libavcodec/mjpegdec.c:1300: error: Buffer Overrun L3
  Offset: 3 Size: [0, +oo] by call to `ff_mjpeg_decode_sos`.

libavcodec/mjpegdec.c:1106:1: Parameter `avctx->priv_data->buffer`
1104. }
1105. 
1106. int ff_mjpeg_decode_frame(AVCodecContext *avctx,
      ^
1107.                               void *data, int *data_size,
1108.                               const uint8_t *buf, int buf_size)

libavcodec/mjpegdec.c:1160:21: Call
1158.                         }
1159.                     }
1160.                     init_get_bits(&s->gb, s->buffer, (dst - s->buffer)*8);
                          ^
1161. 
1162.                     av_log(avctx, AV_LOG_DEBUG, "escaping removed %td bytes\n",

libavcodec/bitstream.h:758:1: Parameter `*buffer`
  756.  * @param bit_size the size of the buffer in bits
  757.  */
  758. static inline void init_get_bits(GetBitContext *s,
       ^
  759.                    const uint8_t *buffer, int bit_size)
  760. {

libavcodec/bitstream.h:767:5: Assignment
  765.     }
  766. 
  767.     s->buffer= buffer;
           ^
  768.     s->size_in_bits= bit_size;
  769.     s->buffer_end= buffer + buffer_size;

libavcodec/mjpegdec.c:1300:21: Call
1298.                     break;
1299.                 case SOS:
1300.                     ff_mjpeg_decode_sos(s);
                          ^
1301.                     /* buggy avid puts EOI every 10-20th frame */
1302.                     /* if restart period is over process EOI */

libavcodec/mjpegdec.c:738:1: Parameter `*s->gb.buffer`
  736. }
  737. 
  738. int ff_mjpeg_decode_sos(MJpegDecodeContext *s)
       ^
  739. {
  740.     int len, nb_components, i, h, v, predictor, point_transform;

libavcodec/mjpegdec.c:848:12: Call
  846.         }
  847.     }else{
  848.         if(mjpeg_decode_scan(s, nb_components, predictor, ilv, prev_shift, point_transform) < 0)
                  ^
  849.             return -1;
  850.     }

libavcodec/mjpegdec.c:660:1: Parameter `*s->gb.buffer`
    658. }
    659. 
    660. static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int ss, int se, int Ah, int Al){
         ^
    661.     int i, mb_x, mb_y;
    662.     int EOBRUN = 0;

libavcodec/mjpegdec.c:702:43: Call
    700.                         return -1;
    701.                     }
    702.                     if (s->progressive && decode_block_progressive(s, s->block, i,
                                                   ^
    703.                                      s->dc_index[i], s->ac_index[i],
    704.                                      s->quant_matrixes[ s->quant_index[c] ], ss, se, Ah, Al, &EOBRUN) < 0) {

libavcodec/mjpegdec.c:433:1: <Length trace>
431. 
432. /* decode block and dequantize - progressive JPEG version */
433. static int decode_block_progressive(MJpegDecodeContext *s, DCTELEM *block,
     ^
434.                         int component, int dc_index, int ac_index, int16_t *quant_matrix,
435.                         int ss, int se, int Ah, int Al, int *EOBRUN)

libavcodec/mjpegdec.c:433:1: Parameter `*s->gb.buffer`
      431. 
      432. /* decode block and dequantize - progressive JPEG version */
      433. static int decode_block_progressive(MJpegDecodeContext *s, DCTELEM *block,
           ^
      434.                         int component, int dc_index, int ac_index, int16_t *quant_matrix,
      435.                         int ss, int se, int Ah, int Al, int *EOBRUN)

libavcodec/mjpegdec.c:467:17: Array access: Offset: 3 Size: [0, +oo] by call to `ff_mjpeg_decode_sos` 
      465.             code &= 0xf;
      466.             if(code > MIN_CACHE_BITS - 16){
      467.                 UPDATE_CACHE(re, &s->gb)
                           ^
      468.             }
      469.             {
