libavcodec/mjpegdec.c:1577: error: Buffer Overrun L2
  Offset: [0, max(4, `avctx->priv_data->nb_components`)] Size: 4 by call to `ff_mjpeg_decode_sos`.

libavcodec/mjpegdec.c:1439:1: Parameter `avctx->priv_data->nb_components`
1437. }
1438. 
1439. int ff_mjpeg_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
      ^
1440.                           AVPacket *avpkt)
1441. {

libavcodec/mjpegdec.c:1577:28: Call
1575.                     break;
1576.                     }
1577.                 if ((ret = ff_mjpeg_decode_sos(s, NULL, NULL)) < 0 &&
                                 ^
1578.                     (avctx->err_recognition & AV_EF_EXPLODE))
1579.                     return ret;

libavcodec/mjpegdec.c:994:1: <Offset trace>
992. }
993. 
994. int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
     ^
995.                         const AVFrame *reference)
996. {

libavcodec/mjpegdec.c:994:1: Parameter `s->nb_components`
  992. }
  993. 
  994. int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
       ^
  995.                         const AVFrame *reference)
  996. {

libavcodec/mjpegdec.c:994:1: <Length trace>
992. }
993. 
994. int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
     ^
995.                         const AVFrame *reference)
996. {

libavcodec/mjpegdec.c:994:1: Parameter `s->h_count[*]`
  992. }
  993. 
  994. int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
       ^
  995.                         const AVFrame *reference)
  996. {

libavcodec/mjpegdec.c:1033:27: Array access: Offset: [0, max(4, avctx->priv_data->nb_components)] Size: 4 by call to `ff_mjpeg_decode_sos` 
  1031.         s->comp_index[i] = index;
  1032. 
  1033.         s->nb_blocks[i] = s->h_count[index] * s->v_count[index];
                                  ^
  1034.         s->h_scount[i]  = s->h_count[index];
  1035.         s->v_scount[i]  = s->v_count[index];

int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
                        const AVFrame *reference)
{
    int len, nb_components, i, h, v, predictor, point_transform;
    int index, id, ret;
    const int block_size = s->lossless ? 1 : 8;
    int ilv, prev_shift;
    len = get_bits(&s->gb, 16);
    nb_components = get_bits(&s->gb, 8);
    if (nb_components == 0 || nb_components > MAX_COMPONENTS) {
        av_log(s->avctx, AV_LOG_ERROR,
               "decode_sos: nb_components (%d) unsupported\n", nb_components);
        return AVERROR_PATCHWELCOME;
    }
    if (len != 6 + 2 * nb_components) {
        av_log(s->avctx, AV_LOG_ERROR, "decode_sos: invalid len (%d)\n", len);
        return AVERROR_INVALIDDATA;
    }
    for (i = 0; i < nb_components; i++) {
        id = get_bits(&s->gb, 8) - 1;
        av_log(s->avctx, AV_LOG_DEBUG, "component: %d\n", id);
        for (index = 0; index < s->nb_components; index++)
            if (id == s->component_id[index])
                break;
        if (index == s->nb_components) {
            av_log(s->avctx, AV_LOG_ERROR,
                   "decode_sos: index(%d) out of components\n", index);
            return AVERROR_INVALIDDATA;
        }
        if (s->avctx->codec_tag == MKTAG('M', 'T', 'S', 'J')
            && nb_components == 3 && s->nb_components == 3 && i)
            index = 3 - i;
        s->comp_index[i] = index;
        s->nb_blocks[i] = s->h_count[index] * s->v_count[index];
        s->h_scount[i]  = s->h_count[index];
        s->v_scount[i]  = s->v_count[index];
        s->dc_index[i] = get_bits(&s->gb, 4);
        s->ac_index[i] = get_bits(&s->gb, 4);
        if (s->dc_index[i] <  0 || s->ac_index[i] < 0 ||
            s->dc_index[i] >= 4 || s->ac_index[i] >= 4)
            goto out_of_range;
        if (!s->vlcs[0][s->dc_index[i]].table ||
            !s->vlcs[1][s->ac_index[i]].table)
            goto out_of_range;
    }
    predictor = get_bits(&s->gb, 8);
    ilv = get_bits(&s->gb, 8);
    prev_shift      = get_bits(&s->gb, 4);
    point_transform = get_bits(&s->gb, 4);
    if (nb_components > 1) {
        s->mb_width  = (s->width  + s->h_max * block_size - 1) / (s->h_max * block_size);
        s->mb_height = (s->height + s->v_max * block_size - 1) / (s->v_max * block_size);
    } else if (!s->ls) {
        h = s->h_max / s->h_scount[0];
        v = s->v_max / s->v_scount[0];
        s->mb_width     = (s->width  + h * block_size - 1) / (h * block_size);
        s->mb_height    = (s->height + v * block_size - 1) / (v * block_size);
        s->nb_blocks[0] = 1;
        s->h_scount[0]  = 1;
        s->v_scount[0]  = 1;
    }
    if (s->avctx->debug & FF_DEBUG_PICT_INFO)
        av_log(s->avctx, AV_LOG_DEBUG, "%s %s p:%d >>:%d ilv:%d bits:%d %s\n",
               s->lossless ? "lossless" : "sequential DCT", s->rgb ? "RGB" : "",
               predictor, point_transform, ilv, s->bits,
               s->pegasus_rct ? "PRCT" : (s->rct ? "RCT" : ""));
    for (i = s->mjpb_skiptosod; i > 0; i--)
        skip_bits(&s->gb, 8);
next_field:
    for (i = 0; i < nb_components; i++)
        s->last_dc[i] = 1024;
    if (s->lossless) {
        if (CONFIG_JPEGLS_DECODER && s->ls) {
            if ((ret = ff_jpegls_decode_picture(s, predictor,
                                                point_transform, ilv)) < 0)
                return ret;
        } else {
            if (s->rgb) {
                if ((ret = ljpeg_decode_rgb_scan(s, predictor,
                                                 point_transform)) < 0)
                    return ret;
            } else {
                if ((ret = ljpeg_decode_yuv_scan(s, predictor,
                                                 point_transform)) < 0)
                    return ret;
            }
        }
    } else {
        if (s->progressive && predictor) {
            if ((ret = mjpeg_decode_scan_progressive_ac(s, predictor,
                                                        ilv, prev_shift,
                                                        point_transform,
                                                        mb_bitmask,
                                                        reference)) < 0)
                return ret;
        } else {
            if ((ret = mjpeg_decode_scan(s, nb_components,
                                         prev_shift, point_transform,
                                         mb_bitmask, reference)) < 0)
                return ret;
        }
    }
    if (s->interlaced &&
        get_bits_left(&s->gb) > 32 &&
        show_bits(&s->gb, 8) == 0xFF) {
        GetBitContext bak = s->gb;
        align_get_bits(&bak);
        if (show_bits(&bak, 16) == 0xFFD1) {
            av_dlog(s->avctx, "AVRn interlaced picture marker found\n");
            s->gb = bak;
            skip_bits(&s->gb, 16);
            s->bottom_field ^= 1;
            goto next_field;
        }
    }
    emms_c();
    return 0;
 out_of_range:
    av_log(s->avctx, AV_LOG_ERROR, "decode_sos: ac/dc index out of range\n");
    return AVERROR_INVALIDDATA;
}
['int ff_mjpeg_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,\n                          AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size       = avpkt->size;\n    MJpegDecodeContext *s = avctx->priv_data;\n    const uint8_t *buf_end, *buf_ptr;\n    const uint8_t *unescaped_buf_ptr;\n    int unescaped_buf_size;\n    int start_code;\n    int ret = 0;\n    AVFrame *picture = data;\n    s->got_picture = 0;\n    buf_ptr = buf;\n    buf_end = buf + buf_size;\n    while (buf_ptr < buf_end) {\n        start_code = ff_mjpeg_find_marker(s, &buf_ptr, buf_end,\n                                          &unescaped_buf_ptr,\n                                          &unescaped_buf_size);\n        if (start_code < 0) {\n            goto the_end;\n        } else if (unescaped_buf_size > (1U<<29)) {\n            av_log(avctx, AV_LOG_ERROR, "MJPEG packet 0x%x too big (0x%x/0x%x), corrupt data?\\n",\n                   start_code, unescaped_buf_size, buf_size);\n            return AVERROR_INVALIDDATA;\n        } else {\n            av_log(avctx, AV_LOG_DEBUG, "marker=%x avail_size_in_buf=%td\\n",\n                   start_code, buf_end - buf_ptr);\n            init_get_bits(&s->gb, unescaped_buf_ptr, unescaped_buf_size * 8);\n            s->start_code = start_code;\n            if (s->avctx->debug & FF_DEBUG_STARTCODE)\n                av_log(avctx, AV_LOG_DEBUG, "startcode: %X\\n", start_code);\n            if (start_code >= 0xd0 && start_code <= 0xd7)\n                av_log(avctx, AV_LOG_DEBUG,\n                       "restart marker: %d\\n", start_code & 0x0f);\n            else if (start_code >= APP0 && start_code <= APP15)\n                mjpeg_decode_app(s);\n            else if (start_code == COM)\n                mjpeg_decode_com(s);\n            switch (start_code) {\n            case SOI:\n                s->restart_interval = 0;\n                s->restart_count    = 0;\n                break;\n            case DQT:\n                ff_mjpeg_decode_dqt(s);\n                break;\n            case DHT:\n                if ((ret = ff_mjpeg_decode_dht(s)) < 0) {\n                    av_log(avctx, AV_LOG_ERROR, "huffman table decode error\\n");\n                    return ret;\n                }\n                break;\n            case SOF0:\n            case SOF1:\n                s->lossless    = 0;\n                s->ls          = 0;\n                s->progressive = 0;\n                if ((ret = ff_mjpeg_decode_sof(s)) < 0)\n                    return ret;\n                break;\n            case SOF2:\n                s->lossless    = 0;\n                s->ls          = 0;\n                s->progressive = 1;\n                if ((ret = ff_mjpeg_decode_sof(s)) < 0)\n                    return ret;\n                break;\n            case SOF3:\n                s->lossless    = 1;\n                s->ls          = 0;\n                s->progressive = 0;\n                if ((ret = ff_mjpeg_decode_sof(s)) < 0)\n                    return ret;\n                break;\n            case SOF48:\n                s->lossless    = 1;\n                s->ls          = 1;\n                s->progressive = 0;\n                if ((ret = ff_mjpeg_decode_sof(s)) < 0)\n                    return ret;\n                break;\n            case LSE:\n                if (!CONFIG_JPEGLS_DECODER ||\n                    (ret = ff_jpegls_decode_lse(s)) < 0)\n                    return ret;\n                break;\n            case EOI:\n                s->cur_scan = 0;\n                if ((s->buggy_avid && !s->interlaced) || s->restart_interval)\n                    break;\neoi_parser:\n                if (!s->got_picture) {\n                    av_log(avctx, AV_LOG_WARNING,\n                           "Found EOI before any SOF, ignoring\\n");\n                    break;\n                    }\n                if (s->interlaced) {\n                    s->bottom_field ^= 1;\n                    if (s->bottom_field == !s->interlace_polarity)\n                        goto not_the_end;\n                    }\n                    *picture   = *s->picture_ptr;\n                    *got_frame = 1;\n                    if (!s->lossless) {\n                        picture->quality      = FFMAX3(s->qscale[0],\n                                                       s->qscale[1],\n                                                       s->qscale[2]);\n                        picture->qstride      = 0;\n                        picture->qscale_table = s->qscale_table;\n                        memset(picture->qscale_table, picture->quality,\n                               (s->width + 15) / 16);\n                        if (avctx->debug & FF_DEBUG_QP)\n                            av_log(avctx, AV_LOG_DEBUG,\n                                   "QP: %d\\n", picture->quality);\n                        picture->quality *= FF_QP2LAMBDA;\n                    }\n                goto the_end;\n            case SOS:\n                if (!s->got_picture) {\n                    av_log(avctx, AV_LOG_WARNING,\n                           "Can not process SOS before SOF, skipping\\n");\n                    break;\n                    }\n                if ((ret = ff_mjpeg_decode_sos(s, NULL, NULL)) < 0 &&\n                    (avctx->err_recognition & AV_EF_EXPLODE))\n                    return ret;\n                if ((s->buggy_avid && !s->interlaced) || s->restart_interval)\n                    goto eoi_parser;\n                break;\n            case DRI:\n                mjpeg_decode_dri(s);\n                break;\n            case SOF5:\n            case SOF6:\n            case SOF7:\n            case SOF9:\n            case SOF10:\n            case SOF11:\n            case SOF13:\n            case SOF14:\n            case SOF15:\n            case JPG:\n                av_log(avctx, AV_LOG_ERROR,\n                       "mjpeg: unsupported coding type (%x)\\n", start_code);\n                break;\n            }\nnot_the_end:\n            buf_ptr += (get_bits_count(&s->gb) + 7) / 8;\n            av_log(avctx, AV_LOG_DEBUG,\n                   "marker parser used %d bytes (%d bits)\\n",\n                   (get_bits_count(&s->gb) + 7) / 8, get_bits_count(&s->gb));\n        }\n    }\n    if (s->got_picture) {\n        av_log(avctx, AV_LOG_WARNING, "EOI missing, emulating\\n");\n        goto eoi_parser;\n    }\n    av_log(avctx, AV_LOG_FATAL, "No JPEG data found in image\\n");\n    return AVERROR_INVALIDDATA;\nthe_end:\n    av_log(avctx, AV_LOG_DEBUG, "mjpeg decode frame unused %td bytes\\n",\n           buf_end - buf_ptr);\n    return buf_ptr - buf;\n}', 'int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,\n                        const AVFrame *reference)\n{\n    int len, nb_components, i, h, v, predictor, point_transform;\n    int index, id, ret;\n    const int block_size = s->lossless ? 1 : 8;\n    int ilv, prev_shift;\n    len = get_bits(&s->gb, 16);\n    nb_components = get_bits(&s->gb, 8);\n    if (nb_components == 0 || nb_components > MAX_COMPONENTS) {\n        av_log(s->avctx, AV_LOG_ERROR,\n               "decode_sos: nb_components (%d) unsupported\\n", nb_components);\n        return AVERROR_PATCHWELCOME;\n    }\n    if (len != 6 + 2 * nb_components) {\n        av_log(s->avctx, AV_LOG_ERROR, "decode_sos: invalid len (%d)\\n", len);\n        return AVERROR_INVALIDDATA;\n    }\n    for (i = 0; i < nb_components; i++) {\n        id = get_bits(&s->gb, 8) - 1;\n        av_log(s->avctx, AV_LOG_DEBUG, "component: %d\\n", id);\n        for (index = 0; index < s->nb_components; index++)\n            if (id == s->component_id[index])\n                break;\n        if (index == s->nb_components) {\n            av_log(s->avctx, AV_LOG_ERROR,\n                   "decode_sos: index(%d) out of components\\n", index);\n            return AVERROR_INVALIDDATA;\n        }\n        if (s->avctx->codec_tag == MKTAG(\'M\', \'T\', \'S\', \'J\')\n            && nb_components == 3 && s->nb_components == 3 && i)\n            index = 3 - i;\n        s->comp_index[i] = index;\n        s->nb_blocks[i] = s->h_count[index] * s->v_count[index];\n        s->h_scount[i]  = s->h_count[index];\n        s->v_scount[i]  = s->v_count[index];\n        s->dc_index[i] = get_bits(&s->gb, 4);\n        s->ac_index[i] = get_bits(&s->gb, 4);\n        if (s->dc_index[i] <  0 || s->ac_index[i] < 0 ||\n            s->dc_index[i] >= 4 || s->ac_index[i] >= 4)\n            goto out_of_range;\n        if (!s->vlcs[0][s->dc_index[i]].table ||\n            !s->vlcs[1][s->ac_index[i]].table)\n            goto out_of_range;\n    }\n    predictor = get_bits(&s->gb, 8);\n    ilv = get_bits(&s->gb, 8);\n    prev_shift      = get_bits(&s->gb, 4);\n    point_transform = get_bits(&s->gb, 4);\n    if (nb_components > 1) {\n        s->mb_width  = (s->width  + s->h_max * block_size - 1) / (s->h_max * block_size);\n        s->mb_height = (s->height + s->v_max * block_size - 1) / (s->v_max * block_size);\n    } else if (!s->ls) {\n        h = s->h_max / s->h_scount[0];\n        v = s->v_max / s->v_scount[0];\n        s->mb_width     = (s->width  + h * block_size - 1) / (h * block_size);\n        s->mb_height    = (s->height + v * block_size - 1) / (v * block_size);\n        s->nb_blocks[0] = 1;\n        s->h_scount[0]  = 1;\n        s->v_scount[0]  = 1;\n    }\n    if (s->avctx->debug & FF_DEBUG_PICT_INFO)\n        av_log(s->avctx, AV_LOG_DEBUG, "%s %s p:%d >>:%d ilv:%d bits:%d %s\\n",\n               s->lossless ? "lossless" : "sequential DCT", s->rgb ? "RGB" : "",\n               predictor, point_transform, ilv, s->bits,\n               s->pegasus_rct ? "PRCT" : (s->rct ? "RCT" : ""));\n    for (i = s->mjpb_skiptosod; i > 0; i--)\n        skip_bits(&s->gb, 8);\nnext_field:\n    for (i = 0; i < nb_components; i++)\n        s->last_dc[i] = 1024;\n    if (s->lossless) {\n        if (CONFIG_JPEGLS_DECODER && s->ls) {\n            if ((ret = ff_jpegls_decode_picture(s, predictor,\n                                                point_transform, ilv)) < 0)\n                return ret;\n        } else {\n            if (s->rgb) {\n                if ((ret = ljpeg_decode_rgb_scan(s, predictor,\n                                                 point_transform)) < 0)\n                    return ret;\n            } else {\n                if ((ret = ljpeg_decode_yuv_scan(s, predictor,\n                                                 point_transform)) < 0)\n                    return ret;\n            }\n        }\n    } else {\n        if (s->progressive && predictor) {\n            if ((ret = mjpeg_decode_scan_progressive_ac(s, predictor,\n                                                        ilv, prev_shift,\n                                                        point_transform,\n                                                        mb_bitmask,\n                                                        reference)) < 0)\n                return ret;\n        } else {\n            if ((ret = mjpeg_decode_scan(s, nb_components,\n                                         prev_shift, point_transform,\n                                         mb_bitmask, reference)) < 0)\n                return ret;\n        }\n    }\n    if (s->interlaced &&\n        get_bits_left(&s->gb) > 32 &&\n        show_bits(&s->gb, 8) == 0xFF) {\n        GetBitContext bak = s->gb;\n        align_get_bits(&bak);\n        if (show_bits(&bak, 16) == 0xFFD1) {\n            av_dlog(s->avctx, "AVRn interlaced picture marker found\\n");\n            s->gb = bak;\n            skip_bits(&s->gb, 16);\n            s->bottom_field ^= 1;\n            goto next_field;\n        }\n    }\n    emms_c();\n    return 0;\n out_of_range:\n    av_log(s->avctx, AV_LOG_ERROR, "decode_sos: ac/dc index out of range\\n");\n    return AVERROR_INVALIDDATA;\n}']