libavcodec/mjpegdec.c:1453: error: Buffer Overrun L3
  Offset: 3 Size: [0, +oo] by call to `ff_mjpeg_decode_sos`.

libavcodec/mjpegdec.c:1259:1: Parameter `avctx->priv_data->buffer`
1257. }
1258. 
1259. int ff_mjpeg_decode_frame(AVCodecContext *avctx,
      ^
1260.                               void *data, int *data_size,
1261.                               const uint8_t *buf, int buf_size)

libavcodec/mjpegdec.c:1313:21: Call
1311.                         }
1312.                     }
1313.                     init_get_bits(&s->gb, s->buffer, (dst - s->buffer)*8);
                          ^
1314. 
1315.                     av_log(avctx, AV_LOG_DEBUG, "escaping removed %td bytes\n",

libavcodec/bitstream.h:745:1: Parameter `*buffer`
  743.  * @param bit_size the size of the buffer in bits
  744.  */
  745. static inline void init_get_bits(GetBitContext *s,
       ^
  746.                    const uint8_t *buffer, int bit_size)
  747. {

libavcodec/bitstream.h:754:5: Assignment
  752.     }
  753. 
  754.     s->buffer= buffer;
           ^
  755.     s->size_in_bits= bit_size;
  756.     s->buffer_end= buffer + buffer_size;

libavcodec/mjpegdec.c:1453:21: Call
1451.                     break;
1452.                 case SOS:
1453.                     ff_mjpeg_decode_sos(s);
                          ^
1454.                     /* buggy avid puts EOI every 10-20th frame */
1455.                     /* if restart period is over process EOI */

libavcodec/mjpegdec.c:885:1: Parameter `*s->gb.buffer`
  883. }
  884. 
  885. int ff_mjpeg_decode_sos(MJpegDecodeContext *s)
       ^
  886. {
  887.     int len, nb_components, i, h, v, predictor, point_transform;

libavcodec/mjpegdec.c:1000:16: Call
   998.                 return -1;
   999.         } else {
  1000.             if(mjpeg_decode_scan(s, nb_components, prev_shift, point_transform) < 0)
                       ^
  1001.                 return -1;
  1002.         }

libavcodec/mjpegdec.c:764:1: Parameter `*s->gb.buffer`
    762. }
    763. 
    764. static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int Ah, int Al){
         ^
    765.     int i, mb_x, mb_y;
    766.     uint8_t* data[MAX_COMPONENTS];

libavcodec/mjpegdec.c:804:28: Call
    802.                     if(!s->progressive) {
    803.                         s->dsp.clear_block(s->block);
    804.                         if(decode_block(s, s->block, i,
                                    ^
    805.                                      s->dc_index[i], s->ac_index[i],
    806.                                      s->quant_matrixes[ s->quant_index[c] ]) < 0) {

libavcodec/mjpegdec.c:387:1: <Length trace>
385. 
386. /* decode block and dequantize */
387. static int decode_block(MJpegDecodeContext *s, DCTELEM *block,
     ^
388.                         int component, int dc_index, int ac_index, int16_t *quant_matrix)
389. {

libavcodec/mjpegdec.c:387:1: Parameter `*s->gb.buffer`
      385. 
      386. /* decode block and dequantize */
      387. static int decode_block(MJpegDecodeContext *s, DCTELEM *block,
           ^
      388.                         int component, int dc_index, int ac_index, int16_t *quant_matrix)
      389. {

libavcodec/mjpegdec.c:415:17: Array access: Offset: 3 Size: [0, +oo] by call to `ff_mjpeg_decode_sos` 
      413.             code &= 0xf;
      414.             if(code > MIN_CACHE_BITS - 16){
      415.                 UPDATE_CACHE(re, &s->gb)
                           ^
      416.             }
      417.             {
