libavcodec/mjpegdec.c:1469: error: Integer Overflow L2
  ([-oo, 536870912] × 8):signed32.

libavcodec/mjpegdec.c:1455:22: <LHS trace>
1453.     while (buf_ptr < buf_end) {
1454.         /* find start next marker */
1455.         start_code = ff_mjpeg_find_marker(s, &buf_ptr, buf_end,
                           ^
1456.                                           &unescaped_buf_ptr,
1457.                                           &unescaped_buf_size);

libavcodec/mjpegdec.c:1455:22: Call
1453.     while (buf_ptr < buf_end) {
1454.         /* find start next marker */
1455.         start_code = ff_mjpeg_find_marker(s, &buf_ptr, buf_end,
                           ^
1456.                                           &unescaped_buf_ptr,
1457.                                           &unescaped_buf_size);

libavcodec/mjpegdec.c:1354:1: Parameter `*unescaped_buf_size`
  1352. }
  1353. 
  1354. int ff_mjpeg_find_marker(MJpegDecodeContext *s,
        ^
  1355.                          const uint8_t **buf_ptr, const uint8_t *buf_end,
  1356.                          const uint8_t **unescaped_buf_ptr,

libavcodec/mjpegdec.c:1469:13: Binary operation: ([-oo, 536870912] × 8):signed32
1467.                    start_code, buf_end - buf_ptr);
1468. 
1469.             init_get_bits(&s->gb, unescaped_buf_ptr, unescaped_buf_size * 8);
                  ^
1470. 
1471.             s->start_code = start_code;
