libavcodec/h264_slice.c:1824: error: Buffer Overrun L1
  Offset: [20, 51] Size: 2.

libavcodec/h264_slice.c:1823:14: <Offset trace>
1821.         ref2frm[18 + 0] =
1822.         ref2frm[18 + 1] = -1;
1823.         for (i = 16; i < 48; i++)
                   ^
1824.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
1825.                              (sl->ref_list[j][i].reference & 3);

libavcodec/h264_slice.c:1823:14: Assignment
1821.         ref2frm[18 + 0] =
1822.         ref2frm[18 + 1] = -1;
1823.         for (i = 16; i < 48; i++)
                   ^
1824.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
1825.                              (sl->ref_list[j][i].reference & 3);

libavcodec/h264_slice.c:1704:1: <Length trace>
1702. /* do all the per-slice initialization needed before we can start decoding the
1703.  * actual MBs */
1704. static int h264_slice_init(H264Context *h, H264SliceContext *sl,
      ^
1705.                            const H2645NAL *nal)
1706. {

libavcodec/h264_slice.c:1704:1: Parameter `h->ref2frm[*][*]`
1702. /* do all the per-slice initialization needed before we can start decoding the
1703.  * actual MBs */
1704. static int h264_slice_init(H264Context *h, H264SliceContext *sl,
      ^
1705.                            const H2645NAL *nal)
1706. {

libavcodec/h264_slice.c:1797:9: Assignment
1795.     for (j = 0; j < 2; j++) {
1796.         int id_list[16];
1797.         int *ref2frm = h->ref2frm[sl->slice_num & (MAX_SLICES - 1)][j];
              ^
1798.         for (i = 0; i < 16; i++) {
1799.             id_list[i] = 60;

libavcodec/h264_slice.c:1824:13: Array access: Offset: [20, 51] Size: 2
1822.         ref2frm[18 + 1] = -1;
1823.         for (i = 16; i < 48; i++)
1824.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
                  ^
1825.                              (sl->ref_list[j][i].reference & 3);
1826.     }

static int h264_slice_init(H264Context *h, H264SliceContext *sl,
                           const H2645NAL *nal)
{
    int i, j, ret = 0;
    if (h->current_slice > 0) {
        if (h->ps.pps != (const PPS*)h->ps.pps_list[sl->pps_id]->data) {
            av_log(h->avctx, AV_LOG_ERROR, "PPS changed between slices\n");
            return AVERROR_INVALIDDATA;
        }
        if (h->picture_structure != sl->picture_structure ||
            h->droppable         != (nal->ref_idc == 0)) {
            av_log(h->avctx, AV_LOG_ERROR,
                   "Changing field mode (%d -> %d) between slices is not allowed\n",
                   h->picture_structure, sl->picture_structure);
            return AVERROR_INVALIDDATA;
        } else if (!h->cur_pic_ptr) {
            av_log(h->avctx, AV_LOG_ERROR,
                   "unset cur_pic_ptr on slice %d\n",
                   h->current_slice + 1);
            return AVERROR_INVALIDDATA;
        }
    }
    if (h->picture_idr && nal->type != H264_NAL_IDR_SLICE) {
        av_log(h->avctx, AV_LOG_ERROR, "Invalid mix of IDR and non-IDR slices\n");
        return AVERROR_INVALIDDATA;
    }
    assert(h->mb_num == h->mb_width * h->mb_height);
    if (sl->first_mb_addr << FIELD_OR_MBAFF_PICTURE(h) >= h->mb_num ||
        sl->first_mb_addr >= h->mb_num) {
        av_log(h->avctx, AV_LOG_ERROR, "first_mb_in_slice overflow\n");
        return AVERROR_INVALIDDATA;
    }
    sl->resync_mb_x = sl->mb_x =  sl->first_mb_addr % h->mb_width;
    sl->resync_mb_y = sl->mb_y = (sl->first_mb_addr / h->mb_width) <<
                                 FIELD_OR_MBAFF_PICTURE(h);
    if (h->picture_structure == PICT_BOTTOM_FIELD)
        sl->resync_mb_y = sl->mb_y = sl->mb_y + 1;
    assert(sl->mb_y < h->mb_height);
    ret = ff_h264_build_ref_list(h, sl);
    if (ret < 0)
        return ret;
    if (h->ps.pps->weighted_bipred_idc == 2 &&
        sl->slice_type_nos == AV_PICTURE_TYPE_B) {
        implicit_weight_table(h, sl, -1);
        if (FRAME_MBAFF(h)) {
            implicit_weight_table(h, sl, 0);
            implicit_weight_table(h, sl, 1);
        }
    }
    if (sl->slice_type_nos == AV_PICTURE_TYPE_B && !sl->direct_spatial_mv_pred)
        ff_h264_direct_dist_scale_factor(h, sl);
    ff_h264_direct_ref_list_init(h, sl);
    if (h->avctx->skip_loop_filter >= AVDISCARD_ALL ||
        (h->avctx->skip_loop_filter >= AVDISCARD_NONKEY &&
         sl->slice_type_nos != AV_PICTURE_TYPE_I) ||
        (h->avctx->skip_loop_filter >= AVDISCARD_BIDIR  &&
         sl->slice_type_nos == AV_PICTURE_TYPE_B) ||
        (h->avctx->skip_loop_filter >= AVDISCARD_NONREF &&
         nal->ref_idc == 0))
        sl->deblocking_filter = 0;
    if (sl->deblocking_filter == 1 && h->nb_slice_ctx > 1) {
        if (h->avctx->flags2 & AV_CODEC_FLAG2_FAST) {
            sl->deblocking_filter = 2;
        } else {
            h->postpone_filter = 1;
        }
    }
    sl->qp_thresh = 15 -
                   FFMIN(sl->slice_alpha_c0_offset, sl->slice_beta_offset) -
                   FFMAX3(0,
                          h->ps.pps->chroma_qp_index_offset[0],
                          h->ps.pps->chroma_qp_index_offset[1]) +
                   6 * (h->ps.sps->bit_depth_luma - 8);
    sl->slice_num       = ++h->current_slice;
    if (sl->slice_num >= MAX_SLICES) {
        av_log(h->avctx, AV_LOG_ERROR,
               "Too many slices, increase MAX_SLICES and recompile\n");
    }
    for (j = 0; j < 2; j++) {
        int id_list[16];
        int *ref2frm = h->ref2frm[sl->slice_num & (MAX_SLICES - 1)][j];
        for (i = 0; i < 16; i++) {
            id_list[i] = 60;
            if (j < sl->list_count && i < sl->ref_count[j] &&
                sl->ref_list[j][i].parent->f->buf[0]) {
                int k;
                AVBuffer *buf = sl->ref_list[j][i].parent->f->buf[0]->buffer;
                for (k = 0; k < h->short_ref_count; k++)
                    if (h->short_ref[k]->f->buf[0]->buffer == buf) {
                        id_list[i] = k;
                        break;
                    }
                for (k = 0; k < h->long_ref_count; k++)
                    if (h->long_ref[k] && h->long_ref[k]->f->buf[0]->buffer == buf) {
                        id_list[i] = h->short_ref_count + k;
                        break;
                    }
            }
        }
        ref2frm[0] =
        ref2frm[1] = -1;
        for (i = 0; i < 16; i++)
            ref2frm[i + 2] = 4 * id_list[i] + (sl->ref_list[j][i].reference & 3);
        ref2frm[18 + 0] =
        ref2frm[18 + 1] = -1;
        for (i = 16; i < 48; i++)
            ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
                             (sl->ref_list[j][i].reference & 3);
    }
    if (h->avctx->debug & FF_DEBUG_PICT_INFO) {
        av_log(h->avctx, AV_LOG_DEBUG,
               "slice:%d %s mb:%d %c%s%s frame:%d poc:%d/%d ref:%d/%d qp:%d loop:%d:%d:%d weight:%d%s %s\n",
               sl->slice_num,
               (h->picture_structure == PICT_FRAME ? "F" : h->picture_structure == PICT_TOP_FIELD ? "T" : "B"),
               sl->mb_y * h->mb_width + sl->mb_x,
               av_get_picture_type_char(sl->slice_type),
               sl->slice_type_fixed ? " fix" : "",
               nal->type == H264_NAL_IDR_SLICE ? " IDR" : "",
               h->poc.frame_num,
               h->cur_pic_ptr->field_poc[0],
               h->cur_pic_ptr->field_poc[1],
               sl->ref_count[0], sl->ref_count[1],
               sl->qscale,
               sl->deblocking_filter,
               sl->slice_alpha_c0_offset, sl->slice_beta_offset,
               sl->pwt.use_weight,
               sl->pwt.use_weight == 1 && sl->pwt.use_weight_chroma ? "c" : "",
               sl->slice_type == AV_PICTURE_TYPE_B ? (sl->direct_spatial_mv_pred ? "SPAT" : "TEMP") : "");
    }
    return 0;
}
['static int h264_slice_init(H264Context *h, H264SliceContext *sl,\n                           const H2645NAL *nal)\n{\n    int i, j, ret = 0;\n    if (h->current_slice > 0) {\n        if (h->ps.pps != (const PPS*)h->ps.pps_list[sl->pps_id]->data) {\n            av_log(h->avctx, AV_LOG_ERROR, "PPS changed between slices\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        if (h->picture_structure != sl->picture_structure ||\n            h->droppable         != (nal->ref_idc == 0)) {\n            av_log(h->avctx, AV_LOG_ERROR,\n                   "Changing field mode (%d -> %d) between slices is not allowed\\n",\n                   h->picture_structure, sl->picture_structure);\n            return AVERROR_INVALIDDATA;\n        } else if (!h->cur_pic_ptr) {\n            av_log(h->avctx, AV_LOG_ERROR,\n                   "unset cur_pic_ptr on slice %d\\n",\n                   h->current_slice + 1);\n            return AVERROR_INVALIDDATA;\n        }\n    }\n    if (h->picture_idr && nal->type != H264_NAL_IDR_SLICE) {\n        av_log(h->avctx, AV_LOG_ERROR, "Invalid mix of IDR and non-IDR slices\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    assert(h->mb_num == h->mb_width * h->mb_height);\n    if (sl->first_mb_addr << FIELD_OR_MBAFF_PICTURE(h) >= h->mb_num ||\n        sl->first_mb_addr >= h->mb_num) {\n        av_log(h->avctx, AV_LOG_ERROR, "first_mb_in_slice overflow\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    sl->resync_mb_x = sl->mb_x =  sl->first_mb_addr % h->mb_width;\n    sl->resync_mb_y = sl->mb_y = (sl->first_mb_addr / h->mb_width) <<\n                                 FIELD_OR_MBAFF_PICTURE(h);\n    if (h->picture_structure == PICT_BOTTOM_FIELD)\n        sl->resync_mb_y = sl->mb_y = sl->mb_y + 1;\n    assert(sl->mb_y < h->mb_height);\n    ret = ff_h264_build_ref_list(h, sl);\n    if (ret < 0)\n        return ret;\n    if (h->ps.pps->weighted_bipred_idc == 2 &&\n        sl->slice_type_nos == AV_PICTURE_TYPE_B) {\n        implicit_weight_table(h, sl, -1);\n        if (FRAME_MBAFF(h)) {\n            implicit_weight_table(h, sl, 0);\n            implicit_weight_table(h, sl, 1);\n        }\n    }\n    if (sl->slice_type_nos == AV_PICTURE_TYPE_B && !sl->direct_spatial_mv_pred)\n        ff_h264_direct_dist_scale_factor(h, sl);\n    ff_h264_direct_ref_list_init(h, sl);\n    if (h->avctx->skip_loop_filter >= AVDISCARD_ALL ||\n        (h->avctx->skip_loop_filter >= AVDISCARD_NONKEY &&\n         sl->slice_type_nos != AV_PICTURE_TYPE_I) ||\n        (h->avctx->skip_loop_filter >= AVDISCARD_BIDIR  &&\n         sl->slice_type_nos == AV_PICTURE_TYPE_B) ||\n        (h->avctx->skip_loop_filter >= AVDISCARD_NONREF &&\n         nal->ref_idc == 0))\n        sl->deblocking_filter = 0;\n    if (sl->deblocking_filter == 1 && h->nb_slice_ctx > 1) {\n        if (h->avctx->flags2 & AV_CODEC_FLAG2_FAST) {\n            sl->deblocking_filter = 2;\n        } else {\n            h->postpone_filter = 1;\n        }\n    }\n    sl->qp_thresh = 15 -\n                   FFMIN(sl->slice_alpha_c0_offset, sl->slice_beta_offset) -\n                   FFMAX3(0,\n                          h->ps.pps->chroma_qp_index_offset[0],\n                          h->ps.pps->chroma_qp_index_offset[1]) +\n                   6 * (h->ps.sps->bit_depth_luma - 8);\n    sl->slice_num       = ++h->current_slice;\n    if (sl->slice_num >= MAX_SLICES) {\n        av_log(h->avctx, AV_LOG_ERROR,\n               "Too many slices, increase MAX_SLICES and recompile\\n");\n    }\n    for (j = 0; j < 2; j++) {\n        int id_list[16];\n        int *ref2frm = h->ref2frm[sl->slice_num & (MAX_SLICES - 1)][j];\n        for (i = 0; i < 16; i++) {\n            id_list[i] = 60;\n            if (j < sl->list_count && i < sl->ref_count[j] &&\n                sl->ref_list[j][i].parent->f->buf[0]) {\n                int k;\n                AVBuffer *buf = sl->ref_list[j][i].parent->f->buf[0]->buffer;\n                for (k = 0; k < h->short_ref_count; k++)\n                    if (h->short_ref[k]->f->buf[0]->buffer == buf) {\n                        id_list[i] = k;\n                        break;\n                    }\n                for (k = 0; k < h->long_ref_count; k++)\n                    if (h->long_ref[k] && h->long_ref[k]->f->buf[0]->buffer == buf) {\n                        id_list[i] = h->short_ref_count + k;\n                        break;\n                    }\n            }\n        }\n        ref2frm[0] =\n        ref2frm[1] = -1;\n        for (i = 0; i < 16; i++)\n            ref2frm[i + 2] = 4 * id_list[i] + (sl->ref_list[j][i].reference & 3);\n        ref2frm[18 + 0] =\n        ref2frm[18 + 1] = -1;\n        for (i = 16; i < 48; i++)\n            ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +\n                             (sl->ref_list[j][i].reference & 3);\n    }\n    if (h->avctx->debug & FF_DEBUG_PICT_INFO) {\n        av_log(h->avctx, AV_LOG_DEBUG,\n               "slice:%d %s mb:%d %c%s%s frame:%d poc:%d/%d ref:%d/%d qp:%d loop:%d:%d:%d weight:%d%s %s\\n",\n               sl->slice_num,\n               (h->picture_structure == PICT_FRAME ? "F" : h->picture_structure == PICT_TOP_FIELD ? "T" : "B"),\n               sl->mb_y * h->mb_width + sl->mb_x,\n               av_get_picture_type_char(sl->slice_type),\n               sl->slice_type_fixed ? " fix" : "",\n               nal->type == H264_NAL_IDR_SLICE ? " IDR" : "",\n               h->poc.frame_num,\n               h->cur_pic_ptr->field_poc[0],\n               h->cur_pic_ptr->field_poc[1],\n               sl->ref_count[0], sl->ref_count[1],\n               sl->qscale,\n               sl->deblocking_filter,\n               sl->slice_alpha_c0_offset, sl->slice_beta_offset,\n               sl->pwt.use_weight,\n               sl->pwt.use_weight == 1 && sl->pwt.use_weight_chroma ? "c" : "",\n               sl->slice_type == AV_PICTURE_TYPE_B ? (sl->direct_spatial_mv_pred ? "SPAT" : "TEMP") : "");\n    }\n    return 0;\n}']