libavcodec/mjpegdec.c:1484: error: Integer Overflow L2
  ([-oo, 536870912] × 8):signed32.

libavcodec/mjpegdec.c:1469:22: <LHS trace>
1467.     while (buf_ptr < buf_end) {
1468.         /* find start next marker */
1469.         start_code = ff_mjpeg_find_marker(s, &buf_ptr, buf_end,
                           ^
1470.                                           &unescaped_buf_ptr,
1471.                                           &unescaped_buf_size);

libavcodec/mjpegdec.c:1469:22: Call
1467.     while (buf_ptr < buf_end) {
1468.         /* find start next marker */
1469.         start_code = ff_mjpeg_find_marker(s, &buf_ptr, buf_end,
                           ^
1470.                                           &unescaped_buf_ptr,
1471.                                           &unescaped_buf_size);

libavcodec/mjpegdec.c:1364:1: Parameter `*unescaped_buf_size`
  1362. }
  1363. 
  1364. int ff_mjpeg_find_marker(MJpegDecodeContext *s,
        ^
  1365.                          const uint8_t **buf_ptr, const uint8_t *buf_end,
  1366.                          const uint8_t **unescaped_buf_ptr,

libavcodec/mjpegdec.c:1484:9: Binary operation: ([-oo, 536870912] × 8):signed32
1482.                start_code, buf_end - buf_ptr);
1483. 
1484.         init_get_bits(&s->gb, unescaped_buf_ptr, unescaped_buf_size * 8);
              ^
1485. 
1486.         s->start_code = start_code;
