libavcodec/mjpegdec.c:1475: error: Integer Overflow L2
  ([0, 4294967296] + 8):signed32 by call to `init_get_bits`.

libavcodec/mjpegdec.c:1461:22: Call
1459.     while (buf_ptr < buf_end) {
1460.         /* find start next marker */
1461.         start_code = ff_mjpeg_find_marker(s, &buf_ptr, buf_end,
                           ^
1462.                                           &unescaped_buf_ptr,
1463.                                           &unescaped_buf_size);

libavcodec/mjpegdec.c:1355:1: Parameter `*unescaped_buf_size`
  1353. }
  1354. 
  1355. int ff_mjpeg_find_marker(MJpegDecodeContext *s,
        ^
  1356.                          const uint8_t **buf_ptr, const uint8_t *buf_end,
  1357.                          const uint8_t **unescaped_buf_ptr,

libavcodec/mjpegdec.c:1475:13: Call
1473.                    start_code, buf_end - buf_ptr);
1474. 
1475.             init_get_bits(&s->gb, unescaped_buf_ptr, unescaped_buf_size * 8);
                  ^
1476. 
1477.             s->start_code = start_code;

libavcodec/get_bits.h:370:1: <LHS trace>
368.  * @param bit_size the size of the buffer in bits
369.  */
370. static inline void init_get_bits(GetBitContext *s, const uint8_t *buffer,
     ^
371.                                  int bit_size)
372. {

libavcodec/get_bits.h:370:1: Parameter `bit_size`
  368.  * @param bit_size the size of the buffer in bits
  369.  */
  370. static inline void init_get_bits(GetBitContext *s, const uint8_t *buffer,
       ^
  371.                                  int bit_size)
  372. {

libavcodec/get_bits.h:382:5: Binary operation: ([0, 4294967296] + 8):signed32 by call to `init_get_bits` 
  380.     s->size_in_bits = bit_size;
  381. #if !UNCHECKED_BITSTREAM_READER
  382.     s->size_in_bits_plus8 = bit_size + 8;
           ^
  383. #endif
  384.     s->buffer_end   = buffer + buffer_size;

static inline void init_get_bits(GetBitContext *s, const uint8_t *buffer,
                                 int bit_size)
{
    int buffer_size = (bit_size+7)>>3;
    if (buffer_size < 0 || bit_size < 0) {
        buffer_size = bit_size = 0;
        buffer = NULL;
    }
    s->buffer       = buffer;
    s->size_in_bits = bit_size;
#if !UNCHECKED_BITSTREAM_READER
    s->size_in_bits_plus8 = bit_size + 8;
#endif
    s->buffer_end   = buffer + buffer_size;
    s->index        = 0;
}
['int ff_mjpeg_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,\n                          AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size       = avpkt->size;\n    MJpegDecodeContext *s = avctx->priv_data;\n    const uint8_t *buf_end, *buf_ptr;\n    const uint8_t *unescaped_buf_ptr;\n    int unescaped_buf_size;\n    int start_code;\n    int ret = 0;\n    AVFrame *picture = data;\n    s->got_picture = 0;\n    buf_ptr = buf;\n    buf_end = buf + buf_size;\n    while (buf_ptr < buf_end) {\n        start_code = ff_mjpeg_find_marker(s, &buf_ptr, buf_end,\n                                          &unescaped_buf_ptr,\n                                          &unescaped_buf_size);\n        if (start_code < 0) {\n            goto the_end;\n        } else if (unescaped_buf_size > (1U<<29)) {\n            av_log(avctx, AV_LOG_ERROR, "MJPEG packet 0x%x too big (0x%x/0x%x), corrupt data?\\n",\n                   start_code, unescaped_buf_size, buf_size);\n            return AVERROR_INVALIDDATA;\n        } else {\n            av_log(avctx, AV_LOG_DEBUG, "marker=%x avail_size_in_buf=%td\\n",\n                   start_code, buf_end - buf_ptr);\n            init_get_bits(&s->gb, unescaped_buf_ptr, unescaped_buf_size * 8);\n            s->start_code = start_code;\n            if (s->avctx->debug & FF_DEBUG_STARTCODE)\n                av_log(avctx, AV_LOG_DEBUG, "startcode: %X\\n", start_code);\n            if (start_code >= 0xd0 && start_code <= 0xd7)\n                av_log(avctx, AV_LOG_DEBUG,\n                       "restart marker: %d\\n", start_code & 0x0f);\n            else if (start_code >= APP0 && start_code <= APP15)\n                mjpeg_decode_app(s);\n            else if (start_code == COM)\n                mjpeg_decode_com(s);\n            switch (start_code) {\n            case SOI:\n                s->restart_interval = 0;\n                s->restart_count    = 0;\n                break;\n            case DQT:\n                ff_mjpeg_decode_dqt(s);\n                break;\n            case DHT:\n                if ((ret = ff_mjpeg_decode_dht(s)) < 0) {\n                    av_log(avctx, AV_LOG_ERROR, "huffman table decode error\\n");\n                    return ret;\n                }\n                break;\n            case SOF0:\n            case SOF1:\n                s->lossless    = 0;\n                s->ls          = 0;\n                s->progressive = 0;\n                if ((ret = ff_mjpeg_decode_sof(s)) < 0)\n                    return ret;\n                break;\n            case SOF2:\n                s->lossless    = 0;\n                s->ls          = 0;\n                s->progressive = 1;\n                if ((ret = ff_mjpeg_decode_sof(s)) < 0)\n                    return ret;\n                break;\n            case SOF3:\n                s->lossless    = 1;\n                s->ls          = 0;\n                s->progressive = 0;\n                if ((ret = ff_mjpeg_decode_sof(s)) < 0)\n                    return ret;\n                break;\n            case SOF48:\n                s->lossless    = 1;\n                s->ls          = 1;\n                s->progressive = 0;\n                if ((ret = ff_mjpeg_decode_sof(s)) < 0)\n                    return ret;\n                break;\n            case LSE:\n                if (!CONFIG_JPEGLS_DECODER ||\n                    (ret = ff_jpegls_decode_lse(s)) < 0)\n                    return ret;\n                break;\n            case EOI:\n                s->cur_scan = 0;\n                if ((s->buggy_avid && !s->interlaced) || s->restart_interval)\n                    break;\neoi_parser:\n                if (!s->got_picture) {\n                    av_log(avctx, AV_LOG_WARNING,\n                           "Found EOI before any SOF, ignoring\\n");\n                    break;\n                    }\n                if (s->interlaced) {\n                    s->bottom_field ^= 1;\n                    if (s->bottom_field == !s->interlace_polarity)\n                        goto not_the_end;\n                    }\n                    *picture   = *s->picture_ptr;\n                    *got_frame = 1;\n                    if (!s->lossless) {\n                        picture->quality      = FFMAX3(s->qscale[0],\n                                                       s->qscale[1],\n                                                       s->qscale[2]);\n                        picture->qstride      = 0;\n                        picture->qscale_table = s->qscale_table;\n                        memset(picture->qscale_table, picture->quality,\n                               (s->width + 15) / 16);\n                        if (avctx->debug & FF_DEBUG_QP)\n                            av_log(avctx, AV_LOG_DEBUG,\n                                   "QP: %d\\n", picture->quality);\n                        picture->quality *= FF_QP2LAMBDA;\n                    }\n                goto the_end;\n            case SOS:\n                if (!s->got_picture) {\n                    av_log(avctx, AV_LOG_WARNING,\n                           "Can not process SOS before SOF, skipping\\n");\n                    break;\n                    }\n                if ((ret = ff_mjpeg_decode_sos(s, NULL, NULL)) < 0 &&\n                    (avctx->err_recognition & AV_EF_EXPLODE))\n                    return ret;\n                if ((s->buggy_avid && !s->interlaced) || s->restart_interval)\n                    goto eoi_parser;\n                break;\n            case DRI:\n                mjpeg_decode_dri(s);\n                break;\n            case SOF5:\n            case SOF6:\n            case SOF7:\n            case SOF9:\n            case SOF10:\n            case SOF11:\n            case SOF13:\n            case SOF14:\n            case SOF15:\n            case JPG:\n                av_log(avctx, AV_LOG_ERROR,\n                       "mjpeg: unsupported coding type (%x)\\n", start_code);\n                break;\n            }\nnot_the_end:\n            buf_ptr += (get_bits_count(&s->gb) + 7) / 8;\n            av_log(avctx, AV_LOG_DEBUG,\n                   "marker parser used %d bytes (%d bits)\\n",\n                   (get_bits_count(&s->gb) + 7) / 8, get_bits_count(&s->gb));\n        }\n    }\n    if (s->got_picture) {\n        av_log(avctx, AV_LOG_WARNING, "EOI missing, emulating\\n");\n        goto eoi_parser;\n    }\n    av_log(avctx, AV_LOG_FATAL, "No JPEG data found in image\\n");\n    return AVERROR_INVALIDDATA;\nthe_end:\n    av_log(avctx, AV_LOG_DEBUG, "mjpeg decode frame unused %td bytes\\n",\n           buf_end - buf_ptr);\n    return buf_ptr - buf;\n}', 'int ff_mjpeg_find_marker(MJpegDecodeContext *s,\n                         const uint8_t **buf_ptr, const uint8_t *buf_end,\n                         const uint8_t **unescaped_buf_ptr,\n                         int *unescaped_buf_size)\n{\n    int start_code;\n    start_code = find_marker(buf_ptr, buf_end);\n    av_fast_padded_malloc(&s->buffer, &s->buffer_size, buf_end - *buf_ptr);\n    if (!s->buffer)\n        return AVERROR(ENOMEM);\n    if (start_code == SOS && !s->ls) {\n        const uint8_t *src = *buf_ptr;\n        uint8_t *dst = s->buffer;\n        while (src < buf_end) {\n            uint8_t x = *(src++);\n            *(dst++) = x;\n            if (s->avctx->codec_id != AV_CODEC_ID_THP) {\n                if (x == 0xff) {\n                    while (src < buf_end && x == 0xff)\n                        x = *(src++);\n                    if (x >= 0xd0 && x <= 0xd7)\n                        *(dst++) = x;\n                    else if (x)\n                        break;\n                }\n            }\n        }\n        *unescaped_buf_ptr  = s->buffer;\n        *unescaped_buf_size = dst - s->buffer;\n        memset(s->buffer + *unescaped_buf_size, 0,\n               FF_INPUT_BUFFER_PADDING_SIZE);\n        av_log(s->avctx, AV_LOG_DEBUG, "escaping removed %td bytes\\n",\n               (buf_end - *buf_ptr) - (dst - s->buffer));\n    } else if (start_code == SOS && s->ls) {\n        const uint8_t *src = *buf_ptr;\n        uint8_t *dst  = s->buffer;\n        int bit_count = 0;\n        int t = 0, b = 0;\n        PutBitContext pb;\n        s->cur_scan++;\n        while (src + t < buf_end) {\n            uint8_t x = src[t++];\n            if (x == 0xff) {\n                while ((src + t < buf_end) && x == 0xff)\n                    x = src[t++];\n                if (x & 0x80) {\n                    t -= 2;\n                    break;\n                }\n            }\n        }\n        bit_count = t * 8;\n        init_put_bits(&pb, dst, t);\n        while (b < t) {\n            uint8_t x = src[b++];\n            put_bits(&pb, 8, x);\n            if (x == 0xFF) {\n                x = src[b++];\n                put_bits(&pb, 7, x);\n                bit_count--;\n            }\n        }\n        flush_put_bits(&pb);\n        *unescaped_buf_ptr  = dst;\n        *unescaped_buf_size = (bit_count + 7) >> 3;\n        memset(s->buffer + *unescaped_buf_size, 0,\n               FF_INPUT_BUFFER_PADDING_SIZE);\n    } else {\n        *unescaped_buf_ptr  = *buf_ptr;\n        *unescaped_buf_size = buf_end - *buf_ptr;\n    }\n    return start_code;\n}', 'static inline void init_get_bits(GetBitContext *s, const uint8_t *buffer,\n                                 int bit_size)\n{\n    int buffer_size = (bit_size+7)>>3;\n    if (buffer_size < 0 || bit_size < 0) {\n        buffer_size = bit_size = 0;\n        buffer = NULL;\n    }\n    s->buffer       = buffer;\n    s->size_in_bits = bit_size;\n#if !UNCHECKED_BITSTREAM_READER\n    s->size_in_bits_plus8 = bit_size + 8;\n#endif\n    s->buffer_end   = buffer + buffer_size;\n    s->index        = 0;\n}']