libavcodec/h264_parser.c:261: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: 16 by call to `ff_h264_decode_extradata`.

libavcodec/h264_parser.c:261:13: Call
259.             if (!avctx->has_b_frames)
260.                 h->s.low_delay = 1;
261.             ff_h264_decode_extradata(h);
                 ^
262.         }
263.     }

libavcodec/h264.c:1046:1: Parameter `h->s.slice_context_count`
  1044. }
  1045. 
  1046. int ff_h264_decode_extradata(H264Context *h)
        ^
  1047. {
  1048.     AVCodecContext *avctx = h->s.avctx;

libavcodec/h264.c:1092:12: Call
  1090.     } else {
  1091.         h->is_avc = 0;
  1092.         if(decode_nal_units(h, avctx->extradata, avctx->extradata_size) < 0)
                   ^
  1093.             return -1;
  1094.     }

libavcodec/h264.c:3754:9: Assignment
    3752.     for(;pass <= 1;pass++){
    3753.         buf_index = 0;
    3754.         context_count = 0;
                  ^
    3755.         next_avc = h->is_avc ? 0 : buf_size;
    3756.         nal_index = 0;

libavcodec/h264.c:3969:13: Call
    3967. 
    3968.         if(context_count == h->max_contexts) {
    3969.             execute_decode_slices(h, context_count);
                      ^
    3970.             context_count = 0;
    3971.         }

libavcodec/h264.c:3699:1: <Offset trace>
3697.  * @param context_count number of contexts to execute
3698.  */
3699. static int execute_decode_slices(H264Context *h, int context_count){
      ^
3700.     MpegEncContext * const s = &h->s;
3701.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:3699:1: Parameter `context_count`
      3697.  * @param context_count number of contexts to execute
      3698.  */
      3699. static int execute_decode_slices(H264Context *h, int context_count){
            ^
      3700.     MpegEncContext * const s = &h->s;
      3701.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:3699:1: <Length trace>
3697.  * @param context_count number of contexts to execute
3698.  */
3699. static int execute_decode_slices(H264Context *h, int context_count){
      ^
3700.     MpegEncContext * const s = &h->s;
3701.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:3699:1: Parameter `h->thread_context[*]`
      3697.  * @param context_count number of contexts to execute
      3698.  */
      3699. static int execute_decode_slices(H264Context *h, int context_count){
            ^
      3700.     MpegEncContext * const s = &h->s;
      3701.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:3720:14: Array access: Offset: [-1, +oo] Size: 16 by call to `ff_h264_decode_extradata` 
      3718. 
      3719.         /* pull back stuff from slices to master context */
      3720.         hx = h->thread_context[context_count - 1];
                         ^
      3721.         s->mb_x = hx->s.mb_x;
      3722.         s->mb_y = hx->s.mb_y;

static int execute_decode_slices(H264Context *h, int context_count){
    MpegEncContext * const s = &h->s;
    AVCodecContext * const avctx= s->avctx;
    H264Context *hx;
    int i;
    if (s->avctx->hwaccel || s->avctx->codec->capabilities&CODEC_CAP_HWACCEL_VDPAU)
        return 0;
    if(context_count == 1) {
        return decode_slice(avctx, &h);
    } else {
        for(i = 1; i < context_count; i++) {
            hx = h->thread_context[i];
            hx->s.err_recognition = avctx->err_recognition;
            hx->s.error_count = 0;
        }
        avctx->execute(avctx, decode_slice,
                       h->thread_context, NULL, context_count, sizeof(void*));
        hx = h->thread_context[context_count - 1];
        s->mb_x = hx->s.mb_x;
        s->mb_y = hx->s.mb_y;
        s->dropable = hx->s.dropable;
        s->picture_structure = hx->s.picture_structure;
        for(i = 1; i < context_count; i++)
            h->s.error_count += h->thread_context[i]->s.error_count;
    }
    return 0;
}
['static int h264_parse(AVCodecParserContext *s,\n                      AVCodecContext *avctx,\n                      const uint8_t **poutbuf, int *poutbuf_size,\n                      const uint8_t *buf, int buf_size)\n{\n    H264Context *h = s->priv_data;\n    ParseContext *pc = &h->s.parse_context;\n    int next;\n    if (!h->got_first) {\n        h->got_first = 1;\n        if (avctx->extradata_size) {\n            h->s.avctx = avctx;\n            if (!avctx->has_b_frames)\n                h->s.low_delay = 1;\n            ff_h264_decode_extradata(h);\n        }\n    }\n    if(s->flags & PARSER_FLAG_COMPLETE_FRAMES){\n        next= buf_size;\n    }else{\n        next= ff_h264_find_frame_end(h, buf, buf_size);\n        if (ff_combine_frame(pc, next, &buf, &buf_size) < 0) {\n            *poutbuf = NULL;\n            *poutbuf_size = 0;\n            return buf_size;\n        }\n        if(next<0 && next != END_NOT_FOUND){\n            assert(pc->last_index + next >= 0 );\n            ff_h264_find_frame_end(h, &pc->buffer[pc->last_index + next], -next);\n        }\n    }\n    parse_nal_units(s, avctx, buf, buf_size);\n    if (h->sei_cpb_removal_delay >= 0) {\n        s->dts_sync_point    = h->sei_buffering_period_present;\n        s->dts_ref_dts_delta = h->sei_cpb_removal_delay;\n        s->pts_dts_delta     = h->sei_dpb_output_delay;\n    } else {\n        s->dts_sync_point    = INT_MIN;\n        s->dts_ref_dts_delta = INT_MIN;\n        s->pts_dts_delta     = INT_MIN;\n    }\n    if (s->flags & PARSER_FLAG_ONCE) {\n        s->flags &= PARSER_FLAG_COMPLETE_FRAMES;\n    }\n    *poutbuf = buf;\n    *poutbuf_size = buf_size;\n    return next;\n}', 'int ff_h264_decode_extradata(H264Context *h)\n{\n    AVCodecContext *avctx = h->s.avctx;\n    if(avctx->extradata[0] == 1){\n        int i, cnt, nalsize;\n        unsigned char *p = avctx->extradata;\n        h->is_avc = 1;\n        if(avctx->extradata_size < 7) {\n            av_log(avctx, AV_LOG_ERROR, "avcC too short\\n");\n            return -1;\n        }\n        h->nal_length_size = 2;\n        cnt = *(p+5) & 0x1f;\n        p += 6;\n        for (i = 0; i < cnt; i++) {\n            nalsize = AV_RB16(p) + 2;\n            if (p - avctx->extradata + nalsize > avctx->extradata_size)\n                return -1;\n            if(decode_nal_units(h, p, nalsize) < 0) {\n                av_log(avctx, AV_LOG_ERROR, "Decoding sps %d from avcC failed\\n", i);\n                return -1;\n            }\n            p += nalsize;\n        }\n        cnt = *(p++);\n        for (i = 0; i < cnt; i++) {\n            nalsize = AV_RB16(p) + 2;\n            if (p - avctx->extradata + nalsize > avctx->extradata_size)\n                return -1;\n            if (decode_nal_units(h, p, nalsize) < 0) {\n                av_log(avctx, AV_LOG_ERROR, "Decoding pps %d from avcC failed\\n", i);\n                return -1;\n            }\n            p += nalsize;\n        }\n        h->nal_length_size = (avctx->extradata[4] & 0x03) + 1;\n    } else {\n        h->is_avc = 0;\n        if(decode_nal_units(h, avctx->extradata, avctx->extradata_size) < 0)\n            return -1;\n    }\n    return 0;\n}', 'static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){\n    MpegEncContext * const s = &h->s;\n    AVCodecContext * const avctx= s->avctx;\n    H264Context *hx;\n    int buf_index;\n    int context_count;\n    int next_avc;\n    int pass = !(avctx->active_thread_type & FF_THREAD_FRAME);\n    int nals_needed=0;\n    int nal_index;\n    h->max_contexts = s->slice_context_count;\n    if(!(s->flags2 & CODEC_FLAG2_CHUNKS)){\n        h->current_slice = 0;\n        if (!s->first_field)\n            s->current_picture_ptr= NULL;\n        ff_h264_reset_sei(h);\n    }\n    for(;pass <= 1;pass++){\n        buf_index = 0;\n        context_count = 0;\n        next_avc = h->is_avc ? 0 : buf_size;\n        nal_index = 0;\n    for(;;){\n        int consumed;\n        int dst_length;\n        int bit_length;\n        uint8_t *ptr;\n        int i, nalsize = 0;\n        int err;\n        if(buf_index >= next_avc) {\n            if (buf_index >= buf_size - h->nal_length_size) break;\n            nalsize = 0;\n            for(i = 0; i < h->nal_length_size; i++)\n                nalsize = (nalsize << 8) | buf[buf_index++];\n            if(nalsize <= 0 || nalsize > buf_size - buf_index){\n                av_log(h->s.avctx, AV_LOG_ERROR, "AVC: nal size %d\\n", nalsize);\n                break;\n            }\n            next_avc= buf_index + nalsize;\n        } else {\n            for(; buf_index + 3 < next_avc; buf_index++){\n                if(buf[buf_index] == 0 && buf[buf_index+1] == 0 && buf[buf_index+2] == 1)\n                    break;\n            }\n            if(buf_index+3 >= buf_size) break;\n            buf_index+=3;\n            if(buf_index >= next_avc) continue;\n        }\n        hx = h->thread_context[context_count];\n        ptr= ff_h264_decode_nal(hx, buf + buf_index, &dst_length, &consumed, next_avc - buf_index);\n        if (ptr==NULL || dst_length < 0){\n            return -1;\n        }\n        i= buf_index + consumed;\n        if((s->workaround_bugs & FF_BUG_AUTODETECT) && i+3<next_avc &&\n           buf[i]==0x00 && buf[i+1]==0x00 && buf[i+2]==0x01 && buf[i+3]==0xE0)\n            s->workaround_bugs |= FF_BUG_TRUNCATED;\n        if(!(s->workaround_bugs & FF_BUG_TRUNCATED)){\n        while(ptr[dst_length - 1] == 0 && dst_length > 0)\n            dst_length--;\n        }\n        bit_length= !dst_length ? 0 : (8*dst_length - ff_h264_decode_rbsp_trailing(h, ptr + dst_length - 1));\n        if(s->avctx->debug&FF_DEBUG_STARTCODE){\n            av_log(h->s.avctx, AV_LOG_DEBUG, "NAL %d at %d/%d length %d\\n", hx->nal_unit_type, buf_index, buf_size, dst_length);\n        }\n        if (h->is_avc && (nalsize != consumed) && nalsize){\n            if (bit_length & 7)\n                ptr[bit_length >> 3] = ptr[bit_length >> 3] & (0xff << 8 - (bit_length & 7));\n            av_log(h->s.avctx, AV_LOG_DEBUG, "AVC: Consumed only %d bytes instead of %d\\n", consumed, nalsize);\n        }\n        buf_index += consumed;\n        nal_index++;\n        if(pass == 0) {\n            switch (hx->nal_unit_type) {\n                case NAL_SPS:\n                case NAL_PPS:\n                    nals_needed = nal_index;\n                    break;\n                case NAL_IDR_SLICE:\n                case NAL_SLICE:\n                    init_get_bits(&hx->s.gb, ptr, bit_length);\n                    if (!get_ue_golomb(&hx->s.gb))\n                        nals_needed = nal_index;\n            }\n            continue;\n        }\n        if(avctx->skip_frame >= AVDISCARD_NONREF && h->nal_ref_idc  == 0)\n            continue;\n      again:\n        err = 0;\n        switch(hx->nal_unit_type){\n        case NAL_IDR_SLICE:\n            if (h->nal_unit_type != NAL_IDR_SLICE) {\n                av_log(h->s.avctx, AV_LOG_ERROR, "Invalid mix of idr and non-idr slices");\n                return -1;\n            }\n            idr(h);\n        case NAL_SLICE:\n            init_get_bits(&hx->s.gb, ptr, bit_length);\n            hx->intra_gb_ptr=\n            hx->inter_gb_ptr= &hx->s.gb;\n            hx->s.data_partitioning = 0;\n            if((err = decode_slice_header(hx, h)))\n               break;\n            s->current_picture_ptr->f.key_frame |=\n                    (hx->nal_unit_type == NAL_IDR_SLICE) ||\n                    (h->sei_recovery_frame_cnt >= 0);\n            if (h->current_slice == 1) {\n                if(!(s->flags2 & CODEC_FLAG2_CHUNKS)) {\n                    decode_postinit(h, nal_index >= nals_needed);\n                }\n                if (s->avctx->hwaccel && s->avctx->hwaccel->start_frame(s->avctx, NULL, 0) < 0)\n                    return -1;\n                if(CONFIG_H264_VDPAU_DECODER && s->avctx->codec->capabilities&CODEC_CAP_HWACCEL_VDPAU)\n                    ff_vdpau_h264_picture_start(s);\n            }\n            if(hx->redundant_pic_count==0\n               && (avctx->skip_frame < AVDISCARD_NONREF || hx->nal_ref_idc)\n               && (avctx->skip_frame < AVDISCARD_BIDIR  || hx->slice_type_nos!=AV_PICTURE_TYPE_B)\n               && (avctx->skip_frame < AVDISCARD_NONKEY || hx->slice_type_nos==AV_PICTURE_TYPE_I)\n               && avctx->skip_frame < AVDISCARD_ALL){\n                if(avctx->hwaccel) {\n                    if (avctx->hwaccel->decode_slice(avctx, &buf[buf_index - consumed], consumed) < 0)\n                        return -1;\n                }else\n                if(CONFIG_H264_VDPAU_DECODER && s->avctx->codec->capabilities&CODEC_CAP_HWACCEL_VDPAU){\n                    static const uint8_t start_code[] = {0x00, 0x00, 0x01};\n                    ff_vdpau_add_data_chunk(s, start_code, sizeof(start_code));\n                    ff_vdpau_add_data_chunk(s, &buf[buf_index - consumed], consumed );\n                }else\n                    context_count++;\n            }\n            break;\n        case NAL_DPA:\n            init_get_bits(&hx->s.gb, ptr, bit_length);\n            hx->intra_gb_ptr=\n            hx->inter_gb_ptr= NULL;\n            if ((err = decode_slice_header(hx, h)) < 0)\n                break;\n            hx->s.data_partitioning = 1;\n            break;\n        case NAL_DPB:\n            init_get_bits(&hx->intra_gb, ptr, bit_length);\n            hx->intra_gb_ptr= &hx->intra_gb;\n            break;\n        case NAL_DPC:\n            init_get_bits(&hx->inter_gb, ptr, bit_length);\n            hx->inter_gb_ptr= &hx->inter_gb;\n            if(hx->redundant_pic_count==0 && hx->intra_gb_ptr && hx->s.data_partitioning\n               && s->context_initialized\n               && (avctx->skip_frame < AVDISCARD_NONREF || hx->nal_ref_idc)\n               && (avctx->skip_frame < AVDISCARD_BIDIR  || hx->slice_type_nos!=AV_PICTURE_TYPE_B)\n               && (avctx->skip_frame < AVDISCARD_NONKEY || hx->slice_type_nos==AV_PICTURE_TYPE_I)\n               && avctx->skip_frame < AVDISCARD_ALL)\n                context_count++;\n            break;\n        case NAL_SEI:\n            init_get_bits(&s->gb, ptr, bit_length);\n            ff_h264_decode_sei(h);\n            break;\n        case NAL_SPS:\n            init_get_bits(&s->gb, ptr, bit_length);\n            ff_h264_decode_seq_parameter_set(h);\n            if (s->flags& CODEC_FLAG_LOW_DELAY ||\n                (h->sps.bitstream_restriction_flag && !h->sps.num_reorder_frames))\n                s->low_delay=1;\n            if(avctx->has_b_frames < 2)\n                avctx->has_b_frames= !s->low_delay;\n            if (avctx->bits_per_raw_sample != h->sps.bit_depth_luma ||\n                h->cur_chroma_format_idc != h->sps.chroma_format_idc) {\n                if (h->sps.bit_depth_luma >= 8 && h->sps.bit_depth_luma <= 10) {\n                    avctx->bits_per_raw_sample = h->sps.bit_depth_luma;\n                    h->cur_chroma_format_idc = h->sps.chroma_format_idc;\n                    h->pixel_shift = h->sps.bit_depth_luma > 8;\n                    ff_h264dsp_init(&h->h264dsp, h->sps.bit_depth_luma, h->sps.chroma_format_idc);\n                    ff_h264_pred_init(&h->hpc, s->codec_id, h->sps.bit_depth_luma, h->sps.chroma_format_idc);\n                    s->dsp.dct_bits = h->sps.bit_depth_luma > 8 ? 32 : 16;\n                    ff_dsputil_init(&s->dsp, s->avctx);\n                } else {\n                    av_log(avctx, AV_LOG_ERROR, "Unsupported bit depth: %d\\n", h->sps.bit_depth_luma);\n                    return -1;\n                }\n            }\n            break;\n        case NAL_PPS:\n            init_get_bits(&s->gb, ptr, bit_length);\n            ff_h264_decode_picture_parameter_set(h, bit_length);\n            break;\n        case NAL_AUD:\n        case NAL_END_SEQUENCE:\n        case NAL_END_STREAM:\n        case NAL_FILLER_DATA:\n        case NAL_SPS_EXT:\n        case NAL_AUXILIARY_SLICE:\n            break;\n        default:\n            av_log(avctx, AV_LOG_DEBUG, "Unknown NAL code: %d (%d bits)\\n", hx->nal_unit_type, bit_length);\n        }\n        if(context_count == h->max_contexts) {\n            execute_decode_slices(h, context_count);\n            context_count = 0;\n        }\n        if (err < 0)\n            av_log(h->s.avctx, AV_LOG_ERROR, "decode_slice_header error\\n");\n        else if(err == 1) {\n            h->nal_unit_type = hx->nal_unit_type;\n            h->nal_ref_idc   = hx->nal_ref_idc;\n            hx = h;\n            goto again;\n        }\n    }\n    }\n    if(context_count)\n        execute_decode_slices(h, context_count);\n    return buf_index;\n}', 'static int execute_decode_slices(H264Context *h, int context_count){\n    MpegEncContext * const s = &h->s;\n    AVCodecContext * const avctx= s->avctx;\n    H264Context *hx;\n    int i;\n    if (s->avctx->hwaccel || s->avctx->codec->capabilities&CODEC_CAP_HWACCEL_VDPAU)\n        return 0;\n    if(context_count == 1) {\n        return decode_slice(avctx, &h);\n    } else {\n        for(i = 1; i < context_count; i++) {\n            hx = h->thread_context[i];\n            hx->s.err_recognition = avctx->err_recognition;\n            hx->s.error_count = 0;\n        }\n        avctx->execute(avctx, decode_slice,\n                       h->thread_context, NULL, context_count, sizeof(void*));\n        hx = h->thread_context[context_count - 1];\n        s->mb_x = hx->s.mb_x;\n        s->mb_y = hx->s.mb_y;\n        s->dropable = hx->s.dropable;\n        s->picture_structure = hx->s.picture_structure;\n        for(i = 1; i < context_count; i++)\n            h->s.error_count += h->thread_context[i]->s.error_count;\n    }\n    return 0;\n}']