libavcodec/h264_mp4toannexb_bsf.c:56: error: Buffer Overrun L3
  Offset: 2 Size: [0, 2147483631].

libavcodec/h264_mp4toannexb_bsf.c:36:1: <Length trace>
34. } H264BSFContext;
35. 
36. static int alloc_and_copy(AVPacket *out,
    ^
37.                           const uint8_t *sps_pps, uint32_t sps_pps_size,
38.                           const uint8_t *in, uint32_t in_size)

libavcodec/h264_mp4toannexb_bsf.c:36:1: Parameter `sps_pps_size`
34. } H264BSFContext;
35. 
36. static int alloc_and_copy(AVPacket *out,
    ^
37.                           const uint8_t *sps_pps, uint32_t sps_pps_size,
38.                           const uint8_t *in, uint32_t in_size)

libavcodec/h264_mp4toannexb_bsf.c:56:9: Array access: Offset: 2 Size: [0, 2147483631]
54.         (out->data + offset + sps_pps_size)[0] =
55.         (out->data + offset + sps_pps_size)[1] = 0;
56.         (out->data + offset + sps_pps_size)[2] = 1;
            ^
57.     }
58. 

static int alloc_and_copy(AVPacket *out,
                          const uint8_t *sps_pps, uint32_t sps_pps_size,
                          const uint8_t *in, uint32_t in_size)
{
    uint32_t offset         = out->size;
    uint8_t nal_header_size = offset ? 3 : 4;
    int err;
    err = av_grow_packet(out, sps_pps_size + in_size + nal_header_size);
    if (err < 0)
        return err;
    if (sps_pps)
        memcpy(out->data + offset, sps_pps, sps_pps_size);
    memcpy(out->data + sps_pps_size + nal_header_size + offset, in, in_size);
    if (!offset) {
        AV_WB32(out->data + sps_pps_size, 1);
    } else {
        (out->data + offset + sps_pps_size)[0] =
        (out->data + offset + sps_pps_size)[1] = 0;
        (out->data + offset + sps_pps_size)[2] = 1;
    }
    return 0;
}
['static int alloc_and_copy(AVPacket *out,\n                          const uint8_t *sps_pps, uint32_t sps_pps_size,\n                          const uint8_t *in, uint32_t in_size)\n{\n    uint32_t offset         = out->size;\n    uint8_t nal_header_size = offset ? 3 : 4;\n    int err;\n    err = av_grow_packet(out, sps_pps_size + in_size + nal_header_size);\n    if (err < 0)\n        return err;\n    if (sps_pps)\n        memcpy(out->data + offset, sps_pps, sps_pps_size);\n    memcpy(out->data + sps_pps_size + nal_header_size + offset, in, in_size);\n    if (!offset) {\n        AV_WB32(out->data + sps_pps_size, 1);\n    } else {\n        (out->data + offset + sps_pps_size)[0] =\n        (out->data + offset + sps_pps_size)[1] = 0;\n        (out->data + offset + sps_pps_size)[2] = 1;\n    }\n    return 0;\n}']