libavcodec/h264dec.c:883: error: Buffer Overrun L2
  Offset: [8, 2147483648] Size: 64 by call to `decode_nal_units`.

libavcodec/h264dec.c:883:17: Call
881.     }
882. 
883.     buf_index = decode_nal_units(h, buf, buf_size);
                     ^
884.     if (buf_index < 0)
885.         return AVERROR_INVALIDDATA;

libavcodec/h264dec.c:670:11: Call
  668.     }
  669. 
  670.     ret = ff_h2645_packet_split(&h->pkt, buf, buf_size, avctx, h->is_avc,
                 ^
  671.                                 h->nal_length_size, avctx->codec_id);
  672.     if (ret < 0) {

libavcodec/h2645_parse.c:299:15: Call
    297.         nal->size_bits = get_bit_length(nal, skip_trailing_zeros);
    298. 
    299.         ret = init_get_bits(&nal->gb, nal->data, nal->size_bits);
                       ^
    300.         if (ret < 0)
    301.             return ret;

libavcodec/get_bits.h:362:1: Parameter `bit_size`
      360.  * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
      361.  */
      362. static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
           ^
      363.                                 int bit_size)
      364. {

libavcodec/get_bits.h:379:5: Assignment
      377.     s->size_in_bits       = bit_size;
      378. #if !UNCHECKED_BITSTREAM_READER
      379.     s->size_in_bits_plus8 = bit_size + 8;
               ^
      380. #endif
      381.     s->buffer_end         = buffer + buffer_size;

libavcodec/h264dec.c:883:17: Call
881.     }
882. 
883.     buf_index = decode_nal_units(h, buf, buf_size);
                     ^
884.     if (buf_index < 0)
885.         return AVERROR_INVALIDDATA;

libavcodec/h264dec.c:656:1: Parameter `*h->cur_pic.qscale_table`
  654. }
  655. 
  656. static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size)
       ^
  657. {
  658.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264dec.c:774:15: Call
  772.     }
  773.     if (context_count) {
  774.         ret = ff_h264_execute_decode_slices(h, context_count);
                     ^
  775.         if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE))
  776.             goto end;

libavcodec/h264_slice.c:2322:1: Parameter `*h->cur_pic.qscale_table`
    2320.  * @param context_count number of contexts to execute
    2321.  */
    2322. int ff_h264_execute_decode_slices(H264Context *h, unsigned context_count)
          ^
    2323. {
    2324.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264_slice.c:2381:21: Call
    2379.                 for (j = sl->resync_mb_y; j < y_end; j += 1 + FIELD_OR_MBAFF_PICTURE(h)) {
    2380.                     sl->mb_y = j;
    2381.                     loop_filter(h, sl, j > sl->resync_mb_y ? 0 : sl->resync_mb_x,
                              ^
    2382.                                 j == y_end - 1 ? x_end : h->mb_width);
    2383.                 }

libavcodec/h264_slice.c:1998:1: Parameter `*h->cur_pic.qscale_table`
      1996. }
      1997. 
      1998. static void loop_filter(const H264Context *h, H264SliceContext *sl, int start_x, int end_x)
            ^
      1999. {
      2000.     uint8_t *dest_y, *dest_cb, *dest_cr;

libavcodec/h264_slice.c:2049:36: Call
      2047.                 if (fill_filter_caches(h, sl, mb_type))
      2048.                     continue;
      2049.                 sl->chroma_qp[0] = get_chroma_qp(h->ps.pps, 0, h->cur_pic.qscale_table[mb_xy]);
                                               ^
      2050.                 sl->chroma_qp[1] = get_chroma_qp(h->ps.pps, 1, h->cur_pic.qscale_table[mb_xy]);
      2051. 

libavcodec/h264dec.h:651:1: <Offset trace>
649.  * Get the chroma qp.
650.  */
651. static av_always_inline int get_chroma_qp(const PPS *pps, int t, int qscale)
     ^
652. {
653.     return pps->chroma_qp_table[t][qscale];

libavcodec/h264dec.h:651:1: Parameter `qscale`
        649.  * Get the chroma qp.
        650.  */
        651. static av_always_inline int get_chroma_qp(const PPS *pps, int t, int qscale)
             ^
        652. {
        653.     return pps->chroma_qp_table[t][qscale];

libavcodec/h264dec.h:651:1: <Length trace>
649.  * Get the chroma qp.
650.  */
651. static av_always_inline int get_chroma_qp(const PPS *pps, int t, int qscale)
     ^
652. {
653.     return pps->chroma_qp_table[t][qscale];

libavcodec/h264dec.h:651:1: Parameter `pps->chroma_qp_table[*][*]`
        649.  * Get the chroma qp.
        650.  */
        651. static av_always_inline int get_chroma_qp(const PPS *pps, int t, int qscale)
             ^
        652. {
        653.     return pps->chroma_qp_table[t][qscale];

libavcodec/h264dec.h:653:12: Array access: Offset: [8, 2147483648] Size: 64 by call to `decode_nal_units` 
        651. static av_always_inline int get_chroma_qp(const PPS *pps, int t, int qscale)
        652. {
        653.     return pps->chroma_qp_table[t][qscale];
                        ^
        654. }
        655. 

static av_always_inline int get_chroma_qp(const PPS *pps, int t, int qscale)
{
    return pps->chroma_qp_table[t][qscale];
}
['static int h264_decode_frame(AVCodecContext *avctx, void *data,\n                             int *got_frame, AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size       = avpkt->size;\n    H264Context *h     = avctx->priv_data;\n    AVFrame *pict      = data;\n    int buf_index      = 0;\n    int ret;\n    const uint8_t *new_extradata;\n    int new_extradata_size;\n    h->flags = avctx->flags;\n    h->setup_finished = 0;\nout:\n    if (buf_size == 0) {\n        H264Picture *out;\n        int i, out_idx;\n        h->cur_pic_ptr = NULL;\n        out     = h->delayed_pic[0];\n        out_idx = 0;\n        for (i = 1;\n             h->delayed_pic[i] &&\n             !h->delayed_pic[i]->f->key_frame &&\n             !h->delayed_pic[i]->mmco_reset;\n             i++)\n            if (h->delayed_pic[i]->poc < out->poc) {\n                out     = h->delayed_pic[i];\n                out_idx = i;\n            }\n        for (i = out_idx; h->delayed_pic[i]; i++)\n            h->delayed_pic[i] = h->delayed_pic[i + 1];\n        if (out) {\n            ret = output_frame(h, pict, out->f);\n            if (ret < 0)\n                return ret;\n            *got_frame = 1;\n        }\n        return buf_index;\n    }\n    new_extradata_size = 0;\n    new_extradata = av_packet_get_side_data(avpkt, AV_PKT_DATA_NEW_EXTRADATA,\n                                            &new_extradata_size);\n    if (new_extradata_size > 0 && new_extradata) {\n        ret = ff_h264_decode_extradata(new_extradata, new_extradata_size,\n                                       &h->ps, &h->is_avc, &h->nal_length_size,\n                                       avctx->err_recognition, avctx);\n        if (ret < 0)\n            return ret;\n    }\n    buf_index = decode_nal_units(h, buf, buf_size);\n    if (buf_index < 0)\n        return AVERROR_INVALIDDATA;\n    if (!h->cur_pic_ptr && h->nal_unit_type == H264_NAL_END_SEQUENCE) {\n        buf_size = 0;\n        goto out;\n    }\n    if (!(avctx->flags2 & AV_CODEC_FLAG2_CHUNKS) && !h->cur_pic_ptr) {\n        if (avctx->skip_frame >= AVDISCARD_NONREF)\n            return 0;\n        av_log(avctx, AV_LOG_ERROR, "no frame!\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (!(avctx->flags2 & AV_CODEC_FLAG2_CHUNKS) ||\n        (h->mb_y >= h->mb_height && h->mb_height)) {\n        if (avctx->flags2 & AV_CODEC_FLAG2_CHUNKS)\n            decode_postinit(h, 1);\n        ff_h264_field_end(h, &h->slice_ctx[0], 0);\n        *got_frame = 0;\n        if (h->next_output_pic && ((avctx->flags & AV_CODEC_FLAG_OUTPUT_CORRUPT) ||\n                                   h->next_output_pic->recovered)) {\n            if (!h->next_output_pic->recovered)\n                h->next_output_pic->f->flags |= AV_FRAME_FLAG_CORRUPT;\n            ret = output_frame(h, pict, h->next_output_pic->f);\n            if (ret < 0)\n                return ret;\n            *got_frame = 1;\n        }\n    }\n    assert(pict->buf[0] || !*got_frame);\n    return get_consumed_bytes(buf_index, buf_size);\n}', 'static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size)\n{\n    AVCodecContext *const avctx = h->avctx;\n    unsigned context_count = 0;\n    int nals_needed = 0;\n    int i, ret = 0;\n    if (!(avctx->flags2 & AV_CODEC_FLAG2_CHUNKS)) {\n        h->current_slice = 0;\n        if (!h->first_field)\n            h->cur_pic_ptr = NULL;\n        ff_h264_sei_uninit(&h->sei);\n    }\n    ret = ff_h2645_packet_split(&h->pkt, buf, buf_size, avctx, h->is_avc,\n                                h->nal_length_size, avctx->codec_id);\n    if (ret < 0) {\n        av_log(avctx, AV_LOG_ERROR,\n               "Error splitting the input into NAL units.\\n");\n        return ret;\n    }\n    if (avctx->active_thread_type & FF_THREAD_FRAME)\n        nals_needed = get_last_needed_nal(h);\n    for (i = 0; i < h->pkt.nb_nals; i++) {\n        H2645NAL *nal = &h->pkt.nals[i];\n        H264SliceContext *sl = &h->slice_ctx[context_count];\n        int err;\n        if (avctx->skip_frame >= AVDISCARD_NONREF &&\n            nal->ref_idc == 0 && nal->type != H264_NAL_SEI)\n            continue;\n        h->nal_ref_idc   = nal->ref_idc;\n        h->nal_unit_type = nal->type;\n        err = 0;\n        switch (nal->type) {\n        case H264_NAL_IDR_SLICE:\n            idr(h);\n        case H264_NAL_SLICE:\n            sl->gb = nal->gb;\n            if ((err = ff_h264_decode_slice_header(h, sl, nal)))\n                break;\n            if (sl->redundant_pic_count > 0)\n                break;\n            if (h->current_slice == 1) {\n                if (!(avctx->flags2 & AV_CODEC_FLAG2_CHUNKS))\n                    decode_postinit(h, i >= nals_needed);\n            }\n            if ((avctx->skip_frame < AVDISCARD_NONREF || nal->ref_idc) &&\n                (avctx->skip_frame < AVDISCARD_BIDIR  ||\n                 sl->slice_type_nos != AV_PICTURE_TYPE_B) &&\n                (avctx->skip_frame < AVDISCARD_NONKEY ||\n                 h->cur_pic_ptr->f->key_frame) &&\n                avctx->skip_frame < AVDISCARD_ALL) {\n                if (avctx->hwaccel) {\n                    ret = avctx->hwaccel->decode_slice(avctx, nal->raw_data, nal->raw_size);\n                    if (ret < 0)\n                        return ret;\n                } else\n                    context_count++;\n            }\n            break;\n        case H264_NAL_DPA:\n        case H264_NAL_DPB:\n        case H264_NAL_DPC:\n            avpriv_request_sample(avctx, "data partitioning");\n            ret = AVERROR(ENOSYS);\n            goto end;\n            break;\n        case H264_NAL_SEI:\n            ret = ff_h264_sei_decode(&h->sei, &nal->gb, &h->ps, avctx);\n            if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE))\n                goto end;\n            break;\n        case H264_NAL_SPS:\n            ret = ff_h264_decode_seq_parameter_set(&nal->gb, avctx, &h->ps);\n            if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE))\n                goto end;\n            break;\n        case H264_NAL_PPS:\n            ret = ff_h264_decode_picture_parameter_set(&nal->gb, avctx, &h->ps,\n                                                       nal->size_bits);\n            if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE))\n                goto end;\n            break;\n        case H264_NAL_AUD:\n        case H264_NAL_END_SEQUENCE:\n        case H264_NAL_END_STREAM:\n        case H264_NAL_FILLER_DATA:\n        case H264_NAL_SPS_EXT:\n        case H264_NAL_AUXILIARY_SLICE:\n            break;\n        default:\n            av_log(avctx, AV_LOG_DEBUG, "Unknown NAL code: %d (%d bits)\\n",\n                   nal->type, nal->size_bits);\n        }\n        if (context_count == h->nb_slice_ctx) {\n            ret = ff_h264_execute_decode_slices(h, context_count);\n            if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE))\n                goto end;\n            context_count = 0;\n        }\n        if (err < 0) {\n            av_log(h->avctx, AV_LOG_ERROR, "decode_slice_header error\\n");\n            sl->ref_count[0] = sl->ref_count[1] = sl->list_count = 0;\n        }\n    }\n    if (context_count) {\n        ret = ff_h264_execute_decode_slices(h, context_count);\n        if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE))\n            goto end;\n    }\n    ret = 0;\nend:\n    if (h->cur_pic_ptr && !h->droppable) {\n        ff_thread_report_progress(&h->cur_pic_ptr->tf, INT_MAX,\n                                  h->picture_structure == PICT_BOTTOM_FIELD);\n    }\n    return (ret < 0) ? ret : buf_size;\n}', 'int ff_h2645_packet_split(H2645Packet *pkt, const uint8_t *buf, int length,\n                          void *logctx, int is_nalff, int nal_length_size,\n                          enum AVCodecID codec_id)\n{\n    int consumed, ret = 0;\n    const uint8_t *next_avc = buf + (is_nalff ? 0 : length);\n    pkt->nb_nals = 0;\n    while (length >= 4) {\n        H2645NAL *nal;\n        int extract_length = 0;\n        int skip_trailing_zeros = 1;\n        if (buf == next_avc) {\n            int i;\n            for (i = 0; i < nal_length_size; i++)\n                extract_length = (extract_length << 8) | buf[i];\n            if (extract_length > length) {\n                av_log(logctx, AV_LOG_ERROR, "Invalid NAL unit size.\\n");\n                return AVERROR_INVALIDDATA;\n            }\n            buf     += nal_length_size;\n            length  -= nal_length_size;\n            next_avc = buf + extract_length;\n        } else {\n            int buf_index = find_next_start_code(buf, next_avc);\n            buf    += buf_index;\n            length -= buf_index;\n            if (buf == next_avc)\n                continue;\n            if (length > 0) {\n                extract_length = length;\n            } else if (pkt->nb_nals == 0) {\n                av_log(logctx, AV_LOG_ERROR, "No NAL unit found\\n");\n                return AVERROR_INVALIDDATA;\n            } else {\n                break;\n            }\n        }\n        if (pkt->nals_allocated < pkt->nb_nals + 1) {\n            int new_size = pkt->nals_allocated + 1;\n            H2645NAL *tmp = av_realloc_array(pkt->nals, new_size, sizeof(*tmp));\n            if (!tmp)\n                return AVERROR(ENOMEM);\n            pkt->nals = tmp;\n            memset(pkt->nals + pkt->nals_allocated, 0,\n                   (new_size - pkt->nals_allocated) * sizeof(*tmp));\n            pkt->nals_allocated = new_size;\n        }\n        nal = &pkt->nals[pkt->nb_nals++];\n        consumed = ff_h2645_extract_rbsp(buf, extract_length, nal);\n        if (consumed < 0)\n            return consumed;\n        if (consumed < length - 3 &&\n            buf[consumed]     == 0x00 && buf[consumed + 1] == 0x00 &&\n            buf[consumed + 2] == 0x01 && buf[consumed + 3] == 0xE0)\n            skip_trailing_zeros = 0;\n        nal->size_bits = get_bit_length(nal, skip_trailing_zeros);\n        ret = init_get_bits(&nal->gb, nal->data, nal->size_bits);\n        if (ret < 0)\n            return ret;\n        if (codec_id == AV_CODEC_ID_HEVC)\n            ret = hevc_parse_nal_header(nal, logctx);\n        else\n            ret = h264_parse_nal_header(nal, logctx);\n        if (ret <= 0) {\n            if (ret < 0) {\n                av_log(logctx, AV_LOG_ERROR, "Invalid NAL unit %d, skipping.\\n",\n                       nal->type);\n            }\n            pkt->nb_nals--;\n        }\n        buf    += consumed;\n        length -= consumed;\n    }\n    return 0;\n}', 'static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,\n                                int bit_size)\n{\n    int buffer_size;\n    int ret = 0;\n    if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {\n        bit_size    = 0;\n        buffer      = NULL;\n        ret         = AVERROR_INVALIDDATA;\n    }\n    buffer_size = (bit_size + 7) >> 3;\n    s->buffer             = buffer;\n    s->size_in_bits       = bit_size;\n#if !UNCHECKED_BITSTREAM_READER\n    s->size_in_bits_plus8 = bit_size + 8;\n#endif\n    s->buffer_end         = buffer + buffer_size;\n    s->index              = 0;\n    return ret;\n}', 'int ff_h264_execute_decode_slices(H264Context *h, unsigned context_count)\n{\n    AVCodecContext *const avctx = h->avctx;\n    H264SliceContext *sl;\n    int i, j;\n    if (h->avctx->hwaccel)\n        return 0;\n    if (context_count == 1) {\n        int ret;\n        h->slice_ctx[0].next_slice_idx = h->mb_width * h->mb_height;\n        h->postpone_filter = 0;\n        ret = decode_slice(avctx, &h->slice_ctx[0]);\n        h->mb_y = h->slice_ctx[0].mb_y;\n        return ret;\n    } else {\n        for (i = 0; i < context_count; i++) {\n            int next_slice_idx = h->mb_width * h->mb_height;\n            int slice_idx;\n            sl                 = &h->slice_ctx[i];\n            sl->er.error_count = 0;\n            slice_idx = sl->mb_y * h->mb_width + sl->mb_x;\n            for (j = 0; j < context_count; j++) {\n                H264SliceContext *sl2 = &h->slice_ctx[j];\n                int        slice_idx2 = sl2->mb_y * h->mb_width + sl2->mb_x;\n                if (i == j || slice_idx2 < slice_idx)\n                    continue;\n                next_slice_idx = FFMIN(next_slice_idx, slice_idx2);\n            }\n            sl->next_slice_idx = next_slice_idx;\n        }\n        avctx->execute(avctx, decode_slice, h->slice_ctx,\n                       NULL, context_count, sizeof(h->slice_ctx[0]));\n        sl                   = &h->slice_ctx[context_count - 1];\n        h->mb_y              = sl->mb_y;\n        for (i = 1; i < context_count; i++)\n            h->slice_ctx[0].er.error_count += h->slice_ctx[i].er.error_count;\n        if (h->postpone_filter) {\n            h->postpone_filter = 0;\n            for (i = 0; i < context_count; i++) {\n                int y_end, x_end;\n                sl = &h->slice_ctx[i];\n                y_end = FFMIN(sl->mb_y + 1, h->mb_height);\n                x_end = (sl->mb_y >= h->mb_height) ? h->mb_width : sl->mb_x;\n                for (j = sl->resync_mb_y; j < y_end; j += 1 + FIELD_OR_MBAFF_PICTURE(h)) {\n                    sl->mb_y = j;\n                    loop_filter(h, sl, j > sl->resync_mb_y ? 0 : sl->resync_mb_x,\n                                j == y_end - 1 ? x_end : h->mb_width);\n                }\n            }\n        }\n    }\n    return 0;\n}', 'static void loop_filter(const H264Context *h, H264SliceContext *sl, int start_x, int end_x)\n{\n    uint8_t *dest_y, *dest_cb, *dest_cr;\n    int linesize, uvlinesize, mb_x, mb_y;\n    const int end_mb_y       = sl->mb_y + FRAME_MBAFF(h);\n    const int old_slice_type = sl->slice_type;\n    const int pixel_shift    = h->pixel_shift;\n    const int block_h        = 16 >> h->chroma_y_shift;\n    if (h->postpone_filter)\n        return;\n    if (sl->deblocking_filter) {\n        for (mb_x = start_x; mb_x < end_x; mb_x++)\n            for (mb_y = end_mb_y - FRAME_MBAFF(h); mb_y <= end_mb_y; mb_y++) {\n                int mb_xy, mb_type;\n                mb_xy         = sl->mb_xy = mb_x + mb_y * h->mb_stride;\n                mb_type       = h->cur_pic.mb_type[mb_xy];\n                if (FRAME_MBAFF(h))\n                    sl->mb_mbaff               =\n                    sl->mb_field_decoding_flag = !!IS_INTERLACED(mb_type);\n                sl->mb_x = mb_x;\n                sl->mb_y = mb_y;\n                dest_y  = h->cur_pic.f->data[0] +\n                          ((mb_x << pixel_shift) + mb_y * sl->linesize) * 16;\n                dest_cb = h->cur_pic.f->data[1] +\n                          (mb_x << pixel_shift) * (8 << CHROMA444(h)) +\n                          mb_y * sl->uvlinesize * block_h;\n                dest_cr = h->cur_pic.f->data[2] +\n                          (mb_x << pixel_shift) * (8 << CHROMA444(h)) +\n                          mb_y * sl->uvlinesize * block_h;\n                if (MB_FIELD(sl)) {\n                    linesize   = sl->mb_linesize   = sl->linesize   * 2;\n                    uvlinesize = sl->mb_uvlinesize = sl->uvlinesize * 2;\n                    if (mb_y & 1) {\n                        dest_y  -= sl->linesize   * 15;\n                        dest_cb -= sl->uvlinesize * (block_h - 1);\n                        dest_cr -= sl->uvlinesize * (block_h - 1);\n                    }\n                } else {\n                    linesize   = sl->mb_linesize   = sl->linesize;\n                    uvlinesize = sl->mb_uvlinesize = sl->uvlinesize;\n                }\n                backup_mb_border(h, sl, dest_y, dest_cb, dest_cr, linesize,\n                                 uvlinesize, 0);\n                if (fill_filter_caches(h, sl, mb_type))\n                    continue;\n                sl->chroma_qp[0] = get_chroma_qp(h->ps.pps, 0, h->cur_pic.qscale_table[mb_xy]);\n                sl->chroma_qp[1] = get_chroma_qp(h->ps.pps, 1, h->cur_pic.qscale_table[mb_xy]);\n                if (FRAME_MBAFF(h)) {\n                    ff_h264_filter_mb(h, sl, mb_x, mb_y, dest_y, dest_cb, dest_cr,\n                                      linesize, uvlinesize);\n                } else {\n                    ff_h264_filter_mb_fast(h, sl, mb_x, mb_y, dest_y, dest_cb,\n                                           dest_cr, linesize, uvlinesize);\n                }\n            }\n    }\n    sl->slice_type  = old_slice_type;\n    sl->mb_x         = end_x;\n    sl->mb_y         = end_mb_y - FRAME_MBAFF(h);\n    sl->chroma_qp[0] = get_chroma_qp(h->ps.pps, 0, sl->qscale);\n    sl->chroma_qp[1] = get_chroma_qp(h->ps.pps, 1, sl->qscale);\n}', 'static av_always_inline int get_chroma_qp(const PPS *pps, int t, int qscale)\n{\n    return pps->chroma_qp_table[t][qscale];\n}']