libavcodec/mjpegbdec.c:121: error: Buffer Overrun L2
  Offset: [0, max(4, `avctx->priv_data->nb_components`)] Size: 4 by call to `ff_mjpeg_decode_sos`.

libavcodec/mjpegbdec.c:40:1: Parameter `avctx->priv_data->nb_components`
38. }
39. 
40. static int mjpegb_decode_frame(AVCodecContext *avctx,
    ^
41.                               void *data, int *got_frame,
42.                               AVPacket *avpkt)

libavcodec/mjpegbdec.c:121:13: Call
119.         s->mjpb_skiptosod = (sod_offs - sos_offs - show_bits(&s->gb, 16));
120.         s->start_code = SOS;
121.         if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 &&
                 ^
122.             (avctx->err_recognition & AV_EF_EXPLODE))
123.           return AVERROR_INVALIDDATA;

libavcodec/mjpegdec.c:994:1: <Offset trace>
992. }
993. 
994. int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
     ^
995.                         const AVFrame *reference)
996. {

libavcodec/mjpegdec.c:994:1: Parameter `s->nb_components`
  992. }
  993. 
  994. int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
       ^
  995.                         const AVFrame *reference)
  996. {

libavcodec/mjpegdec.c:994:1: <Length trace>
992. }
993. 
994. int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
     ^
995.                         const AVFrame *reference)
996. {

libavcodec/mjpegdec.c:994:1: Parameter `s->h_count[*]`
  992. }
  993. 
  994. int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
       ^
  995.                         const AVFrame *reference)
  996. {

libavcodec/mjpegdec.c:1033:27: Array access: Offset: [0, max(4, avctx->priv_data->nb_components)] Size: 4 by call to `ff_mjpeg_decode_sos` 
  1031.         s->comp_index[i] = index;
  1032. 
  1033.         s->nb_blocks[i] = s->h_count[index] * s->v_count[index];
                                  ^
  1034.         s->h_scount[i]  = s->h_count[index];
  1035.         s->v_scount[i]  = s->v_count[index];

int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
                        const AVFrame *reference)
{
    int len, nb_components, i, h, v, predictor, point_transform;
    int index, id, ret;
    const int block_size = s->lossless ? 1 : 8;
    int ilv, prev_shift;
    len = get_bits(&s->gb, 16);
    nb_components = get_bits(&s->gb, 8);
    if (nb_components == 0 || nb_components > MAX_COMPONENTS) {
        av_log(s->avctx, AV_LOG_ERROR,
               "decode_sos: nb_components (%d) unsupported\n", nb_components);
        return AVERROR_PATCHWELCOME;
    }
    if (len != 6 + 2 * nb_components) {
        av_log(s->avctx, AV_LOG_ERROR, "decode_sos: invalid len (%d)\n", len);
        return AVERROR_INVALIDDATA;
    }
    for (i = 0; i < nb_components; i++) {
        id = get_bits(&s->gb, 8) - 1;
        av_log(s->avctx, AV_LOG_DEBUG, "component: %d\n", id);
        for (index = 0; index < s->nb_components; index++)
            if (id == s->component_id[index])
                break;
        if (index == s->nb_components) {
            av_log(s->avctx, AV_LOG_ERROR,
                   "decode_sos: index(%d) out of components\n", index);
            return AVERROR_INVALIDDATA;
        }
        if (s->avctx->codec_tag == MKTAG('M', 'T', 'S', 'J')
            && nb_components == 3 && s->nb_components == 3 && i)
            index = 3 - i;
        s->comp_index[i] = index;
        s->nb_blocks[i] = s->h_count[index] * s->v_count[index];
        s->h_scount[i]  = s->h_count[index];
        s->v_scount[i]  = s->v_count[index];
        s->dc_index[i] = get_bits(&s->gb, 4);
        s->ac_index[i] = get_bits(&s->gb, 4);
        if (s->dc_index[i] <  0 || s->ac_index[i] < 0 ||
            s->dc_index[i] >= 4 || s->ac_index[i] >= 4)
            goto out_of_range;
        if (!s->vlcs[0][s->dc_index[i]].table ||
            !s->vlcs[1][s->ac_index[i]].table)
            goto out_of_range;
    }
    predictor = get_bits(&s->gb, 8);
    ilv = get_bits(&s->gb, 8);
    prev_shift      = get_bits(&s->gb, 4);
    point_transform = get_bits(&s->gb, 4);
    if (nb_components > 1) {
        s->mb_width  = (s->width  + s->h_max * block_size - 1) / (s->h_max * block_size);
        s->mb_height = (s->height + s->v_max * block_size - 1) / (s->v_max * block_size);
    } else if (!s->ls) {
        h = s->h_max / s->h_scount[0];
        v = s->v_max / s->v_scount[0];
        s->mb_width     = (s->width  + h * block_size - 1) / (h * block_size);
        s->mb_height    = (s->height + v * block_size - 1) / (v * block_size);
        s->nb_blocks[0] = 1;
        s->h_scount[0]  = 1;
        s->v_scount[0]  = 1;
    }
    if (s->avctx->debug & FF_DEBUG_PICT_INFO)
        av_log(s->avctx, AV_LOG_DEBUG, "%s %s p:%d >>:%d ilv:%d bits:%d %s\n",
               s->lossless ? "lossless" : "sequential DCT", s->rgb ? "RGB" : "",
               predictor, point_transform, ilv, s->bits,
               s->pegasus_rct ? "PRCT" : (s->rct ? "RCT" : ""));
    for (i = s->mjpb_skiptosod; i > 0; i--)
        skip_bits(&s->gb, 8);
next_field:
    for (i = 0; i < nb_components; i++)
        s->last_dc[i] = 1024;
    if (s->lossless) {
        if (CONFIG_JPEGLS_DECODER && s->ls) {
            if ((ret = ff_jpegls_decode_picture(s, predictor,
                                                point_transform, ilv)) < 0)
                return ret;
        } else {
            if (s->rgb) {
                if ((ret = ljpeg_decode_rgb_scan(s, predictor,
                                                 point_transform)) < 0)
                    return ret;
            } else {
                if ((ret = ljpeg_decode_yuv_scan(s, predictor,
                                                 point_transform)) < 0)
                    return ret;
            }
        }
    } else {
        if (s->progressive && predictor) {
            if ((ret = mjpeg_decode_scan_progressive_ac(s, predictor,
                                                        ilv, prev_shift,
                                                        point_transform,
                                                        mb_bitmask,
                                                        reference)) < 0)
                return ret;
        } else {
            if ((ret = mjpeg_decode_scan(s, nb_components,
                                         prev_shift, point_transform,
                                         mb_bitmask, reference)) < 0)
                return ret;
        }
    }
    if (s->interlaced &&
        get_bits_left(&s->gb) > 32 &&
        show_bits(&s->gb, 8) == 0xFF) {
        GetBitContext bak = s->gb;
        align_get_bits(&bak);
        if (show_bits(&bak, 16) == 0xFFD1) {
            av_dlog(s->avctx, "AVRn interlaced picture marker found\n");
            s->gb = bak;
            skip_bits(&s->gb, 16);
            s->bottom_field ^= 1;
            goto next_field;
        }
    }
    emms_c();
    return 0;
 out_of_range:
    av_log(s->avctx, AV_LOG_ERROR, "decode_sos: ac/dc index out of range\n");
    return AVERROR_INVALIDDATA;
}
['static int mjpegb_decode_frame(AVCodecContext *avctx,\n                              void *data, int *got_frame,\n                              AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    MJpegDecodeContext *s = avctx->priv_data;\n    const uint8_t *buf_end, *buf_ptr;\n    AVFrame *picture = data;\n    GetBitContext hgb;\n    uint32_t dqt_offs, dht_offs, sof_offs, sos_offs, second_field_offs;\n    uint32_t field_size, sod_offs;\n    buf_ptr = buf;\n    buf_end = buf + buf_size;\nread_header:\n    s->restart_interval = 0;\n    s->restart_count = 0;\n    s->mjpb_skiptosod = 0;\n    if (buf_end - buf_ptr >= 1 << 28)\n        return AVERROR_INVALIDDATA;\n    init_get_bits(&hgb, buf_ptr,  (buf_end - buf_ptr)*8);\n    skip_bits(&hgb, 32);\n    if (get_bits_long(&hgb, 32) != MKBETAG(\'m\',\'j\',\'p\',\'g\'))\n    {\n        av_log(avctx, AV_LOG_WARNING, "not mjpeg-b (bad fourcc)\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    field_size = get_bits_long(&hgb, 32);\n    av_log(avctx, AV_LOG_DEBUG, "field size: 0x%x\\n", field_size);\n    skip_bits(&hgb, 32);\n    second_field_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "second_field_offs is %d and size is %d\\n");\n    av_log(avctx, AV_LOG_DEBUG, "second field offs: 0x%x\\n", second_field_offs);\n    dqt_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "dqt is %d and size is %d\\n");\n    av_log(avctx, AV_LOG_DEBUG, "dqt offs: 0x%x\\n", dqt_offs);\n    if (dqt_offs)\n    {\n        init_get_bits(&s->gb, buf_ptr+dqt_offs, (buf_end - (buf_ptr+dqt_offs))*8);\n        s->start_code = DQT;\n        if (ff_mjpeg_decode_dqt(s) < 0 &&\n            (avctx->err_recognition & AV_EF_EXPLODE))\n          return AVERROR_INVALIDDATA;\n    }\n    dht_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "dht is %d and size is %d\\n");\n    av_log(avctx, AV_LOG_DEBUG, "dht offs: 0x%x\\n", dht_offs);\n    if (dht_offs)\n    {\n        init_get_bits(&s->gb, buf_ptr+dht_offs, (buf_end - (buf_ptr+dht_offs))*8);\n        s->start_code = DHT;\n        ff_mjpeg_decode_dht(s);\n    }\n    sof_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "sof is %d and size is %d\\n");\n    av_log(avctx, AV_LOG_DEBUG, "sof offs: 0x%x\\n", sof_offs);\n    if (sof_offs)\n    {\n        init_get_bits(&s->gb, buf_ptr+sof_offs, (buf_end - (buf_ptr+sof_offs))*8);\n        s->start_code = SOF0;\n        if (ff_mjpeg_decode_sof(s) < 0)\n            return -1;\n    }\n    sos_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "sos is %d and size is %d\\n");\n    av_log(avctx, AV_LOG_DEBUG, "sos offs: 0x%x\\n", sos_offs);\n    sod_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "sof is %d and size is %d\\n");\n    av_log(avctx, AV_LOG_DEBUG, "sod offs: 0x%x\\n", sod_offs);\n    if (sos_offs)\n    {\n        init_get_bits(&s->gb, buf_ptr + sos_offs,\n                      8 * FFMIN(field_size, buf_end - buf_ptr - sos_offs));\n        s->mjpb_skiptosod = (sod_offs - sos_offs - show_bits(&s->gb, 16));\n        s->start_code = SOS;\n        if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 &&\n            (avctx->err_recognition & AV_EF_EXPLODE))\n          return AVERROR_INVALIDDATA;\n    }\n    if (s->interlaced) {\n        s->bottom_field ^= 1;\n        if (s->bottom_field != s->interlace_polarity && second_field_offs)\n        {\n            buf_ptr = buf + second_field_offs;\n            second_field_offs = 0;\n            goto read_header;\n            }\n    }\n    *picture= *s->picture_ptr;\n    *got_frame = 1;\n    if(!s->lossless){\n        picture->quality= FFMAX3(s->qscale[0], s->qscale[1], s->qscale[2]);\n        picture->qstride= 0;\n        picture->qscale_table= s->qscale_table;\n        memset(picture->qscale_table, picture->quality, (s->width+15)/16);\n        if(avctx->debug & FF_DEBUG_QP)\n            av_log(avctx, AV_LOG_DEBUG, "QP: %d\\n", picture->quality);\n        picture->quality*= FF_QP2LAMBDA;\n    }\n    return buf_size;\n}', 'int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,\n                        const AVFrame *reference)\n{\n    int len, nb_components, i, h, v, predictor, point_transform;\n    int index, id, ret;\n    const int block_size = s->lossless ? 1 : 8;\n    int ilv, prev_shift;\n    len = get_bits(&s->gb, 16);\n    nb_components = get_bits(&s->gb, 8);\n    if (nb_components == 0 || nb_components > MAX_COMPONENTS) {\n        av_log(s->avctx, AV_LOG_ERROR,\n               "decode_sos: nb_components (%d) unsupported\\n", nb_components);\n        return AVERROR_PATCHWELCOME;\n    }\n    if (len != 6 + 2 * nb_components) {\n        av_log(s->avctx, AV_LOG_ERROR, "decode_sos: invalid len (%d)\\n", len);\n        return AVERROR_INVALIDDATA;\n    }\n    for (i = 0; i < nb_components; i++) {\n        id = get_bits(&s->gb, 8) - 1;\n        av_log(s->avctx, AV_LOG_DEBUG, "component: %d\\n", id);\n        for (index = 0; index < s->nb_components; index++)\n            if (id == s->component_id[index])\n                break;\n        if (index == s->nb_components) {\n            av_log(s->avctx, AV_LOG_ERROR,\n                   "decode_sos: index(%d) out of components\\n", index);\n            return AVERROR_INVALIDDATA;\n        }\n        if (s->avctx->codec_tag == MKTAG(\'M\', \'T\', \'S\', \'J\')\n            && nb_components == 3 && s->nb_components == 3 && i)\n            index = 3 - i;\n        s->comp_index[i] = index;\n        s->nb_blocks[i] = s->h_count[index] * s->v_count[index];\n        s->h_scount[i]  = s->h_count[index];\n        s->v_scount[i]  = s->v_count[index];\n        s->dc_index[i] = get_bits(&s->gb, 4);\n        s->ac_index[i] = get_bits(&s->gb, 4);\n        if (s->dc_index[i] <  0 || s->ac_index[i] < 0 ||\n            s->dc_index[i] >= 4 || s->ac_index[i] >= 4)\n            goto out_of_range;\n        if (!s->vlcs[0][s->dc_index[i]].table ||\n            !s->vlcs[1][s->ac_index[i]].table)\n            goto out_of_range;\n    }\n    predictor = get_bits(&s->gb, 8);\n    ilv = get_bits(&s->gb, 8);\n    prev_shift      = get_bits(&s->gb, 4);\n    point_transform = get_bits(&s->gb, 4);\n    if (nb_components > 1) {\n        s->mb_width  = (s->width  + s->h_max * block_size - 1) / (s->h_max * block_size);\n        s->mb_height = (s->height + s->v_max * block_size - 1) / (s->v_max * block_size);\n    } else if (!s->ls) {\n        h = s->h_max / s->h_scount[0];\n        v = s->v_max / s->v_scount[0];\n        s->mb_width     = (s->width  + h * block_size - 1) / (h * block_size);\n        s->mb_height    = (s->height + v * block_size - 1) / (v * block_size);\n        s->nb_blocks[0] = 1;\n        s->h_scount[0]  = 1;\n        s->v_scount[0]  = 1;\n    }\n    if (s->avctx->debug & FF_DEBUG_PICT_INFO)\n        av_log(s->avctx, AV_LOG_DEBUG, "%s %s p:%d >>:%d ilv:%d bits:%d %s\\n",\n               s->lossless ? "lossless" : "sequential DCT", s->rgb ? "RGB" : "",\n               predictor, point_transform, ilv, s->bits,\n               s->pegasus_rct ? "PRCT" : (s->rct ? "RCT" : ""));\n    for (i = s->mjpb_skiptosod; i > 0; i--)\n        skip_bits(&s->gb, 8);\nnext_field:\n    for (i = 0; i < nb_components; i++)\n        s->last_dc[i] = 1024;\n    if (s->lossless) {\n        if (CONFIG_JPEGLS_DECODER && s->ls) {\n            if ((ret = ff_jpegls_decode_picture(s, predictor,\n                                                point_transform, ilv)) < 0)\n                return ret;\n        } else {\n            if (s->rgb) {\n                if ((ret = ljpeg_decode_rgb_scan(s, predictor,\n                                                 point_transform)) < 0)\n                    return ret;\n            } else {\n                if ((ret = ljpeg_decode_yuv_scan(s, predictor,\n                                                 point_transform)) < 0)\n                    return ret;\n            }\n        }\n    } else {\n        if (s->progressive && predictor) {\n            if ((ret = mjpeg_decode_scan_progressive_ac(s, predictor,\n                                                        ilv, prev_shift,\n                                                        point_transform,\n                                                        mb_bitmask,\n                                                        reference)) < 0)\n                return ret;\n        } else {\n            if ((ret = mjpeg_decode_scan(s, nb_components,\n                                         prev_shift, point_transform,\n                                         mb_bitmask, reference)) < 0)\n                return ret;\n        }\n    }\n    if (s->interlaced &&\n        get_bits_left(&s->gb) > 32 &&\n        show_bits(&s->gb, 8) == 0xFF) {\n        GetBitContext bak = s->gb;\n        align_get_bits(&bak);\n        if (show_bits(&bak, 16) == 0xFFD1) {\n            av_dlog(s->avctx, "AVRn interlaced picture marker found\\n");\n            s->gb = bak;\n            skip_bits(&s->gb, 16);\n            s->bottom_field ^= 1;\n            goto next_field;\n        }\n    }\n    emms_c();\n    return 0;\n out_of_range:\n    av_log(s->avctx, AV_LOG_ERROR, "decode_sos: ac/dc index out of range\\n");\n    return AVERROR_INVALIDDATA;\n}']