libavformat/mpegts.c:1418: error: Integer Overflow L2
  ([-1, min(4093, `*section`)] - 2):unsigned8.

libavformat/mpegts.c:1400:27: <LHS trace>
1398.     av_dlog(ts->stream, "pcr_pid=0x%x\n", pcr_pid);
1399. 
1400.     program_info_length = get16(&p, p_end);
                                ^
1401.     if (program_info_length < 0)
1402.         return;

libavformat/mpegts.c:1400:27: Call
1398.     av_dlog(ts->stream, "pcr_pid=0x%x\n", pcr_pid);
1399. 
1400.     program_info_length = get16(&p, p_end);
                                ^
1401.     if (program_info_length < 0)
1402.         return;

libavformat/mpegts.c:452:9: Assignment
  450.     p = *pp;
  451.     if ((p + 1) >= p_end)
  452.         return -1;
               ^
  453.     c = AV_RB16(p);
  454.     p += 2;

libavformat/mpegts.c:1400:5: Assignment
1398.     av_dlog(ts->stream, "pcr_pid=0x%x\n", pcr_pid);
1399. 
1400.     program_info_length = get16(&p, p_end);
          ^
1401.     if (program_info_length < 0)
1402.         return;

libavformat/mpegts.c:1403:5: Assignment
1401.     if (program_info_length < 0)
1402.         return;
1403.     program_info_length &= 0xfff;
          ^
1404.     while(program_info_length >= 2) {
1405.         uint8_t tag, len;

libavformat/mpegts.c:1418:13: Binary operation: ([-1, min(4093, *section)] - 2):unsigned8
1416.             get8(&p, p_end); // scope
1417.             get8(&p, p_end); // label
1418.             len -= 2;
                  ^
1419.             mp4_read_iods(ts->stream, p, len, mp4_descr + mp4_descr_count,
1420.                           &mp4_descr_count, MAX_MP4_DESCR_COUNT);

static void pmt_cb(MpegTSFilter *filter, const uint8_t *section, int section_len)
{
    MpegTSContext *ts = filter->u.section_filter.opaque;
    SectionHeader h1, *h = &h1;
    PESContext *pes;
    AVStream *st;
    const uint8_t *p, *p_end, *desc_list_end;
    int program_info_length, pcr_pid, pid, stream_type;
    int desc_list_len;
    uint32_t prog_reg_desc = 0;
    Mp4Descr mp4_descr[MAX_MP4_DESCR_COUNT] = {{ 0 }};
    int mp4_descr_count = 0;
    int i;
    av_dlog(ts->stream, "PMT: len %i\n", section_len);
    hex_dump_debug(ts->stream, (uint8_t *)section, section_len);
    p_end = section + section_len - 4;
    p = section;
    if (parse_section_header(h, &p, p_end) < 0)
        return;
    av_dlog(ts->stream, "sid=0x%x sec_num=%d/%d\n",
           h->id, h->sec_num, h->last_sec_num);
    if (h->tid != PMT_TID)
        return;
    clear_program(ts, h->id);
    pcr_pid = get16(&p, p_end);
    if (pcr_pid < 0)
        return;
    pcr_pid &= 0x1fff;
    add_pid_to_pmt(ts, h->id, pcr_pid);
    av_dlog(ts->stream, "pcr_pid=0x%x\n", pcr_pid);
    program_info_length = get16(&p, p_end);
    if (program_info_length < 0)
        return;
    program_info_length &= 0xfff;
    while(program_info_length >= 2) {
        uint8_t tag, len;
        tag = get8(&p, p_end);
        len = get8(&p, p_end);
        av_dlog(ts->stream, "program tag: 0x%02x len=%d\n", tag, len);
        if(len > program_info_length - 2)
            break;
        program_info_length -= len + 2;
        if (tag == 0x1d) {
            get8(&p, p_end);
            get8(&p, p_end);
            len -= 2;
            mp4_read_iods(ts->stream, p, len, mp4_descr + mp4_descr_count,
                          &mp4_descr_count, MAX_MP4_DESCR_COUNT);
        } else if (tag == 0x05 && len >= 4) {
            prog_reg_desc = bytestream_get_le32(&p);
            len -= 4;
        }
        p += len;
    }
    p += program_info_length;
    if (p >= p_end)
        goto out;
    if (!ts->stream->nb_streams)
        ts->stop_parse = 1;
    for(;;) {
        st = 0;
        pes = NULL;
        stream_type = get8(&p, p_end);
        if (stream_type < 0)
            break;
        pid = get16(&p, p_end);
        if (pid < 0)
            break;
        pid &= 0x1fff;
        if (ts->pids[pid] && ts->pids[pid]->type == MPEGTS_PES) {
            pes = ts->pids[pid]->u.pes_filter.opaque;
            if (!pes->st) {
                pes->st = avformat_new_stream(pes->stream, NULL);
                pes->st->id = pes->pid;
            }
            st = pes->st;
        } else if (stream_type != 0x13) {
            if (ts->pids[pid]) mpegts_close_filter(ts, ts->pids[pid]);
            pes = add_pes_stream(ts, pid, pcr_pid);
            if (pes) {
                st = avformat_new_stream(pes->stream, NULL);
                st->id = pes->pid;
            }
        } else {
            int idx = ff_find_stream_index(ts->stream, pid);
            if (idx >= 0) {
                st = ts->stream->streams[idx];
            } else {
                st = avformat_new_stream(ts->stream, NULL);
                st->id = pid;
                st->codec->codec_type = AVMEDIA_TYPE_DATA;
            }
        }
        if (!st)
            goto out;
        if (pes && !pes->stream_type)
            mpegts_set_stream_info(st, pes, stream_type, prog_reg_desc);
        add_pid_to_pmt(ts, h->id, pid);
        ff_program_add_stream_index(ts->stream, h->id, st->index);
        desc_list_len = get16(&p, p_end);
        if (desc_list_len < 0)
            break;
        desc_list_len &= 0xfff;
        desc_list_end = p + desc_list_len;
        if (desc_list_end > p_end)
            break;
        for(;;) {
            if (ff_parse_mpeg2_descriptor(ts->stream, st, stream_type, &p, desc_list_end,
                mp4_descr, mp4_descr_count, pid, ts) < 0)
                break;
            if (pes && prog_reg_desc == AV_RL32("HDMV") && stream_type == 0x83 && pes->sub_st) {
                ff_program_add_stream_index(ts->stream, h->id, pes->sub_st->index);
                pes->sub_st->codec->codec_tag = st->codec->codec_tag;
            }
        }
        p = desc_list_end;
    }
 out:
    for (i = 0; i < mp4_descr_count; i++)
        av_free(mp4_descr[i].dec_config_descr);
}
['static void pmt_cb(MpegTSFilter *filter, const uint8_t *section, int section_len)\n{\n    MpegTSContext *ts = filter->u.section_filter.opaque;\n    SectionHeader h1, *h = &h1;\n    PESContext *pes;\n    AVStream *st;\n    const uint8_t *p, *p_end, *desc_list_end;\n    int program_info_length, pcr_pid, pid, stream_type;\n    int desc_list_len;\n    uint32_t prog_reg_desc = 0;\n    Mp4Descr mp4_descr[MAX_MP4_DESCR_COUNT] = {{ 0 }};\n    int mp4_descr_count = 0;\n    int i;\n    av_dlog(ts->stream, "PMT: len %i\\n", section_len);\n    hex_dump_debug(ts->stream, (uint8_t *)section, section_len);\n    p_end = section + section_len - 4;\n    p = section;\n    if (parse_section_header(h, &p, p_end) < 0)\n        return;\n    av_dlog(ts->stream, "sid=0x%x sec_num=%d/%d\\n",\n           h->id, h->sec_num, h->last_sec_num);\n    if (h->tid != PMT_TID)\n        return;\n    clear_program(ts, h->id);\n    pcr_pid = get16(&p, p_end);\n    if (pcr_pid < 0)\n        return;\n    pcr_pid &= 0x1fff;\n    add_pid_to_pmt(ts, h->id, pcr_pid);\n    av_dlog(ts->stream, "pcr_pid=0x%x\\n", pcr_pid);\n    program_info_length = get16(&p, p_end);\n    if (program_info_length < 0)\n        return;\n    program_info_length &= 0xfff;\n    while(program_info_length >= 2) {\n        uint8_t tag, len;\n        tag = get8(&p, p_end);\n        len = get8(&p, p_end);\n        av_dlog(ts->stream, "program tag: 0x%02x len=%d\\n", tag, len);\n        if(len > program_info_length - 2)\n            break;\n        program_info_length -= len + 2;\n        if (tag == 0x1d) {\n            get8(&p, p_end);\n            get8(&p, p_end);\n            len -= 2;\n            mp4_read_iods(ts->stream, p, len, mp4_descr + mp4_descr_count,\n                          &mp4_descr_count, MAX_MP4_DESCR_COUNT);\n        } else if (tag == 0x05 && len >= 4) {\n            prog_reg_desc = bytestream_get_le32(&p);\n            len -= 4;\n        }\n        p += len;\n    }\n    p += program_info_length;\n    if (p >= p_end)\n        goto out;\n    if (!ts->stream->nb_streams)\n        ts->stop_parse = 1;\n    for(;;) {\n        st = 0;\n        pes = NULL;\n        stream_type = get8(&p, p_end);\n        if (stream_type < 0)\n            break;\n        pid = get16(&p, p_end);\n        if (pid < 0)\n            break;\n        pid &= 0x1fff;\n        if (ts->pids[pid] && ts->pids[pid]->type == MPEGTS_PES) {\n            pes = ts->pids[pid]->u.pes_filter.opaque;\n            if (!pes->st) {\n                pes->st = avformat_new_stream(pes->stream, NULL);\n                pes->st->id = pes->pid;\n            }\n            st = pes->st;\n        } else if (stream_type != 0x13) {\n            if (ts->pids[pid]) mpegts_close_filter(ts, ts->pids[pid]);\n            pes = add_pes_stream(ts, pid, pcr_pid);\n            if (pes) {\n                st = avformat_new_stream(pes->stream, NULL);\n                st->id = pes->pid;\n            }\n        } else {\n            int idx = ff_find_stream_index(ts->stream, pid);\n            if (idx >= 0) {\n                st = ts->stream->streams[idx];\n            } else {\n                st = avformat_new_stream(ts->stream, NULL);\n                st->id = pid;\n                st->codec->codec_type = AVMEDIA_TYPE_DATA;\n            }\n        }\n        if (!st)\n            goto out;\n        if (pes && !pes->stream_type)\n            mpegts_set_stream_info(st, pes, stream_type, prog_reg_desc);\n        add_pid_to_pmt(ts, h->id, pid);\n        ff_program_add_stream_index(ts->stream, h->id, st->index);\n        desc_list_len = get16(&p, p_end);\n        if (desc_list_len < 0)\n            break;\n        desc_list_len &= 0xfff;\n        desc_list_end = p + desc_list_len;\n        if (desc_list_end > p_end)\n            break;\n        for(;;) {\n            if (ff_parse_mpeg2_descriptor(ts->stream, st, stream_type, &p, desc_list_end,\n                mp4_descr, mp4_descr_count, pid, ts) < 0)\n                break;\n            if (pes && prog_reg_desc == AV_RL32("HDMV") && stream_type == 0x83 && pes->sub_st) {\n                ff_program_add_stream_index(ts->stream, h->id, pes->sub_st->index);\n                pes->sub_st->codec->codec_tag = st->codec->codec_tag;\n            }\n        }\n        p = desc_list_end;\n    }\n out:\n    for (i = 0; i < mp4_descr_count; i++)\n        av_free(mp4_descr[i].dec_config_descr);\n}', 'static inline int get16(const uint8_t **pp, const uint8_t *p_end)\n{\n    const uint8_t *p;\n    int c;\n    p = *pp;\n    if ((p + 1) >= p_end)\n        return -1;\n    c = AV_RB16(p);\n    p += 2;\n    *pp = p;\n    return c;\n}']