libavcodec/h264_refs.c:137: error: Buffer Overrun L2
  Offset: [0, 64] Size: 2 by call to `build_def_list`.

libavcodec/h264_refs.c:116:1: Parameter `h->default_ref_list[*]`
114. }
115. 
116. int ff_h264_fill_default_ref_list(H264Context *h)
     ^
117. {
118.     int i, len;

libavcodec/h264_refs.c:137:20: Call
135.             len  = build_def_list(h->default_ref_list[list], FF_ARRAY_ELEMS(h->default_ref_list[0]),
136.                                   sorted, len, 0, h->picture_structure);
137.             len += build_def_list(h->default_ref_list[list] + len,
                        ^
138.                                   FF_ARRAY_ELEMS(h->default_ref_list[0]) - len,
139.                                   h->long_ref, 16, 1, h->picture_structure);

libavcodec/h264_refs.c:70:1: Parameter `def_len`
  68. }
  69. 
  70. static int build_def_list(Picture *def, int def_len,
      ^
  71.                           Picture **in, int len, int is_long, int sel)
  72. {

libavcodec/h264_refs.c:83:13: Call
  81.         if (i[0] < len && index < def_len) {
  82.             in[i[0]]->pic_id = is_long ? i[0] : in[i[0]]->frame_num;
  83.             split_field_copy(&def[index++], in[i[0]++], sel, 1);
                  ^
  84.         }
  85.         if (i[1] < len && index < def_len) {

libavcodec/h264_refs.c:54:1: <Length trace>
52. }
53. 
54. static int split_field_copy(Picture *dest, Picture *src, int parity, int id_add)
    ^
55. {
56.     int match = !!(src->reference & parity);

libavcodec/h264_refs.c:54:1: Parameter `*dest`
    52. }
    53. 
    54. static int split_field_copy(Picture *dest, Picture *src, int parity, int id_add)
        ^
    55. {
    56.     int match = !!(src->reference & parity);

libavcodec/h264_refs.c:59:9: Array access: Offset: [0, 64] Size: 2 by call to `build_def_list` 
    57. 
    58.     if (match) {
    59.         COPY_PICTURE(dest, src);
                ^
    60.         if (parity != PICT_FRAME) {
    61.             pic_as_field(dest, parity);

static int split_field_copy(Picture *dest, Picture *src, int parity, int id_add)
{
    int match = !!(src->reference & parity);
    if (match) {
        COPY_PICTURE(dest, src);
        if (parity != PICT_FRAME) {
            pic_as_field(dest, parity);
            dest->pic_id *= 2;
            dest->pic_id += id_add;
        }
    }
    return match;
}
['int ff_h264_fill_default_ref_list(H264Context *h)\n{\n    int i, len;\n    if (h->slice_type_nos == AV_PICTURE_TYPE_B) {\n        Picture *sorted[32];\n        int cur_poc, list;\n        int lens[2];\n        if (FIELD_PICTURE(h))\n            cur_poc = h->cur_pic_ptr->field_poc[h->picture_structure == PICT_BOTTOM_FIELD];\n        else\n            cur_poc = h->cur_pic_ptr->poc;\n        for (list = 0; list < 2; list++) {\n            len  = add_sorted(sorted,       h->short_ref, h->short_ref_count, cur_poc, 1 ^ list);\n            len += add_sorted(sorted + len, h->short_ref, h->short_ref_count, cur_poc, 0 ^ list);\n            assert(len <= 32);\n            len  = build_def_list(h->default_ref_list[list], FF_ARRAY_ELEMS(h->default_ref_list[0]),\n                                  sorted, len, 0, h->picture_structure);\n            len += build_def_list(h->default_ref_list[list] + len,\n                                  FF_ARRAY_ELEMS(h->default_ref_list[0]) - len,\n                                  h->long_ref, 16, 1, h->picture_structure);\n            if (len < h->ref_count[list])\n                memset(&h->default_ref_list[list][len], 0, sizeof(Picture) * (h->ref_count[list] - len));\n            lens[list] = len;\n        }\n        if (lens[0] == lens[1] && lens[1] > 1) {\n            for (i = 0; i < lens[0] &&\n                        h->default_ref_list[0][i].f.buf[0]->buffer ==\n                        h->default_ref_list[1][i].f.buf[0]->buffer; i++);\n            if (i == lens[0]) {\n                Picture tmp;\n                COPY_PICTURE(&tmp, &h->default_ref_list[1][0]);\n                COPY_PICTURE(&h->default_ref_list[1][0], &h->default_ref_list[1][1]);\n                COPY_PICTURE(&h->default_ref_list[1][1], &tmp);\n            }\n        }\n    } else {\n        len  = build_def_list(h->default_ref_list[0], FF_ARRAY_ELEMS(h->default_ref_list[0]),\n                              h->short_ref, h->short_ref_count, 0, h->picture_structure);\n        len += build_def_list(h->default_ref_list[0] + len,\n                              FF_ARRAY_ELEMS(h->default_ref_list[0]) - len,\n                              h-> long_ref, 16, 1, h->picture_structure);\n        if (len < h->ref_count[0])\n            memset(&h->default_ref_list[0][len], 0, sizeof(Picture) * (h->ref_count[0] - len));\n    }\n#ifdef TRACE\n    for (i = 0; i < h->ref_count[0]; i++) {\n        tprintf(h->avctx, "List0: %s fn:%d 0x%p\\n",\n                (h->default_ref_list[0][i].long_ref ? "LT" : "ST"),\n                h->default_ref_list[0][i].pic_id,\n                h->default_ref_list[0][i].f.data[0]);\n    }\n    if (h->slice_type_nos == AV_PICTURE_TYPE_B) {\n        for (i = 0; i < h->ref_count[1]; i++) {\n            tprintf(h->avctx, "List1: %s fn:%d 0x%p\\n",\n                    (h->default_ref_list[1][i].long_ref ? "LT" : "ST"),\n                    h->default_ref_list[1][i].pic_id,\n                    h->default_ref_list[1][i].f.data[0]);\n        }\n    }\n#endif\n    return 0;\n}', 'static int build_def_list(Picture *def, int def_len,\n                          Picture **in, int len, int is_long, int sel)\n{\n    int  i[2] = { 0 };\n    int index = 0;\n    while ((i[0] < len || i[1] < len) && index < def_len) {\n        while (i[0] < len && !(in[i[0]] && (in[i[0]]->reference & sel)))\n            i[0]++;\n        while (i[1] < len && !(in[i[1]] && (in[i[1]]->reference & (sel ^ 3))))\n            i[1]++;\n        if (i[0] < len && index < def_len) {\n            in[i[0]]->pic_id = is_long ? i[0] : in[i[0]]->frame_num;\n            split_field_copy(&def[index++], in[i[0]++], sel, 1);\n        }\n        if (i[1] < len && index < def_len) {\n            in[i[1]]->pic_id = is_long ? i[1] : in[i[1]]->frame_num;\n            split_field_copy(&def[index++], in[i[1]++], sel ^ 3, 0);\n        }\n    }\n    return index;\n}', 'static int split_field_copy(Picture *dest, Picture *src, int parity, int id_add)\n{\n    int match = !!(src->reference & parity);\n    if (match) {\n        COPY_PICTURE(dest, src);\n        if (parity != PICT_FRAME) {\n            pic_as_field(dest, parity);\n            dest->pic_id *= 2;\n            dest->pic_id += id_add;\n        }\n    }\n    return match;\n}']