libavcodec/mjpegbdec.c:106: error: Buffer Overrun L2
  Offset: [0, max(4, `avctx->priv_data->nb_components`)] Size: 4 by call to `ff_mjpeg_decode_sos`.

libavcodec/mjpegbdec.c:32:1: Parameter `avctx->priv_data->nb_components`
30. 
31. 
32. static int mjpegb_decode_frame(AVCodecContext *avctx,
    ^
33.                               void *data, int *data_size,
34.                               const uint8_t *buf, int buf_size)

libavcodec/mjpegbdec.c:106:9: Call
104.         s->mjpb_skiptosod = (sod_offs - sos_offs - show_bits(&s->gb, 16));
105.         s->start_code = SOS;
106.         ff_mjpeg_decode_sos(s);
             ^
107.     }
108. 

libavcodec/mjpegdec.c:738:1: <Offset trace>
736. }
737. 
738. int ff_mjpeg_decode_sos(MJpegDecodeContext *s)
     ^
739. {
740.     int len, nb_components, i, h, v, predictor, point_transform;

libavcodec/mjpegdec.c:738:1: Parameter `s->nb_components`
  736. }
  737. 
  738. int ff_mjpeg_decode_sos(MJpegDecodeContext *s)
       ^
  739. {
  740.     int len, nb_components, i, h, v, predictor, point_transform;

libavcodec/mjpegdec.c:738:1: <Length trace>
736. }
737. 
738. int ff_mjpeg_decode_sos(MJpegDecodeContext *s)
     ^
739. {
740.     int len, nb_components, i, h, v, predictor, point_transform;

libavcodec/mjpegdec.c:738:1: Parameter `s->h_count[*]`
  736. }
  737. 
  738. int ff_mjpeg_decode_sos(MJpegDecodeContext *s)
       ^
  739. {
  740.     int len, nb_components, i, h, v, predictor, point_transform;

libavcodec/mjpegdec.c:770:27: Array access: Offset: [0, max(4, avctx->priv_data->nb_components)] Size: 4 by call to `ff_mjpeg_decode_sos` 
  768.         s->comp_index[i] = index;
  769. 
  770.         s->nb_blocks[i] = s->h_count[index] * s->v_count[index];
                                 ^
  771.         s->h_scount[i] = s->h_count[index];
  772.         s->v_scount[i] = s->v_count[index];
