libavcodec/h264.c:1483: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: 16 by call to `decode_nal_units`.

libavcodec/h264.c:1458:1: Parameter `h->slice_context_count`
1456.                             int parse_extradata);
1457. 
1458. int ff_h264_decode_extradata(H264Context *h)
      ^
1459. {
1460.     AVCodecContext *avctx = h->avctx;

libavcodec/h264.c:1483:19: Call
1481.             if (p - avctx->extradata + nalsize > avctx->extradata_size)
1482.                 return AVERROR_INVALIDDATA;
1483.             ret = decode_nal_units(h, p, nalsize, 1);
                        ^
1484.             if (ret < 0) {
1485.                 av_log(avctx, AV_LOG_ERROR,

libavcodec/h264.c:4564:9: Assignment
  4562.     for (; pass <= 1; pass++) {
  4563.         buf_index     = 0;
  4564.         context_count = 0;
                ^
  4565.         next_avc      = h->is_avc ? 0 : buf_size;
  4566.         nal_index     = 0;

libavcodec/h264.c:4827:17: Call
  4825. 
  4826.             if (context_count == h->max_contexts) {
  4827.                 execute_decode_slices(h, context_count);
                        ^
  4828.                 context_count = 0;
  4829.             }

libavcodec/h264.c:4503:1: <Offset trace>
4501.  * @param context_count number of contexts to execute
4502.  */
4503. static int execute_decode_slices(H264Context *h, unsigned context_count)
      ^
4504. {
4505.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264.c:4503:1: Parameter `context_count`
    4501.  * @param context_count number of contexts to execute
    4502.  */
    4503. static int execute_decode_slices(H264Context *h, unsigned context_count)
          ^
    4504. {
    4505.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264.c:4503:1: <Length trace>
4501.  * @param context_count number of contexts to execute
4502.  */
4503. static int execute_decode_slices(H264Context *h, unsigned context_count)
      ^
4504. {
4505.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264.c:4503:1: Parameter `h->thread_context[*]`
    4501.  * @param context_count number of contexts to execute
    4502.  */
    4503. static int execute_decode_slices(H264Context *h, unsigned context_count)
          ^
    4504. {
    4505.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264.c:4529:32: Array access: Offset: [-1, +oo] Size: 16 by call to `decode_nal_units` 
    4527. 
    4528.         /* pull back stuff from slices to master context */
    4529.         hx                   = h->thread_context[context_count - 1];
                                         ^
    4530.         h->mb_x              = hx->mb_x;
    4531.         h->mb_y              = hx->mb_y;

static int execute_decode_slices(H264Context *h, unsigned context_count)
{
    AVCodecContext *const avctx = h->avctx;
    H264Context *hx;
    int i;
    if (h->mb_y >= h->mb_height) {
        av_log(h->avctx, AV_LOG_ERROR,
               "Input contains more MB rows than the frame height.\n");
        return AVERROR_INVALIDDATA;
    }
    if (h->avctx->hwaccel)
        return 0;
    if (context_count == 1) {
        return decode_slice(avctx, &h);
    } else {
        for (i = 1; i < context_count; i++) {
            hx                 = h->thread_context[i];
            hx->er.error_count = 0;
        }
        avctx->execute(avctx, decode_slice, h->thread_context,
                       NULL, context_count, sizeof(void *));
        hx                   = h->thread_context[context_count - 1];
        h->mb_x              = hx->mb_x;
        h->mb_y              = hx->mb_y;
        h->droppable         = hx->droppable;
        h->picture_structure = hx->picture_structure;
        for (i = 1; i < context_count; i++)
            h->er.error_count += h->thread_context[i]->er.error_count;
    }
    return 0;
}
['int ff_h264_decode_extradata(H264Context *h)\n{\n    AVCodecContext *avctx = h->avctx;\n    int ret;\n    if (avctx->extradata[0] == 1) {\n        int i, cnt, nalsize;\n        unsigned char *p = avctx->extradata;\n        h->is_avc = 1;\n        if (avctx->extradata_size < 7) {\n            av_log(avctx, AV_LOG_ERROR, "avcC too short\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        h->nal_length_size = 2;\n        cnt = *(p + 5) & 0x1f;\n        p  += 6;\n        for (i = 0; i < cnt; i++) {\n            nalsize = AV_RB16(p) + 2;\n            if (p - avctx->extradata + nalsize > avctx->extradata_size)\n                return AVERROR_INVALIDDATA;\n            ret = decode_nal_units(h, p, nalsize, 1);\n            if (ret < 0) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "Decoding sps %d from avcC failed\\n", i);\n                return ret;\n            }\n            p += nalsize;\n        }\n        cnt = *(p++);\n        for (i = 0; i < cnt; i++) {\n            nalsize = AV_RB16(p) + 2;\n            if (p - avctx->extradata + nalsize > avctx->extradata_size)\n                return AVERROR_INVALIDDATA;\n            ret = decode_nal_units(h, p, nalsize, 1);\n            if (ret < 0) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "Decoding pps %d from avcC failed\\n", i);\n                return ret;\n            }\n            p += nalsize;\n        }\n        h->nal_length_size = (avctx->extradata[4] & 0x03) + 1;\n    } else {\n        h->is_avc = 0;\n        ret = decode_nal_units(h, avctx->extradata, avctx->extradata_size, 1);\n        if (ret < 0)\n            return ret;\n    }\n    return 0;\n}', 'static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size,\n                            int parse_extradata)\n{\n    AVCodecContext *const avctx = h->avctx;\n    H264Context *hx;\n    int buf_index;\n    unsigned context_count;\n    int next_avc;\n    int pass = !(avctx->active_thread_type & FF_THREAD_FRAME);\n    int nals_needed = 0;\n    int nal_index;\n    int ret = 0;\n    h->max_contexts = h->slice_context_count;\n    if (!(avctx->flags2 & CODEC_FLAG2_CHUNKS)) {\n        h->current_slice = 0;\n        if (!h->first_field)\n            h->cur_pic_ptr = NULL;\n        ff_h264_reset_sei(h);\n    }\n    for (; pass <= 1; pass++) {\n        buf_index     = 0;\n        context_count = 0;\n        next_avc      = h->is_avc ? 0 : buf_size;\n        nal_index     = 0;\n        for (;;) {\n            int consumed;\n            int dst_length;\n            int bit_length;\n            const uint8_t *ptr;\n            int i, nalsize = 0;\n            int err;\n            if (buf_index >= next_avc) {\n                if (buf_index >= buf_size - h->nal_length_size)\n                    break;\n                nalsize = 0;\n                for (i = 0; i < h->nal_length_size; i++)\n                    nalsize = (nalsize << 8) | buf[buf_index++];\n                if (nalsize <= 0 || nalsize > buf_size - buf_index) {\n                    av_log(h->avctx, AV_LOG_ERROR,\n                           "AVC: nal size %d\\n", nalsize);\n                    break;\n                }\n                next_avc = buf_index + nalsize;\n            } else {\n                for (; buf_index + 3 < next_avc; buf_index++)\n                    if (buf[buf_index]     == 0 &&\n                        buf[buf_index + 1] == 0 &&\n                        buf[buf_index + 2] == 1)\n                        break;\n                if (buf_index + 3 >= buf_size) {\n                    buf_index = buf_size;\n                    break;\n                }\n                buf_index += 3;\n                if (buf_index >= next_avc)\n                    continue;\n            }\n            hx = h->thread_context[context_count];\n            ptr = ff_h264_decode_nal(hx, buf + buf_index, &dst_length,\n                                     &consumed, next_avc - buf_index);\n            if (ptr == NULL || dst_length < 0) {\n                ret = -1;\n                goto end;\n            }\n            i = buf_index + consumed;\n            if ((h->workaround_bugs & FF_BUG_AUTODETECT) && i + 3 < next_avc &&\n                buf[i]     == 0x00 && buf[i + 1] == 0x00 &&\n                buf[i + 2] == 0x01 && buf[i + 3] == 0xE0)\n                h->workaround_bugs |= FF_BUG_TRUNCATED;\n            if (!(h->workaround_bugs & FF_BUG_TRUNCATED))\n                while (dst_length > 0 && ptr[dst_length - 1] == 0)\n                    dst_length--;\n            bit_length = !dst_length ? 0\n                                     : (8 * dst_length -\n                                        decode_rbsp_trailing(h, ptr + dst_length - 1));\n            if (h->avctx->debug & FF_DEBUG_STARTCODE)\n                av_log(h->avctx, AV_LOG_DEBUG,\n                       "NAL %d at %d/%d length %d\\n",\n                       hx->nal_unit_type, buf_index, buf_size, dst_length);\n            if (h->is_avc && (nalsize != consumed) && nalsize)\n                av_log(h->avctx, AV_LOG_DEBUG,\n                       "AVC: Consumed only %d bytes instead of %d\\n",\n                       consumed, nalsize);\n            buf_index += consumed;\n            nal_index++;\n            if (pass == 0) {\n                switch (hx->nal_unit_type) {\n                case NAL_SPS:\n                case NAL_PPS:\n                    nals_needed = nal_index;\n                    break;\n                case NAL_DPA:\n                case NAL_IDR_SLICE:\n                case NAL_SLICE:\n                    init_get_bits(&hx->gb, ptr, bit_length);\n                    if (!get_ue_golomb(&hx->gb))\n                        nals_needed = nal_index;\n                }\n                continue;\n            }\n            if (avctx->skip_frame >= AVDISCARD_NONREF &&\n                h->nal_ref_idc == 0 &&\n                h->nal_unit_type != NAL_SEI)\n                continue;\nagain:\n            if (parse_extradata && HAVE_THREADS &&\n                (h->avctx->active_thread_type & FF_THREAD_FRAME) &&\n                (hx->nal_unit_type != NAL_PPS &&\n                 hx->nal_unit_type != NAL_SPS)) {\n                if (hx->nal_unit_type < NAL_AUD ||\n                    hx->nal_unit_type > NAL_AUXILIARY_SLICE)\n                    av_log(avctx, AV_LOG_INFO,\n                           "Ignoring NAL unit %d during extradata parsing\\n",\n                           hx->nal_unit_type);\n                hx->nal_unit_type = NAL_FF_IGNORE;\n            }\n            err = 0;\n            switch (hx->nal_unit_type) {\n            case NAL_IDR_SLICE:\n                if (h->nal_unit_type != NAL_IDR_SLICE) {\n                    av_log(h->avctx, AV_LOG_ERROR,\n                           "Invalid mix of idr and non-idr slices\\n");\n                    ret = -1;\n                    goto end;\n                }\n                idr(h);\n            case NAL_SLICE:\n                init_get_bits(&hx->gb, ptr, bit_length);\n                hx->intra_gb_ptr      =\n                hx->inter_gb_ptr      = &hx->gb;\n                hx->data_partitioning = 0;\n                if ((err = decode_slice_header(hx, h)))\n                    break;\n                if (h->sei_recovery_frame_cnt >= 0 && h->recovery_frame < 0) {\n                    h->recovery_frame = (h->frame_num + h->sei_recovery_frame_cnt) &\n                                        ((1 << h->sps.log2_max_frame_num) - 1);\n                }\n                h->cur_pic_ptr->f.key_frame |=\n                    (hx->nal_unit_type == NAL_IDR_SLICE) ||\n                    (h->sei_recovery_frame_cnt >= 0);\n                if (hx->nal_unit_type == NAL_IDR_SLICE ||\n                    h->recovery_frame == h->frame_num) {\n                    h->recovery_frame         = -1;\n                    h->cur_pic_ptr->recovered = 1;\n                }\n                if (hx->nal_unit_type == NAL_IDR_SLICE)\n                    h->frame_recovered |= FRAME_RECOVERED_IDR;\n                h->cur_pic_ptr->recovered |= !!(h->frame_recovered & FRAME_RECOVERED_IDR);\n                if (h->current_slice == 1) {\n                    if (!(avctx->flags2 & CODEC_FLAG2_CHUNKS))\n                        decode_postinit(h, nal_index >= nals_needed);\n                    if (h->avctx->hwaccel &&\n                        (ret = h->avctx->hwaccel->start_frame(h->avctx, NULL, 0)) < 0)\n                        return ret;\n                }\n                if (hx->redundant_pic_count == 0 &&\n                    (avctx->skip_frame < AVDISCARD_NONREF ||\n                     hx->nal_ref_idc) &&\n                    (avctx->skip_frame < AVDISCARD_BIDIR  ||\n                     hx->slice_type_nos != AV_PICTURE_TYPE_B) &&\n                    (avctx->skip_frame < AVDISCARD_NONKEY ||\n                     hx->slice_type_nos == AV_PICTURE_TYPE_I) &&\n                    avctx->skip_frame < AVDISCARD_ALL) {\n                    if (avctx->hwaccel) {\n                        ret = avctx->hwaccel->decode_slice(avctx,\n                                                           &buf[buf_index - consumed],\n                                                           consumed);\n                        if (ret < 0)\n                            return ret;\n                    } else\n                        context_count++;\n                }\n                break;\n            case NAL_DPA:\n                if (h->avctx->flags & CODEC_FLAG2_CHUNKS) {\n                    av_log(h->avctx, AV_LOG_ERROR,\n                           "Decoding in chunks is not supported for "\n                           "partitioned slices.\\n");\n                    return AVERROR(ENOSYS);\n                }\n                init_get_bits(&hx->gb, ptr, bit_length);\n                hx->intra_gb_ptr =\n                hx->inter_gb_ptr = NULL;\n                if ((err = decode_slice_header(hx, h)) < 0) {\n                    h->data_partitioning = 0;\n                    break;\n                }\n                hx->data_partitioning = 1;\n                break;\n            case NAL_DPB:\n                init_get_bits(&hx->intra_gb, ptr, bit_length);\n                hx->intra_gb_ptr = &hx->intra_gb;\n                break;\n            case NAL_DPC:\n                init_get_bits(&hx->inter_gb, ptr, bit_length);\n                hx->inter_gb_ptr = &hx->inter_gb;\n                if (hx->redundant_pic_count == 0 &&\n                    hx->intra_gb_ptr &&\n                    hx->data_partitioning &&\n                    h->cur_pic_ptr && h->context_initialized &&\n                    (avctx->skip_frame < AVDISCARD_NONREF || hx->nal_ref_idc) &&\n                    (avctx->skip_frame < AVDISCARD_BIDIR  ||\n                     hx->slice_type_nos != AV_PICTURE_TYPE_B) &&\n                    (avctx->skip_frame < AVDISCARD_NONKEY ||\n                     hx->slice_type_nos == AV_PICTURE_TYPE_I) &&\n                    avctx->skip_frame < AVDISCARD_ALL)\n                    context_count++;\n                break;\n            case NAL_SEI:\n                init_get_bits(&h->gb, ptr, bit_length);\n                ff_h264_decode_sei(h);\n                break;\n            case NAL_SPS:\n                init_get_bits(&h->gb, ptr, bit_length);\n                ret = ff_h264_decode_seq_parameter_set(h);\n                if (ret < 0 && h->is_avc && (nalsize != consumed) && nalsize) {\n                    av_log(h->avctx, AV_LOG_DEBUG,\n                           "SPS decoding failure, trying again with the complete NAL\\n");\n                    init_get_bits(&h->gb, buf + buf_index + 1 - consumed,\n                                  8 * (nalsize - 1));\n                    ff_h264_decode_seq_parameter_set(h);\n                }\n                ret = h264_set_parameter_from_sps(h);\n                if (ret < 0)\n                    goto end;\n                break;\n            case NAL_PPS:\n                init_get_bits(&h->gb, ptr, bit_length);\n                ff_h264_decode_picture_parameter_set(h, bit_length);\n                break;\n            case NAL_AUD:\n            case NAL_END_SEQUENCE:\n            case NAL_END_STREAM:\n            case NAL_FILLER_DATA:\n            case NAL_SPS_EXT:\n            case NAL_AUXILIARY_SLICE:\n                break;\n            case NAL_FF_IGNORE:\n                break;\n            default:\n                av_log(avctx, AV_LOG_DEBUG, "Unknown NAL code: %d (%d bits)\\n",\n                       hx->nal_unit_type, bit_length);\n            }\n            if (context_count == h->max_contexts) {\n                execute_decode_slices(h, context_count);\n                context_count = 0;\n            }\n            if (err < 0) {\n                av_log(h->avctx, AV_LOG_ERROR, "decode_slice_header error\\n");\n                h->ref_count[0] = h->ref_count[1] = h->list_count = 0;\n            } else if (err == 1) {\n                h->nal_unit_type = hx->nal_unit_type;\n                h->nal_ref_idc   = hx->nal_ref_idc;\n                hx               = h;\n                goto again;\n            }\n        }\n    }\n    if (context_count)\n        execute_decode_slices(h, context_count);\nend:\n    if (h->cur_pic_ptr && !h->droppable) {\n        ff_thread_report_progress(&h->cur_pic_ptr->tf, INT_MAX,\n                                  h->picture_structure == PICT_BOTTOM_FIELD);\n    }\n    return (ret < 0) ? ret : buf_index;\n}', 'static int execute_decode_slices(H264Context *h, unsigned context_count)\n{\n    AVCodecContext *const avctx = h->avctx;\n    H264Context *hx;\n    int i;\n    if (h->mb_y >= h->mb_height) {\n        av_log(h->avctx, AV_LOG_ERROR,\n               "Input contains more MB rows than the frame height.\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (h->avctx->hwaccel)\n        return 0;\n    if (context_count == 1) {\n        return decode_slice(avctx, &h);\n    } else {\n        for (i = 1; i < context_count; i++) {\n            hx                 = h->thread_context[i];\n            hx->er.error_count = 0;\n        }\n        avctx->execute(avctx, decode_slice, h->thread_context,\n                       NULL, context_count, sizeof(void *));\n        hx                   = h->thread_context[context_count - 1];\n        h->mb_x              = hx->mb_x;\n        h->mb_y              = hx->mb_y;\n        h->droppable         = hx->droppable;\n        h->picture_structure = hx->picture_structure;\n        for (i = 1; i < context_count; i++)\n            h->er.error_count += h->thread_context[i]->er.error_count;\n    }\n    return 0;\n}']