libavcodec/h264_mp4toannexb_bsf.c:56: error: Buffer Overrun L3
  Offset: 2 Size: [1, 2147483631].

libavcodec/h264_mp4toannexb_bsf.c:34:1: <Length trace>
32. } H264BSFContext;
33. 
34. static int alloc_and_copy(uint8_t **poutbuf, int *poutbuf_size,
    ^
35.                           const uint8_t *sps_pps, uint32_t sps_pps_size,
36.                           const uint8_t *in, uint32_t in_size)

libavcodec/h264_mp4toannexb_bsf.c:34:1: Parameter `sps_pps_size`
32. } H264BSFContext;
33. 
34. static int alloc_and_copy(uint8_t **poutbuf, int *poutbuf_size,
    ^
35.                           const uint8_t *sps_pps, uint32_t sps_pps_size,
36.                           const uint8_t *in, uint32_t in_size)

libavcodec/h264_mp4toannexb_bsf.c:56:9: Array access: Offset: 2 Size: [1, 2147483631]
54.         (*poutbuf + offset + sps_pps_size)[0] =
55.         (*poutbuf + offset + sps_pps_size)[1] = 0;
56.         (*poutbuf + offset + sps_pps_size)[2] = 1;
            ^
57.     }
58. 

static int alloc_and_copy(uint8_t **poutbuf, int *poutbuf_size,
                          const uint8_t *sps_pps, uint32_t sps_pps_size,
                          const uint8_t *in, uint32_t in_size)
{
    uint32_t offset         = *poutbuf_size;
    uint8_t nal_header_size = offset ? 3 : 4;
    int err;
    *poutbuf_size += sps_pps_size + in_size + nal_header_size;
    if ((err = av_reallocp(poutbuf,
                           *poutbuf_size + FF_INPUT_BUFFER_PADDING_SIZE)) < 0) {
        *poutbuf_size = 0;
        return err;
    }
    if (sps_pps)
        memcpy(*poutbuf + offset, sps_pps, sps_pps_size);
    memcpy(*poutbuf + sps_pps_size + nal_header_size + offset, in, in_size);
    if (!offset) {
        AV_WB32(*poutbuf + sps_pps_size, 1);
    } else {
        (*poutbuf + offset + sps_pps_size)[0] =
        (*poutbuf + offset + sps_pps_size)[1] = 0;
        (*poutbuf + offset + sps_pps_size)[2] = 1;
    }
    return 0;
}
['static int alloc_and_copy(uint8_t **poutbuf, int *poutbuf_size,\n                          const uint8_t *sps_pps, uint32_t sps_pps_size,\n                          const uint8_t *in, uint32_t in_size)\n{\n    uint32_t offset         = *poutbuf_size;\n    uint8_t nal_header_size = offset ? 3 : 4;\n    int err;\n    *poutbuf_size += sps_pps_size + in_size + nal_header_size;\n    if ((err = av_reallocp(poutbuf,\n                           *poutbuf_size + FF_INPUT_BUFFER_PADDING_SIZE)) < 0) {\n        *poutbuf_size = 0;\n        return err;\n    }\n    if (sps_pps)\n        memcpy(*poutbuf + offset, sps_pps, sps_pps_size);\n    memcpy(*poutbuf + sps_pps_size + nal_header_size + offset, in, in_size);\n    if (!offset) {\n        AV_WB32(*poutbuf + sps_pps_size, 1);\n    } else {\n        (*poutbuf + offset + sps_pps_size)[0] =\n        (*poutbuf + offset + sps_pps_size)[1] = 0;\n        (*poutbuf + offset + sps_pps_size)[2] = 1;\n    }\n    return 0;\n}']