libavcodec/mpeg12dec.c:2306: error: Integer Overflow L1
  ([1099511627520, +oo] + `*buf`):unsigned32 by call to `avpriv_find_start_code`.

libavcodec/mpeg12dec.c:2293:1: Parameter `*buf`
2291. }
2292. 
2293. static int decode_chunks(AVCodecContext *avctx, AVFrame *picture,
      ^
2294.                          int *got_output, const uint8_t *buf, int buf_size)
2295. {

libavcodec/mpeg12dec.c:2306:19: Call
2304.         /* find next start code */
2305.         uint32_t start_code = -1;
2306.         buf_ptr = avpriv_find_start_code(buf_ptr, buf_end, &start_code);
                        ^
2307.         if (start_code > 0x1ff) {
2308.             if (!skip_frame) {

libavcodec/utils.c:2299:1: <LHS trace>
2297. }
2298. 
2299. const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,
      ^
2300.                                       const uint8_t *end,
2301.                                       uint32_t * restrict state)

libavcodec/utils.c:2299:1: Parameter `*state`
  2297. }
  2298. 
  2299. const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,
        ^
  2300.                                       const uint8_t *end,
  2301.                                       uint32_t * restrict state)

libavcodec/utils.c:2310:9: Assignment
  2308. 
  2309.     for (i = 0; i < 3; i++) {
  2310.         uint32_t tmp = *state << 8;
                ^
  2311.         *state = tmp + *(p++);
  2312.         if (tmp == 0x100 || p == end)

libavcodec/utils.c:2299:1: <RHS trace>
2297. }
2298. 
2299. const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,
      ^
2300.                                       const uint8_t *end,
2301.                                       uint32_t * restrict state)

libavcodec/utils.c:2299:1: Parameter `*p`
  2297. }
  2298. 
  2299. const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,
        ^
  2300.                                       const uint8_t *end,
  2301.                                       uint32_t * restrict state)

libavcodec/utils.c:2311:9: Binary operation: ([1099511627520, +oo] + *buf):unsigned32 by call to `avpriv_find_start_code` 
  2309.     for (i = 0; i < 3; i++) {
  2310.         uint32_t tmp = *state << 8;
  2311.         *state = tmp + *(p++);
                ^
  2312.         if (tmp == 0x100 || p == end)
  2313.             return p;

const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,
                                      const uint8_t *end,
                                      uint32_t * restrict state)
{
    int i;
    assert(p <= end);
    if (p >= end)
        return end;
    for (i = 0; i < 3; i++) {
        uint32_t tmp = *state << 8;
        *state = tmp + *(p++);
        if (tmp == 0x100 || p == end)
            return p;
    }
    while (p < end) {
        if      (p[-1] > 1      ) p += 3;
        else if (p[-2]          ) p += 2;
        else if (p[-3]|(p[-1]-1)) p++;
        else {
            p++;
            break;
        }
    }
    p = FFMIN(p, end) - 4;
    *state = AV_RB32(p);
    return p + 4;
}
['static int decode_chunks(AVCodecContext *avctx, AVFrame *picture,\n                         int *got_output, const uint8_t *buf, int buf_size)\n{\n    Mpeg1Context *s = avctx->priv_data;\n    MpegEncContext *s2 = &s->mpeg_enc_ctx;\n    const uint8_t *buf_ptr = buf;\n    const uint8_t *buf_end = buf + buf_size;\n    int ret, input_size;\n    int last_code = 0, skip_frame = 0;\n    for (;;) {\n        uint32_t start_code = -1;\n        buf_ptr = avpriv_find_start_code(buf_ptr, buf_end, &start_code);\n        if (start_code > 0x1ff) {\n            if (!skip_frame) {\n                if (HAVE_THREADS &&\n                    (avctx->active_thread_type & FF_THREAD_SLICE) &&\n                    !avctx->hwaccel) {\n                    int i;\n                    avctx->execute(avctx, slice_decode_thread,\n                                   &s2->thread_context[0], NULL,\n                                   s->slice_count, sizeof(void *));\n                    for (i = 0; i < s->slice_count; i++)\n                        s2->er.error_count += s2->thread_context[i]->er.error_count;\n                }\n                ret = slice_end(avctx, picture);\n                if (ret < 0)\n                    return ret;\n                else if (ret) {\n                    if (s2->last_picture_ptr || s2->low_delay)\n                        *got_output = 1;\n                }\n            }\n            s2->pict_type = 0;\n            return FFMAX(0, buf_ptr - buf - s2->parse_context.last_index);\n        }\n        input_size = buf_end - buf_ptr;\n        if (avctx->debug & FF_DEBUG_STARTCODE)\n            av_log(avctx, AV_LOG_DEBUG, "%3X at %td left %d\\n",\n                   start_code, buf_ptr - buf, input_size);\n        switch (start_code) {\n        case SEQ_START_CODE:\n            if (last_code == 0) {\n                mpeg1_decode_sequence(avctx, buf_ptr, input_size);\n                s->sync = 1;\n            } else {\n                av_log(avctx, AV_LOG_ERROR,\n                       "ignoring SEQ_START_CODE after %X\\n", last_code);\n                if (avctx->err_recognition & AV_EF_EXPLODE)\n                    return AVERROR_INVALIDDATA;\n            }\n            break;\n        case PICTURE_START_CODE:\n            if (s2->width <= 0 || s2->height <= 0) {\n                av_log(avctx, AV_LOG_ERROR, "Invalid frame dimensions %dx%d.\\n",\n                       s2->width, s2->height);\n                return AVERROR_INVALIDDATA;\n            }\n            if (HAVE_THREADS && (avctx->active_thread_type & FF_THREAD_SLICE) &&\n                !avctx->hwaccel && s->slice_count) {\n                int i;\n                avctx->execute(avctx, slice_decode_thread,\n                               s2->thread_context, NULL,\n                               s->slice_count, sizeof(void *));\n                for (i = 0; i < s->slice_count; i++)\n                    s2->er.error_count += s2->thread_context[i]->er.error_count;\n                s->slice_count = 0;\n            }\n            if (last_code == 0 || last_code == SLICE_MIN_START_CODE) {\n                ret = mpeg_decode_postinit(avctx);\n                if (ret < 0) {\n                    av_log(avctx, AV_LOG_ERROR,\n                           "mpeg_decode_postinit() failure\\n");\n                    return ret;\n                }\n                if (mpeg1_decode_picture(avctx, buf_ptr, input_size) < 0)\n                    s2->pict_type = 0;\n                s->first_slice = 1;\n                last_code      = PICTURE_START_CODE;\n            } else {\n                av_log(avctx, AV_LOG_ERROR,\n                       "ignoring pic after %X\\n", last_code);\n                if (avctx->err_recognition & AV_EF_EXPLODE)\n                    return AVERROR_INVALIDDATA;\n            }\n            break;\n        case EXT_START_CODE:\n            init_get_bits(&s2->gb, buf_ptr, input_size * 8);\n            switch (get_bits(&s2->gb, 4)) {\n            case 0x1:\n                if (last_code == 0) {\n                    mpeg_decode_sequence_extension(s);\n                } else {\n                    av_log(avctx, AV_LOG_ERROR,\n                           "ignoring seq ext after %X\\n", last_code);\n                    if (avctx->err_recognition & AV_EF_EXPLODE)\n                        return AVERROR_INVALIDDATA;\n                }\n                break;\n            case 0x2:\n                mpeg_decode_sequence_display_extension(s);\n                break;\n            case 0x3:\n                mpeg_decode_quant_matrix_extension(s2);\n                break;\n            case 0x7:\n                mpeg_decode_picture_display_extension(s);\n                break;\n            case 0x8:\n                if (last_code == PICTURE_START_CODE) {\n                    mpeg_decode_picture_coding_extension(s);\n                } else {\n                    av_log(avctx, AV_LOG_ERROR,\n                           "ignoring pic cod ext after %X\\n", last_code);\n                    if (avctx->err_recognition & AV_EF_EXPLODE)\n                        return AVERROR_INVALIDDATA;\n                }\n                break;\n            }\n            break;\n        case USER_START_CODE:\n            mpeg_decode_user_data(avctx, buf_ptr, input_size);\n            break;\n        case GOP_START_CODE:\n            if (last_code == 0) {\n                s2->first_field = 0;\n                mpeg_decode_gop(avctx, buf_ptr, input_size);\n                s->sync = 1;\n            } else {\n                av_log(avctx, AV_LOG_ERROR,\n                       "ignoring GOP_START_CODE after %X\\n", last_code);\n                if (avctx->err_recognition & AV_EF_EXPLODE)\n                    return AVERROR_INVALIDDATA;\n            }\n            break;\n        default:\n            if (start_code >= SLICE_MIN_START_CODE &&\n                start_code <= SLICE_MAX_START_CODE && last_code != 0) {\n                const int field_pic = s2->picture_structure != PICT_FRAME;\n                int mb_y = (start_code - SLICE_MIN_START_CODE) << field_pic;\n                last_code = SLICE_MIN_START_CODE;\n                if (s2->picture_structure == PICT_BOTTOM_FIELD)\n                    mb_y++;\n                if (mb_y >= s2->mb_height) {\n                    av_log(s2->avctx, AV_LOG_ERROR,\n                           "slice below image (%d >= %d)\\n", mb_y, s2->mb_height);\n                    return -1;\n                }\n                if (s2->last_picture_ptr == NULL) {\n                    if (s2->pict_type == AV_PICTURE_TYPE_B) {\n                        if (!s->closed_gop) {\n                            skip_frame = 1;\n                            break;\n                        }\n                    }\n                }\n                if (s2->pict_type == AV_PICTURE_TYPE_I)\n                    s->sync = 1;\n                if (s2->next_picture_ptr == NULL) {\n                    if (s2->pict_type == AV_PICTURE_TYPE_P && !s->sync) {\n                        skip_frame = 1;\n                        break;\n                    }\n                }\n                if ((avctx->skip_frame >= AVDISCARD_NONREF &&\n                     s2->pict_type == AV_PICTURE_TYPE_B) ||\n                    (avctx->skip_frame >= AVDISCARD_NONKEY &&\n                     s2->pict_type != AV_PICTURE_TYPE_I) ||\n                    avctx->skip_frame >= AVDISCARD_ALL) {\n                    skip_frame = 1;\n                    break;\n                }\n                if (!s->mpeg_enc_ctx_allocated)\n                    break;\n                if (s2->codec_id == AV_CODEC_ID_MPEG2VIDEO) {\n                    if (mb_y < avctx->skip_top ||\n                        mb_y >= s2->mb_height - avctx->skip_bottom)\n                        break;\n                }\n                if (!s2->pict_type) {\n                    av_log(avctx, AV_LOG_ERROR, "Missing picture start code\\n");\n                    if (avctx->err_recognition & AV_EF_EXPLODE)\n                        return AVERROR_INVALIDDATA;\n                    break;\n                }\n                if (s->first_slice) {\n                    skip_frame     = 0;\n                    s->first_slice = 0;\n                    if (mpeg_field_start(s2, buf, buf_size) < 0)\n                        return -1;\n                }\n                if (!s2->current_picture_ptr) {\n                    av_log(avctx, AV_LOG_ERROR,\n                           "current_picture not initialized\\n");\n                    return AVERROR_INVALIDDATA;\n                }\n                if (HAVE_THREADS &&\n                    (avctx->active_thread_type & FF_THREAD_SLICE) &&\n                    !avctx->hwaccel) {\n                    int threshold = (s2->mb_height * s->slice_count +\n                                     s2->slice_context_count / 2) /\n                                    s2->slice_context_count;\n                    if (threshold <= mb_y) {\n                        MpegEncContext *thread_context = s2->thread_context[s->slice_count];\n                        thread_context->start_mb_y = mb_y;\n                        thread_context->end_mb_y   = s2->mb_height;\n                        if (s->slice_count) {\n                            s2->thread_context[s->slice_count - 1]->end_mb_y = mb_y;\n                            ret = ff_update_duplicate_context(thread_context, s2);\n                            if (ret < 0)\n                                return ret;\n                        }\n                        init_get_bits(&thread_context->gb, buf_ptr, input_size * 8);\n                        s->slice_count++;\n                    }\n                    buf_ptr += 2;\n                } else {\n                    ret = mpeg_decode_slice(s2, mb_y, &buf_ptr, input_size);\n                    emms_c();\n                    if (ret < 0) {\n                        if (avctx->err_recognition & AV_EF_EXPLODE)\n                            return ret;\n                        if (s2->resync_mb_x >= 0 && s2->resync_mb_y >= 0)\n                            ff_er_add_slice(&s2->er, s2->resync_mb_x,\n                                            s2->resync_mb_y, s2->mb_x, s2->mb_y,\n                                            ER_AC_ERROR | ER_DC_ERROR | ER_MV_ERROR);\n                    } else {\n                        ff_er_add_slice(&s2->er, s2->resync_mb_x,\n                                        s2->resync_mb_y, s2->mb_x - 1, s2->mb_y,\n                                        ER_AC_END | ER_DC_END | ER_MV_END);\n                    }\n                }\n            }\n            break;\n        }\n    }\n}', 'const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,\n                                      const uint8_t *end,\n                                      uint32_t * restrict state)\n{\n    int i;\n    assert(p <= end);\n    if (p >= end)\n        return end;\n    for (i = 0; i < 3; i++) {\n        uint32_t tmp = *state << 8;\n        *state = tmp + *(p++);\n        if (tmp == 0x100 || p == end)\n            return p;\n    }\n    while (p < end) {\n        if      (p[-1] > 1      ) p += 3;\n        else if (p[-2]          ) p += 2;\n        else if (p[-3]|(p[-1]-1)) p++;\n        else {\n            p++;\n            break;\n        }\n    }\n    p = FFMIN(p, end) - 4;\n    *state = AV_RB32(p);\n    return p + 4;\n}']