1) >= p_end)
  429.         return -1;
               ^
  430.     c = AV_RB16(p);
  431.     p += 2;

libavformat/mpegts.c:935:5: Assignment
933.     dprintf(ts->stream, "pcr_pid=0x%x\n", pcr_pid);
934. 
935.     program_info_length = get16(&p, p_end) & 0xfff;
         ^
936.     if (program_info_length < 0)
937.         return;

libavformat/mpegts.c:952:13: Binary operation: ([-1, min(4093, *section)] - 2):unsigned8
950.             get8(&p, p_end); // scope
951.             get8(&p, p_end); // label
952.             len -= 2;
                 ^
953.             mp4_read_iods(ts->stream, p, len, &mp4_es_id,
954.                           &mp4_dec_config_descr, &mp4_dec_config_descr_len);

static void pmt_cb(MpegTSFilter *filter, const uint8_t *section, int section_len)
{
    MpegTSContext *ts = filter->u.section_filter.opaque;
    SectionHeader h1, *h = &h1;
    PESContext *pes;
    AVStream *st;
    const uint8_t *p, *p_end, *desc_list_end, *desc_end;
    int program_info_length, pcr_pid, pid, stream_type;
    int desc_list_len, desc_len, desc_tag;
    char language[4];
    uint32_t prog_reg_desc = 0;
    uint8_t *mp4_dec_config_descr = NULL;
    int mp4_dec_config_descr_len = 0;
    int mp4_es_id = 0;
#ifdef DEBUG
    dprintf(ts->stream, "PMT: len %i\n", section_len);
    av_hex_dump_log(ts->stream, AV_LOG_DEBUG, (uint8_t *)section, section_len);
#endif
    p_end = section + section_len - 4;
    p = section;
    if (parse_section_header(h, &p, p_end) < 0)
        return;
    dprintf(ts->stream, "sid=0x%x sec_num=%d/%d\n",
           h->id, h->sec_num, h->last_sec_num);
    if (h->tid != PMT_TID)
        return;
    clear_program(ts, h->id);
    pcr_pid = get16(&p, p_end) & 0x1fff;
    if (pcr_pid < 0)
        return;
    add_pid_to_pmt(ts, h->id, pcr_pid);
    dprintf(ts->stream, "pcr_pid=0x%x\n", pcr_pid);
    program_info_length = get16(&p, p_end) & 0xfff;
    if (program_info_length < 0)
        return;
    while(program_info_length >= 2) {
        uint8_t tag, len;
        tag = get8(&p, p_end);
        len = get8(&p, p_end);
        dprintf(ts->stream, "program tag: 0x%02x len=%d\n", tag, len);
        if(len > program_info_length - 2)
            break;
        program_info_length -= len + 2;
        if (tag == 0x1d) {
            get8(&p, p_end);
            get8(&p, p_end);
            len -= 2;
            mp4_read_iods(ts->stream, p, len, &mp4_es_id,
                          &mp4_dec_config_descr, &mp4_dec_config_descr_len);
        } else if (tag == 0x05 && len >= 4) {
            prog_reg_desc = bytestream_get_le32(&p);
            len -= 4;
        }
        p += len;
    }
    p += program_info_length;
    if (p >= p_end)
        goto out;
    if (!ts->stream->nb_streams)
        ts->stop_parse = 1;
    for(;;) {
        st = 0;
        stream_type = get8(&p, p_end);
        if (stream_type < 0)
            break;
        pid = get16(&p, p_end) & 0x1fff;
        if (pid < 0)
            break;
        if (ts->pids[pid] && ts->pids[pid]->type == MPEGTS_PES) {
            pes = ts->pids[pid]->u.pes_filter.opaque;
            if (!pes->st)
                pes->st = av_new_stream(pes->stream, pes->pid);
            st = pes->st;
        } else {
            if (ts->pids[pid]) mpegts_close_filter(ts, ts->pids[pid]);
            pes = add_pes_stream(ts, pid, pcr_pid);
            if (pes)
                st = av_new_stream(pes->stream, pes->pid);
        }
        if (!st)
            goto out;
        if (!pes->stream_type)
            mpegts_set_stream_info(st, pes, stream_type, prog_reg_desc);
        add_pid_to_pmt(ts, h->id, pid);
        ff_program_add_stream_index(ts->stream, h->id, st->index);
        desc_list_len = get16(&p, p_end) & 0xfff;
        if (desc_list_len < 0)
            break;
        desc_list_end = p + desc_list_len;
        if (desc_list_end > p_end)
            break;
        for(;;) {
            desc_tag = get8(&p, desc_list_end);
            if (desc_tag < 0)
                break;
            desc_len = get8(&p, desc_list_end);
            if (desc_len < 0)
                break;
            desc_end = p + desc_len;
            if (desc_end > desc_list_end)
                break;
            dprintf(ts->stream, "tag: 0x%02x len=%d\n",
                   desc_tag, desc_len);
            if (st->codec->codec_id == CODEC_ID_NONE &&
                stream_type == STREAM_TYPE_PRIVATE_DATA)
                mpegts_find_stream_type(st, desc_tag, DESC_types);
            switch(desc_tag) {
            case 0x1F:
                get16(&p, desc_end);
                if (st->codec->codec_id == CODEC_ID_AAC_LATM &&
                    mp4_dec_config_descr_len && mp4_es_id == pid) {
                    ByteIOContext pb;
                    init_put_byte(&pb, mp4_dec_config_descr,
                                  mp4_dec_config_descr_len, 0, NULL, NULL, NULL, NULL);
                    ff_mp4_read_dec_config_descr(ts->stream, st, &pb);
                    if (st->codec->codec_id == CODEC_ID_AAC &&
                        st->codec->extradata_size > 0)
                        st->need_parsing = 0;
                }
                break;
            case 0x56:
                language[0] = get8(&p, desc_end);
                language[1] = get8(&p, desc_end);
                language[2] = get8(&p, desc_end);
                language[3] = 0;
                av_metadata_set2(&st->metadata, "language", language, 0);
                break;
            case 0x59:
                language[0] = get8(&p, desc_end);
                language[1] = get8(&p, desc_end);
                language[2] = get8(&p, desc_end);
                language[3] = 0;
                get8(&p, desc_end);
                if (st->codec->extradata) {
                    if (st->codec->extradata_size == 4 && memcmp(st->codec->extradata, p, 4))
                        av_log_ask_for_sample(ts->stream, "DVB sub with multiple IDs\n");
                } else {
                    st->codec->extradata = av_malloc(4 + FF_INPUT_BUFFER_PADDING_SIZE);
                    if (st->codec->extradata) {
                        st->codec->extradata_size = 4;
                        memcpy(st->codec->extradata, p, 4);
                    }
                }
                p += 4;
                av_metadata_set2(&st->metadata, "language", language, 0);
                break;
            case 0x0a:
                language[0] = get8(&p, desc_end);
                language[1] = get8(&p, desc_end);
                language[2] = get8(&p, desc_end);
                language[3] = 0;
                av_metadata_set2(&st->metadata, "language", language, 0);
                break;
            case 0x05:
                st->codec->codec_tag = bytestream_get_le32(&p);
                dprintf(ts->stream, "reg_desc=%.4s\n", (char*)&st->codec->codec_tag);
                if (st->codec->codec_id == CODEC_ID_NONE &&
                    stream_type == STREAM_TYPE_PRIVATE_DATA)
                    mpegts_find_stream_type(st, st->codec->codec_tag, REGD_types);
                break;
            default:
                break;
            }
            p = desc_end;
            if (prog_reg_desc == AV_RL32("HDMV") && stream_type == 0x83 && pes->sub_st) {
                ff_program_add_stream_index(ts->stream, h->id, pes->sub_st->index);
                pes->sub_st->codec->codec_tag = st->codec->codec_tag;
            }
        }
        p = desc_list_end;
    }
 out:
    av_free(mp4_dec_config_descr);
}
['static void pmt_cb(MpegTSFilter *filter, const uint8_t *section, int section_len)\n{\n    MpegTSContext *ts = filter->u.section_filter.opaque;\n    SectionHeader h1, *h = &h1;\n    PESContext *pes;\n    AVStream *st;\n    const uint8_t *p, *p_end, *desc_list_end, *desc_end;\n    int program_info_length, pcr_pid, pid, stream_type;\n    int desc_list_len, desc_len, desc_tag;\n    char language[4];\n    uint32_t prog_reg_desc = 0;\n    uint8_t *mp4_dec_config_descr = NULL;\n    int mp4_dec_config_descr_len = 0;\n    int mp4_es_id = 0;\n#ifdef DEBUG\n    dprintf(ts->stream, "PMT: len %i\\n", section_len);\n    av_hex_dump_log(ts->stream, AV_LOG_DEBUG, (uint8_t *)section, section_len);\n#endif\n    p_end = section + section_len - 4;\n    p = section;\n    if (parse_section_header(h, &p, p_end) < 0)\n        return;\n    dprintf(ts->stream, "sid=0x%x sec_num=%d/%d\\n",\n           h->id, h->sec_num, h->last_sec_num);\n    if (h->tid != PMT_TID)\n        return;\n    clear_program(ts, h->id);\n    pcr_pid = get16(&p, p_end) & 0x1fff;\n    if (pcr_pid < 0)\n        return;\n    add_pid_to_pmt(ts, h->id, pcr_pid);\n    dprintf(ts->stream, "pcr_pid=0x%x\\n", pcr_pid);\n    program_info_length = get16(&p, p_end) & 0xfff;\n    if (program_info_length < 0)\n        return;\n    while(program_info_length >= 2) {\n        uint8_t tag, len;\n        tag = get8(&p, p_end);\n        len = get8(&p, p_end);\n        dprintf(ts->stream, "program tag: 0x%02x len=%d\\n", tag, len);\n        if(len > program_info_length - 2)\n            break;\n        program_info_length -= len + 2;\n        if (tag == 0x1d) {\n            get8(&p, p_end);\n            get8(&p, p_end);\n            len -= 2;\n            mp4_read_iods(ts->stream, p, len, &mp4_es_id,\n                          &mp4_dec_config_descr, &mp4_dec_config_descr_len);\n        } else if (tag == 0x05 && len >= 4) {\n            prog_reg_desc = bytestream_get_le32(&p);\n            len -= 4;\n        }\n        p += len;\n    }\n    p += program_info_length;\n    if (p >= p_end)\n        goto out;\n    if (!ts->stream->nb_streams)\n        ts->stop_parse = 1;\n    for(;;) {\n        st = 0;\n        stream_type = get8(&p, p_end);\n        if (stream_type < 0)\n            break;\n        pid = get16(&p, p_end) & 0x1fff;\n        if (pid < 0)\n            break;\n        if (ts->pids[pid] && ts->pids[pid]->type == MPEGTS_PES) {\n            pes = ts->pids[pid]->u.pes_filter.opaque;\n            if (!pes->st)\n                pes->st = av_new_stream(pes->stream, pes->pid);\n            st = pes->st;\n        } else {\n            if (ts->pids[pid]) mpegts_close_filter(ts, ts->pids[pid]);\n            pes = add_pes_stream(ts, pid, pcr_pid);\n            if (pes)\n                st = av_new_stream(pes->stream, pes->pid);\n        }\n        if (!st)\n            goto out;\n        if (!pes->stream_type)\n            mpegts_set_stream_info(st, pes, stream_type, prog_reg_desc);\n        add_pid_to_pmt(ts, h->id, pid);\n        ff_program_add_stream_index(ts->stream, h->id, st->index);\n        desc_list_len = get16(&p, p_end) & 0xfff;\n        if (desc_list_len < 0)\n            break;\n        desc_list_end = p + desc_list_len;\n        if (desc_list_end > p_end)\n            break;\n        for(;;) {\n            desc_tag = get8(&p, desc_list_end);\n            if (desc_tag < 0)\n                break;\n            desc_len = get8(&p, desc_list_end);\n            if (desc_len < 0)\n                break;\n            desc_end = p + desc_len;\n            if (desc_end > desc_list_end)\n                break;\n            dprintf(ts->stream, "tag: 0x%02x len=%d\\n",\n                   desc_tag, desc_len);\n            if (st->codec->codec_id == CODEC_ID_NONE &&\n                stream_type == STREAM_TYPE_PRIVATE_DATA)\n                mpegts_find_stream_type(st, desc_tag, DESC_types);\n            switch(desc_tag) {\n            case 0x1F:\n                get16(&p, desc_end);\n                if (st->codec->codec_id == CODEC_ID_AAC_LATM &&\n                    mp4_dec_config_descr_len && mp4_es_id == pid) {\n                    ByteIOContext pb;\n                    init_put_byte(&pb, mp4_dec_config_descr,\n                                  mp4_dec_config_descr_len, 0, NULL, NULL, NULL, NULL);\n                    ff_mp4_read_dec_config_descr(ts->stream, st, &pb);\n                    if (st->codec->codec_id == CODEC_ID_AAC &&\n                        st->codec->extradata_size > 0)\n                        st->need_parsing = 0;\n                }\n                break;\n            case 0x56:\n                language[0] = get8(&p, desc_end);\n                language[1] = get8(&p, desc_end);\n                language[2] = get8(&p, desc_end);\n                language[3] = 0;\n                av_metadata_set2(&st->metadata, "language", language, 0);\n                break;\n            case 0x59:\n                language[0] = get8(&p, desc_end);\n                language[1] = get8(&p, desc_end);\n                language[2] = get8(&p, desc_end);\n                language[3] = 0;\n                get8(&p, desc_end);\n                if (st->codec->extradata) {\n                    if (st->codec->extradata_size == 4 && memcmp(st->codec->extradata, p, 4))\n                        av_log_ask_for_sample(ts->stream, "DVB sub with multiple IDs\\n");\n                } else {\n                    st->codec->extradata = av_malloc(4 + FF_INPUT_BUFFER_PADDING_SIZE);\n                    if (st->codec->extradata) {\n                        st->codec->extradata_size = 4;\n                        memcpy(st->codec->extradata, p, 4);\n                    }\n                }\n                p += 4;\n                av_metadata_set2(&st->metadata, "language", language, 0);\n                break;\n            case 0x0a:\n                language[0] = get8(&p, desc_end);\n                language[1] = get8(&p, desc_end);\n                language[2] = get8(&p, desc_end);\n                language[3] = 0;\n                av_metadata_set2(&st->metadata, "language", language, 0);\n                break;\n            case 0x05:\n                st->codec->codec_tag = bytestream_get_le32(&p);\n                dprintf(ts->stream, "reg_desc=%.4s\\n", (char*)&st->codec->codec_tag);\n                if (st->codec->codec_id == CODEC_ID_NONE &&\n                    stream_type == STREAM_TYPE_PRIVATE_DATA)\n                    mpegts_find_stream_type(st, st->codec->codec_tag, REGD_types);\n                break;\n            default:\n                break;\n            }\n            p = desc_end;\n            if (prog_reg_desc == AV_RL32("HDMV") && stream_type == 0x83 && pes->sub_st) {\n                ff_program_add_stream_index(ts->stream, h->id, pes->sub_st->index);\n                pes->sub_st->codec->codec_tag = st->codec->codec_tag;\n            }\n        }\n        p = desc_list_end;\n    }\n out:\n    av_free(mp4_dec_config_descr);\n}', 'static inline int get16(const uint8_t **pp, const uint8_t *p_end)\n{\n    const uint8_t *p;\n    int c;\n    p = *pp;\n    if ((p + 1) >= p_end)\n        return -1;\n    c = AV_RB16(p);\n    p += 2;\n    *pp = p;\n    return c;\n}']