libavcodec/h264.c:660: error: Buffer Overrun L3
  Offset: [-1, 0] Size: 16 by call to `ff_h264_decode_extradata`.

libavcodec/h264.c:626:5: Assignment
624. 
625.     h->picture_structure   = PICT_FRAME;
626.     h->slice_context_count = 1;
         ^
627.     h->workaround_bugs     = avctx->workaround_bugs;
628.     h->flags               = avctx->flags;

libavcodec/h264.c:660:14: Call
658. 
659.     if (avctx->extradata_size > 0 && avctx->extradata) {
660.        ret = ff_h264_decode_extradata(h);
                  ^
661.        if (ret < 0)
662.            return ret;

libavcodec/h264.c:540:1: Parameter `h->slice_context_count`
  538.                             int parse_extradata);
  539. 
  540. int ff_h264_decode_extradata(H264Context *h)
       ^
  541. {
  542.     AVCodecContext *avctx = h->avctx;

libavcodec/h264.c:592:15: Call
  590.     } else {
  591.         h->is_avc = 0;
  592.         ret = decode_nal_units(h, avctx->extradata, avctx->extradata_size, 1);
                     ^
  593.         if (ret < 0)
  594.             return ret;

libavcodec/h264.c:1419:9: Assignment
    1417.     {
    1418.         buf_index     = 0;
    1419.         context_count = 0;
                  ^
    1420.         next_avc      = h->is_avc ? 0 : buf_size;
    1421.         nal_index     = 0;

libavcodec/h264.c:1633:17: Call
    1631. 
    1632.             if (context_count == h->max_contexts) {
    1633.                 ff_h264_execute_decode_slices(h, context_count);
                          ^
    1634.                 context_count = 0;
    1635.             }

libavcodec/h264_slice.c:2348:1: <Offset trace>
2346.  * @param context_count number of contexts to execute
2347.  */
2348. int ff_h264_execute_decode_slices(H264Context *h, unsigned context_count)
      ^
2349. {
2350.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264_slice.c:2348:1: Parameter `context_count`
      2346.  * @param context_count number of contexts to execute
      2347.  */
      2348. int ff_h264_execute_decode_slices(H264Context *h, unsigned context_count)
            ^
      2349. {
      2350.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264_slice.c:2348:1: <Length trace>
2346.  * @param context_count number of contexts to execute
2347.  */
2348. int ff_h264_execute_decode_slices(H264Context *h, unsigned context_count)
      ^
2349. {
2350.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264_slice.c:2348:1: Parameter `h->thread_context[*]`
      2346.  * @param context_count number of contexts to execute
      2347.  */
      2348. int ff_h264_execute_decode_slices(H264Context *h, unsigned context_count)
            ^
      2349. {
      2350.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264_slice.c:2374:32: Array access: Offset: [-1, 0] Size: 16 by call to `ff_h264_decode_extradata` 
      2372. 
      2373.         /* pull back stuff from slices to master context */
      2374.         hx                   = h->thread_context[context_count - 1];
                                           ^
      2375.         h->mb_x              = hx->mb_x;
      2376.         h->mb_y              = hx->mb_y;

int ff_h264_execute_decode_slices(H264Context *h, unsigned context_count)
{
    AVCodecContext *const avctx = h->avctx;
    H264Context *hx;
    int i;
    if (h->mb_y >= h->mb_height) {
        av_log(h->avctx, AV_LOG_ERROR,
               "Input contains more MB rows than the frame height.\n");
        return AVERROR_INVALIDDATA;
    }
    if (h->avctx->hwaccel)
        return 0;
    if (context_count == 1) {
        return decode_slice(avctx, &h);
    } else {
        for (i = 1; i < context_count; i++) {
            hx                 = h->thread_context[i];
            hx->er.error_count = 0;
        }
        avctx->execute(avctx, decode_slice, h->thread_context,
                       NULL, context_count, sizeof(void *));
        hx                   = h->thread_context[context_count - 1];
        h->mb_x              = hx->mb_x;
        h->mb_y              = hx->mb_y;
        h->droppable         = hx->droppable;
        h->picture_structure = hx->picture_structure;
        for (i = 1; i < context_count; i++)
            h->er.error_count += h->thread_context[i]->er.error_count;
    }
    return 0;
}
['int ff_h264_decode_init(AVCodecContext *avctx)\n{\n    H264Context *h = avctx->priv_data;\n    int i;\n    int ret;\n    h->avctx = avctx;\n    h->bit_depth_luma    = 8;\n    h->chroma_format_idc = 1;\n    ff_h264dsp_init(&h->h264dsp, 8, 1);\n    ff_h264chroma_init(&h->h264chroma, h->sps.bit_depth_chroma);\n    ff_h264qpel_init(&h->h264qpel, 8);\n    ff_h264_pred_init(&h->hpc, h->avctx->codec_id, 8, 1);\n    h->dequant_coeff_pps = -1;\n    if (CONFIG_ERROR_RESILIENCE)\n        ff_dsputil_init(&h->dsp, h->avctx);\n    ff_videodsp_init(&h->vdsp, 8);\n    memset(h->pps.scaling_matrix4, 16, 6 * 16 * sizeof(uint8_t));\n    memset(h->pps.scaling_matrix8, 16, 2 * 64 * sizeof(uint8_t));\n    h->picture_structure   = PICT_FRAME;\n    h->slice_context_count = 1;\n    h->workaround_bugs     = avctx->workaround_bugs;\n    h->flags               = avctx->flags;\n    if (!avctx->has_b_frames)\n        h->low_delay = 1;\n    avctx->chroma_sample_location = AVCHROMA_LOC_LEFT;\n    ff_h264_decode_init_vlc();\n    ff_init_cabac_states();\n    h->pixel_shift        = 0;\n    h->sps.bit_depth_luma = avctx->bits_per_raw_sample = 8;\n    h->thread_context[0] = h;\n    h->outputed_poc      = h->next_outputed_poc = INT_MIN;\n    for (i = 0; i < MAX_DELAYED_PIC_COUNT; i++)\n        h->last_pocs[i] = INT_MIN;\n    h->prev_poc_msb = 1 << 16;\n    h->x264_build   = -1;\n    ff_h264_reset_sei(h);\n    h->recovery_frame = -1;\n    h->frame_recovered = 0;\n    if (avctx->codec_id == AV_CODEC_ID_H264) {\n        if (avctx->ticks_per_frame == 1)\n            h->avctx->time_base.den *= 2;\n        avctx->ticks_per_frame = 2;\n    }\n    if (avctx->extradata_size > 0 && avctx->extradata) {\n       ret = ff_h264_decode_extradata(h);\n       if (ret < 0)\n           return ret;\n    }\n    if (h->sps.bitstream_restriction_flag &&\n        h->avctx->has_b_frames < h->sps.num_reorder_frames) {\n        h->avctx->has_b_frames = h->sps.num_reorder_frames;\n        h->low_delay           = 0;\n    }\n    avctx->internal->allocate_progress = 1;\n    return 0;\n}', 'int ff_h264_decode_extradata(H264Context *h)\n{\n    AVCodecContext *avctx = h->avctx;\n    int ret;\n    if (avctx->extradata[0] == 1) {\n        int i, cnt, nalsize;\n        unsigned char *p = avctx->extradata;\n        h->is_avc = 1;\n        if (avctx->extradata_size < 7) {\n            av_log(avctx, AV_LOG_ERROR,\n                   "avcC %d too short\\n", avctx->extradata_size);\n            return AVERROR_INVALIDDATA;\n        }\n        h->nal_length_size = 2;\n        cnt = *(p + 5) & 0x1f;\n        p  += 6;\n        for (i = 0; i < cnt; i++) {\n            nalsize = AV_RB16(p) + 2;\n            if (p - avctx->extradata + nalsize > avctx->extradata_size)\n                return AVERROR_INVALIDDATA;\n            ret = decode_nal_units(h, p, nalsize, 1);\n            if (ret < 0) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "Decoding sps %d from avcC failed\\n", i);\n                return ret;\n            }\n            p += nalsize;\n        }\n        cnt = *(p++);\n        for (i = 0; i < cnt; i++) {\n            nalsize = AV_RB16(p) + 2;\n            if (p - avctx->extradata + nalsize > avctx->extradata_size)\n                return AVERROR_INVALIDDATA;\n            ret = decode_nal_units(h, p, nalsize, 1);\n            if (ret < 0) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "Decoding pps %d from avcC failed\\n", i);\n                return ret;\n            }\n            p += nalsize;\n        }\n        h->nal_length_size = (avctx->extradata[4] & 0x03) + 1;\n    } else {\n        h->is_avc = 0;\n        ret = decode_nal_units(h, avctx->extradata, avctx->extradata_size, 1);\n        if (ret < 0)\n            return ret;\n    }\n    return 0;\n}', 'static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size,\n                            int parse_extradata)\n{\n    AVCodecContext *const avctx = h->avctx;\n    H264Context *hx;\n    int buf_index;\n    unsigned context_count;\n    int next_avc;\n    int nals_needed = 0;\n    int nal_index;\n    int ret = 0;\n    h->max_contexts = h->slice_context_count;\n    if (!(avctx->flags2 & CODEC_FLAG2_CHUNKS)) {\n        h->current_slice = 0;\n        if (!h->first_field)\n            h->cur_pic_ptr = NULL;\n        ff_h264_reset_sei(h);\n    }\n    if (avctx->active_thread_type & FF_THREAD_FRAME)\n        nals_needed = get_last_needed_nal(h, buf, buf_size);\n    {\n        buf_index     = 0;\n        context_count = 0;\n        next_avc      = h->is_avc ? 0 : buf_size;\n        nal_index     = 0;\n        for (;;) {\n            int consumed;\n            int dst_length;\n            int bit_length;\n            const uint8_t *ptr;\n            int nalsize = 0;\n            int err;\n            if (buf_index >= next_avc) {\n                nalsize = get_avc_nalsize(h, buf, buf_size, &buf_index);\n                if (nalsize < 0)\n                    break;\n                next_avc = buf_index + nalsize;\n            } else {\n                buf_index = find_start_code(buf, buf_size, buf_index, next_avc);\n                if (buf_index >= buf_size)\n                    break;\n            }\n            hx = h->thread_context[context_count];\n            ptr = ff_h264_decode_nal(hx, buf + buf_index, &dst_length,\n                                     &consumed, next_avc - buf_index);\n            if (ptr == NULL || dst_length < 0) {\n                ret = -1;\n                goto end;\n            }\n            bit_length = get_bit_length(h, buf, ptr, dst_length,\n                                        buf_index + consumed, next_avc);\n            if (h->avctx->debug & FF_DEBUG_STARTCODE)\n                av_log(h->avctx, AV_LOG_DEBUG,\n                       "NAL %d at %d/%d length %d\\n",\n                       hx->nal_unit_type, buf_index, buf_size, dst_length);\n            if (h->is_avc && (nalsize != consumed) && nalsize)\n                av_log(h->avctx, AV_LOG_DEBUG,\n                       "AVC: Consumed only %d bytes instead of %d\\n",\n                       consumed, nalsize);\n            buf_index += consumed;\n            nal_index++;\n            if (avctx->skip_frame >= AVDISCARD_NONREF &&\n                h->nal_ref_idc == 0 &&\n                h->nal_unit_type != NAL_SEI)\n                continue;\nagain:\n            if (parse_extradata && HAVE_THREADS &&\n                (h->avctx->active_thread_type & FF_THREAD_FRAME) &&\n                (hx->nal_unit_type != NAL_PPS &&\n                 hx->nal_unit_type != NAL_SPS)) {\n                if (hx->nal_unit_type < NAL_AUD ||\n                    hx->nal_unit_type > NAL_AUXILIARY_SLICE)\n                    av_log(avctx, AV_LOG_INFO,\n                           "Ignoring NAL unit %d during extradata parsing\\n",\n                           hx->nal_unit_type);\n                hx->nal_unit_type = NAL_FF_IGNORE;\n            }\n            err = 0;\n            switch (hx->nal_unit_type) {\n            case NAL_IDR_SLICE:\n                if (h->nal_unit_type != NAL_IDR_SLICE) {\n                    av_log(h->avctx, AV_LOG_ERROR,\n                           "Invalid mix of idr and non-idr slices\\n");\n                    ret = -1;\n                    goto end;\n                }\n                idr(h);\n            case NAL_SLICE:\n                init_get_bits(&hx->gb, ptr, bit_length);\n                hx->intra_gb_ptr      =\n                hx->inter_gb_ptr      = &hx->gb;\n                hx->data_partitioning = 0;\n                if ((err = ff_h264_decode_slice_header(hx, h)))\n                    break;\n                if (h->sei_recovery_frame_cnt >= 0 && h->recovery_frame < 0) {\n                    h->recovery_frame = (h->frame_num + h->sei_recovery_frame_cnt) &\n                                        ((1 << h->sps.log2_max_frame_num) - 1);\n                }\n                h->cur_pic_ptr->f.key_frame |=\n                    (hx->nal_unit_type == NAL_IDR_SLICE) ||\n                    (h->sei_recovery_frame_cnt >= 0);\n                if (hx->nal_unit_type == NAL_IDR_SLICE ||\n                    h->recovery_frame == h->frame_num) {\n                    h->recovery_frame         = -1;\n                    h->cur_pic_ptr->recovered = 1;\n                }\n                if (hx->nal_unit_type == NAL_IDR_SLICE)\n                    h->frame_recovered |= FRAME_RECOVERED_IDR;\n                h->cur_pic_ptr->recovered |= !!(h->frame_recovered & FRAME_RECOVERED_IDR);\n                if (h->current_slice == 1) {\n                    if (!(avctx->flags2 & CODEC_FLAG2_CHUNKS))\n                        decode_postinit(h, nal_index >= nals_needed);\n                    if (h->avctx->hwaccel &&\n                        (ret = h->avctx->hwaccel->start_frame(h->avctx, NULL, 0)) < 0)\n                        return ret;\n                }\n                if (hx->redundant_pic_count == 0 &&\n                    (avctx->skip_frame < AVDISCARD_NONREF ||\n                     hx->nal_ref_idc) &&\n                    (avctx->skip_frame < AVDISCARD_BIDIR  ||\n                     hx->slice_type_nos != AV_PICTURE_TYPE_B) &&\n                    (avctx->skip_frame < AVDISCARD_NONKEY ||\n                     hx->slice_type_nos == AV_PICTURE_TYPE_I) &&\n                    avctx->skip_frame < AVDISCARD_ALL) {\n                    if (avctx->hwaccel) {\n                        ret = avctx->hwaccel->decode_slice(avctx,\n                                                           &buf[buf_index - consumed],\n                                                           consumed);\n                        if (ret < 0)\n                            return ret;\n                    } else\n                        context_count++;\n                }\n                break;\n            case NAL_DPA:\n                if (h->avctx->flags & CODEC_FLAG2_CHUNKS) {\n                    av_log(h->avctx, AV_LOG_ERROR,\n                           "Decoding in chunks is not supported for "\n                           "partitioned slices.\\n");\n                    return AVERROR(ENOSYS);\n                }\n                init_get_bits(&hx->gb, ptr, bit_length);\n                hx->intra_gb_ptr =\n                hx->inter_gb_ptr = NULL;\n                if ((err = ff_h264_decode_slice_header(hx, h)) < 0) {\n                    h->data_partitioning = 0;\n                    break;\n                }\n                hx->data_partitioning = 1;\n                break;\n            case NAL_DPB:\n                init_get_bits(&hx->intra_gb, ptr, bit_length);\n                hx->intra_gb_ptr = &hx->intra_gb;\n                break;\n            case NAL_DPC:\n                init_get_bits(&hx->inter_gb, ptr, bit_length);\n                hx->inter_gb_ptr = &hx->inter_gb;\n                if (hx->redundant_pic_count == 0 &&\n                    hx->intra_gb_ptr &&\n                    hx->data_partitioning &&\n                    h->cur_pic_ptr && h->context_initialized &&\n                    (avctx->skip_frame < AVDISCARD_NONREF || hx->nal_ref_idc) &&\n                    (avctx->skip_frame < AVDISCARD_BIDIR  ||\n                     hx->slice_type_nos != AV_PICTURE_TYPE_B) &&\n                    (avctx->skip_frame < AVDISCARD_NONKEY ||\n                     hx->slice_type_nos == AV_PICTURE_TYPE_I) &&\n                    avctx->skip_frame < AVDISCARD_ALL)\n                    context_count++;\n                break;\n            case NAL_SEI:\n                init_get_bits(&h->gb, ptr, bit_length);\n                ff_h264_decode_sei(h);\n                break;\n            case NAL_SPS:\n                init_get_bits(&h->gb, ptr, bit_length);\n                ret = ff_h264_decode_seq_parameter_set(h);\n                if (ret < 0 && h->is_avc && (nalsize != consumed) && nalsize) {\n                    av_log(h->avctx, AV_LOG_DEBUG,\n                           "SPS decoding failure, trying again with the complete NAL\\n");\n                    init_get_bits(&h->gb, buf + buf_index + 1 - consumed,\n                                  8 * (nalsize - 1));\n                    ff_h264_decode_seq_parameter_set(h);\n                }\n                ret = ff_h264_set_parameter_from_sps(h);\n                if (ret < 0)\n                    goto end;\n                break;\n            case NAL_PPS:\n                init_get_bits(&h->gb, ptr, bit_length);\n                ff_h264_decode_picture_parameter_set(h, bit_length);\n                break;\n            case NAL_AUD:\n            case NAL_END_SEQUENCE:\n            case NAL_END_STREAM:\n            case NAL_FILLER_DATA:\n            case NAL_SPS_EXT:\n            case NAL_AUXILIARY_SLICE:\n                break;\n            case NAL_FF_IGNORE:\n                break;\n            default:\n                av_log(avctx, AV_LOG_DEBUG, "Unknown NAL code: %d (%d bits)\\n",\n                       hx->nal_unit_type, bit_length);\n            }\n            if (context_count == h->max_contexts) {\n                ff_h264_execute_decode_slices(h, context_count);\n                context_count = 0;\n            }\n            if (err < 0) {\n                av_log(h->avctx, AV_LOG_ERROR, "decode_slice_header error\\n");\n                h->ref_count[0] = h->ref_count[1] = h->list_count = 0;\n            } else if (err == 1) {\n                h->nal_unit_type = hx->nal_unit_type;\n                h->nal_ref_idc   = hx->nal_ref_idc;\n                hx               = h;\n                goto again;\n            }\n        }\n    }\n    if (context_count)\n        ff_h264_execute_decode_slices(h, context_count);\nend:\n    if (h->cur_pic_ptr && !h->droppable) {\n        ff_thread_report_progress(&h->cur_pic_ptr->tf, INT_MAX,\n                                  h->picture_structure == PICT_BOTTOM_FIELD);\n    }\n    return (ret < 0) ? ret : buf_index;\n}', 'int ff_h264_execute_decode_slices(H264Context *h, unsigned context_count)\n{\n    AVCodecContext *const avctx = h->avctx;\n    H264Context *hx;\n    int i;\n    if (h->mb_y >= h->mb_height) {\n        av_log(h->avctx, AV_LOG_ERROR,\n               "Input contains more MB rows than the frame height.\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (h->avctx->hwaccel)\n        return 0;\n    if (context_count == 1) {\n        return decode_slice(avctx, &h);\n    } else {\n        for (i = 1; i < context_count; i++) {\n            hx                 = h->thread_context[i];\n            hx->er.error_count = 0;\n        }\n        avctx->execute(avctx, decode_slice, h->thread_context,\n                       NULL, context_count, sizeof(void *));\n        hx                   = h->thread_context[context_count - 1];\n        h->mb_x              = hx->mb_x;\n        h->mb_y              = hx->mb_y;\n        h->droppable         = hx->droppable;\n        h->picture_structure = hx->picture_structure;\n        for (i = 1; i < context_count; i++)\n            h->er.error_count += h->thread_context[i]->er.error_count;\n    }\n    return 0;\n}']