libavcodec/h264_parser.c:273: error: Buffer Overrun L3
  Offset: [2, +oo] Size: [1, 2147483631] by call to `ff_h264_sei_decode`.

libavcodec/h264_parser.c:223:5: Call
221.     s->picture_structure = AV_PICTURE_STRUCTURE_UNKNOWN;
222. 
223.     ff_h264_sei_uninit(&p->sei);
         ^
224. 
225.     if (!buf_size)

libavcodec/h264_sei.c:53:5: Assignment
  51.     h->afd.present                 =  0;
  52. 
  53.     h->a53_caption.a53_caption_size = 0;
          ^
  54.     av_freep(&h->a53_caption.a53_caption);
  55. }

libavcodec/h264_parser.c:273:13: Call
271.             break;
272.         case H264_NAL_SEI:
273.             ff_h264_sei_decode(&p->sei, &nal.gb, &p->ps, avctx);
                 ^
274.             break;
275.         case H264_NAL_IDR_SLICE:

libavcodec/h264_sei.c:349:1: Parameter `h->a53_caption.a53_caption_size`
  347. }
  348. 
  349. int ff_h264_sei_decode(H264SEIContext *h, GetBitContext *gb,
       ^
  350.                        const H264ParamSets *ps, void *logctx)
  351. {

libavcodec/h264_sei.c:382:19: Call
  380.             break;
  381.         case H264_SEI_TYPE_USER_DATA_REGISTERED:
  382.             ret = decode_registered_user_data(h, gb, logctx, size);
                         ^
  383.             break;
  384.         case H264_SEI_TYPE_USER_DATA_UNREGISTERED:

libavcodec/h264_sei.c:194:1: Parameter `h->a53_caption.a53_caption_size`
    192. }
    193. 
    194. static int decode_registered_user_data(H264SEIContext *h, GetBitContext *gb,
         ^
    195.                                        void *logctx, int size)
    196. {

libavcodec/h264_sei.c:219:20: Call
    217.             return decode_registered_user_data_afd(&h->afd, gb, size);
    218.         case MKBETAG('G', 'A', '9', '4'):       // closed captions
    219.             return decode_registered_user_data_closed_caption(&h->a53_caption, gb,
                            ^
    220.                                                               logctx, size);
    221.         default:

libavcodec/h264_sei.c:139:1: <Offset trace>
137. }
138. 
139. static int decode_registered_user_data_closed_caption(H264SEIA53Caption *h,
     ^
140.                                                      GetBitContext *gb, void *logctx,
141.                                                      int size)

libavcodec/h264_sei.c:139:1: Parameter `h->a53_caption_size`
      137. }
      138. 
      139. static int decode_registered_user_data_closed_caption(H264SEIA53Caption *h,
           ^
      140.                                                      GetBitContext *gb, void *logctx,
      141.                                                      int size)

libavcodec/h264_sei.c:175:36: Assignment
      173. 
      174.                 for (i = 0; i < cc_count; i++) {
      175.                     h->a53_caption[h->a53_caption_size++] = get_bits(gb, 8);
                                              ^
      176.                     h->a53_caption[h->a53_caption_size++] = get_bits(gb, 8);
      177.                     h->a53_caption[h->a53_caption_size++] = get_bits(gb, 8);

libavcodec/h264_sei.c:176:36: Assignment
      174.                 for (i = 0; i < cc_count; i++) {
      175.                     h->a53_caption[h->a53_caption_size++] = get_bits(gb, 8);
      176.                     h->a53_caption[h->a53_caption_size++] = get_bits(gb, 8);
                                              ^
      177.                     h->a53_caption[h->a53_caption_size++] = get_bits(gb, 8);
      178.                 }

libavcodec/h264_sei.c:157:24: <Length trace>
155.         if (flag) {
156.             skip_bits(gb, 1);       // zero bit
157.             cc_count = get_bits(gb, 5);
                            ^
158.             skip_bits(gb, 8);       // reserved
159.             size -= 2;

libavcodec/h264_sei.c:157:24: Call
      155.         if (flag) {
      156.             skip_bits(gb, 1);       // zero bit
      157.             cc_count = get_bits(gb, 5);
                                  ^
      158.             skip_bits(gb, 8);       // reserved
      159.             size -= 2;

libavcodec/get_bits.h:232:5: Call
        230.     register int tmp;
        231.     OPEN_READER(re, s);
        232.     UPDATE_CACHE(re, s);
                 ^
        233.     tmp = SHOW_UBITS(re, s, n);
        234.     LAST_SKIP_BITS(re, s, n);

libavutil/ppc/intreadwrite.h:63:5: Assignment
          61.     uint32_t v;
          62.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
          63.     return v;
                  ^
          64. }
          65. 

libavcodec/get_bits.h:232:5: Assignment
        230.     register int tmp;
        231.     OPEN_READER(re, s);
        232.     UPDATE_CACHE(re, s);
                 ^
        233.     tmp = SHOW_UBITS(re, s, n);
        234.     LAST_SKIP_BITS(re, s, n);

libavcodec/get_bits.h:233:5: Assignment
        231.     OPEN_READER(re, s);
        232.     UPDATE_CACHE(re, s);
        233.     tmp = SHOW_UBITS(re, s, n);
                 ^
        234.     LAST_SKIP_BITS(re, s, n);
        235.     CLOSE_READER(re, s);

libavcodec/get_bits.h:236:5: Assignment
        234.     LAST_SKIP_BITS(re, s, n);
        235.     CLOSE_READER(re, s);
        236.     return tmp;
                 ^
        237. }
        238. 

libavcodec/h264_sei.c:157:13: Assignment
      155.         if (flag) {
      156.             skip_bits(gb, 1);       // zero bit
      157.             cc_count = get_bits(gb, 5);
                       ^
      158.             skip_bits(gb, 8);       // reserved
      159.             size -= 2;

libavcodec/h264_sei.c:162:17: Assignment
      160. 
      161.             if (cc_count && size >= cc_count * 3) {
      162.                 const uint64_t new_size = (h->a53_caption_size + cc_count
                           ^
      163.                                            * UINT64_C(3));
      164.                 int i, ret;

libavcodec/h264_sei.c:170:23: Call
      168. 
      169.                 /* Allow merging of the cc data from two fields. */
      170.                 ret = av_reallocp(&h->a53_caption, new_size);
                                 ^
      171.                 if (ret < 0)
      172.                     return ret;

libavutil/mem.c:125:9: Call
        123. 
        124.     if (!size) {
        125.         av_freep(ptr);
                     ^
        126.         return 0;
        127.     }

libavutil/mem.c:198:26: Assignment
          196. 
          197.     memcpy(&val, arg, sizeof(val));
          198.     memcpy(arg, &(void *){ NULL }, sizeof(val));
                                        ^
          199.     av_free(val);
          200. }

libavcodec/h264_sei.c:177:21: Array access: Offset: [2, +oo] Size: [1, 2147483631] by call to `ff_h264_sei_decode` 
      175.                     h->a53_caption[h->a53_caption_size++] = get_bits(gb, 8);
      176.                     h->a53_caption[h->a53_caption_size++] = get_bits(gb, 8);
      177.                     h->a53_caption[h->a53_caption_size++] = get_bits(gb, 8);
                               ^
      178.                 }
      179. 
