libavcodec/h264_slice.c:1535: error: Buffer Overrun L1
  Offset: [20, 51] Size: 2.

libavcodec/h264_slice.c:1534:14: <Offset trace>
1532.         ref2frm[18 + 0] =
1533.         ref2frm[18 + 1] = -1;
1534.         for (i = 16; i < 48; i++)
                   ^
1535.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
1536.                              (sl->ref_list[j][i].reference & 3);

libavcodec/h264_slice.c:1534:14: Assignment
1532.         ref2frm[18 + 0] =
1533.         ref2frm[18 + 1] = -1;
1534.         for (i = 16; i < 48; i++)
                   ^
1535.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
1536.                              (sl->ref_list[j][i].reference & 3);

libavcodec/h264_slice.c:1422:1: <Length trace>
1420.  * @return 0 if okay, <0 if an error occurred
1421.  */
1422. int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl)
      ^
1423. {
1424.     int i, j, ret = 0;

libavcodec/h264_slice.c:1422:1: Parameter `h->ref2frm[*][*]`
1420.  * @return 0 if okay, <0 if an error occurred
1421.  */
1422. int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl)
      ^
1423. {
1424.     int i, j, ret = 0;

libavcodec/h264_slice.c:1508:9: Assignment
1506.     for (j = 0; j < 2; j++) {
1507.         int id_list[16];
1508.         int *ref2frm = h->ref2frm[sl->slice_num & (MAX_SLICES - 1)][j];
              ^
1509.         for (i = 0; i < 16; i++) {
1510.             id_list[i] = 60;

libavcodec/h264_slice.c:1535:13: Array access: Offset: [20, 51] Size: 2
1533.         ref2frm[18 + 1] = -1;
1534.         for (i = 16; i < 48; i++)
1535.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
                  ^
1536.                              (sl->ref_list[j][i].reference & 3);
1537.     }

int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl)
{
    int i, j, ret = 0;
    ret = h264_slice_header_parse(h, sl);
    if (ret < 0)
        return ret;
    if (h->current_slice == 0) {
        ret = h264_field_start(h, sl);
        if (ret < 0)
            return ret;
    }
    assert(h->mb_num == h->mb_width * h->mb_height);
    if (sl->first_mb_addr << FIELD_OR_MBAFF_PICTURE(h) >= h->mb_num ||
        sl->first_mb_addr >= h->mb_num) {
        av_log(h->avctx, AV_LOG_ERROR, "first_mb_in_slice overflow\n");
        return AVERROR_INVALIDDATA;
    }
    sl->resync_mb_x = sl->mb_x =  sl->first_mb_addr % h->mb_width;
    sl->resync_mb_y = sl->mb_y = (sl->first_mb_addr / h->mb_width) <<
                                 FIELD_OR_MBAFF_PICTURE(h);
    if (h->picture_structure == PICT_BOTTOM_FIELD)
        sl->resync_mb_y = sl->mb_y = sl->mb_y + 1;
    assert(sl->mb_y < h->mb_height);
    if (!h->setup_finished) {
        ff_h264_init_poc(h->cur_pic_ptr->field_poc, &h->cur_pic_ptr->poc,
                         h->ps.sps, &h->poc, h->picture_structure, h->nal_ref_idc);
        memcpy(h->mmco, sl->mmco, sl->nb_mmco * sizeof(*h->mmco));
        h->nb_mmco = sl->nb_mmco;
        h->explicit_ref_marking = sl->explicit_ref_marking;
    }
    ret = ff_h264_build_ref_list(h, sl);
    if (ret < 0)
        return ret;
    if (h->ps.pps->weighted_bipred_idc == 2 &&
        sl->slice_type_nos == AV_PICTURE_TYPE_B) {
        implicit_weight_table(h, sl, -1);
        if (FRAME_MBAFF(h)) {
            implicit_weight_table(h, sl, 0);
            implicit_weight_table(h, sl, 1);
        }
    }
    if (sl->slice_type_nos == AV_PICTURE_TYPE_B && !sl->direct_spatial_mv_pred)
        ff_h264_direct_dist_scale_factor(h, sl);
    ff_h264_direct_ref_list_init(h, sl);
    if (h->avctx->skip_loop_filter >= AVDISCARD_ALL ||
        (h->avctx->skip_loop_filter >= AVDISCARD_NONKEY &&
         sl->slice_type_nos != AV_PICTURE_TYPE_I) ||
        (h->avctx->skip_loop_filter >= AVDISCARD_BIDIR  &&
         sl->slice_type_nos == AV_PICTURE_TYPE_B) ||
        (h->avctx->skip_loop_filter >= AVDISCARD_NONREF &&
         h->nal_ref_idc == 0))
        sl->deblocking_filter = 0;
    if (sl->deblocking_filter == 1 && h->nb_slice_ctx > 1) {
        if (h->avctx->flags2 & AV_CODEC_FLAG2_FAST) {
            sl->deblocking_filter = 2;
        } else {
            h->postpone_filter = 1;
        }
    }
    sl->qp_thresh = 15 -
                   FFMIN(sl->slice_alpha_c0_offset, sl->slice_beta_offset) -
                   FFMAX3(0,
                          h->ps.pps->chroma_qp_index_offset[0],
                          h->ps.pps->chroma_qp_index_offset[1]) +
                   6 * (h->ps.sps->bit_depth_luma - 8);
    sl->slice_num       = ++h->current_slice;
    if (sl->slice_num >= MAX_SLICES) {
        av_log(h->avctx, AV_LOG_ERROR,
               "Too many slices, increase MAX_SLICES and recompile\n");
    }
    for (j = 0; j < 2; j++) {
        int id_list[16];
        int *ref2frm = h->ref2frm[sl->slice_num & (MAX_SLICES - 1)][j];
        for (i = 0; i < 16; i++) {
            id_list[i] = 60;
            if (j < sl->list_count && i < sl->ref_count[j] &&
                sl->ref_list[j][i].parent->f->buf[0]) {
                int k;
                AVBuffer *buf = sl->ref_list[j][i].parent->f->buf[0]->buffer;
                for (k = 0; k < h->short_ref_count; k++)
                    if (h->short_ref[k]->f->buf[0]->buffer == buf) {
                        id_list[i] = k;
                        break;
                    }
                for (k = 0; k < h->long_ref_count; k++)
                    if (h->long_ref[k] && h->long_ref[k]->f->buf[0]->buffer == buf) {
                        id_list[i] = h->short_ref_count + k;
                        break;
                    }
            }
        }
        ref2frm[0] =
        ref2frm[1] = -1;
        for (i = 0; i < 16; i++)
            ref2frm[i + 2] = 4 * id_list[i] + (sl->ref_list[j][i].reference & 3);
        ref2frm[18 + 0] =
        ref2frm[18 + 1] = -1;
        for (i = 16; i < 48; i++)
            ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
                             (sl->ref_list[j][i].reference & 3);
    }
    if (h->avctx->debug & FF_DEBUG_PICT_INFO) {
        av_log(h->avctx, AV_LOG_DEBUG,
               "slice:%d %s mb:%d %c%s%s frame:%d poc:%d/%d ref:%d/%d qp:%d loop:%d:%d:%d weight:%d%s %s\n",
               sl->slice_num,
               (h->picture_structure == PICT_FRAME ? "F" : h->picture_structure == PICT_TOP_FIELD ? "T" : "B"),
               sl->mb_y * h->mb_width + sl->mb_x,
               av_get_picture_type_char(sl->slice_type),
               sl->slice_type_fixed ? " fix" : "",
               h->nal_unit_type == NAL_IDR_SLICE ? " IDR" : "",
               h->poc.frame_num,
               h->cur_pic_ptr->field_poc[0],
               h->cur_pic_ptr->field_poc[1],
               sl->ref_count[0], sl->ref_count[1],
               sl->qscale,
               sl->deblocking_filter,
               sl->slice_alpha_c0_offset, sl->slice_beta_offset,
               sl->pwt.use_weight,
               sl->pwt.use_weight == 1 && sl->pwt.use_weight_chroma ? "c" : "",
               sl->slice_type == AV_PICTURE_TYPE_B ? (sl->direct_spatial_mv_pred ? "SPAT" : "TEMP") : "");
    }
    return 0;
}
['int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl)\n{\n    int i, j, ret = 0;\n    ret = h264_slice_header_parse(h, sl);\n    if (ret < 0)\n        return ret;\n    if (h->current_slice == 0) {\n        ret = h264_field_start(h, sl);\n        if (ret < 0)\n            return ret;\n    }\n    assert(h->mb_num == h->mb_width * h->mb_height);\n    if (sl->first_mb_addr << FIELD_OR_MBAFF_PICTURE(h) >= h->mb_num ||\n        sl->first_mb_addr >= h->mb_num) {\n        av_log(h->avctx, AV_LOG_ERROR, "first_mb_in_slice overflow\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    sl->resync_mb_x = sl->mb_x =  sl->first_mb_addr % h->mb_width;\n    sl->resync_mb_y = sl->mb_y = (sl->first_mb_addr / h->mb_width) <<\n                                 FIELD_OR_MBAFF_PICTURE(h);\n    if (h->picture_structure == PICT_BOTTOM_FIELD)\n        sl->resync_mb_y = sl->mb_y = sl->mb_y + 1;\n    assert(sl->mb_y < h->mb_height);\n    if (!h->setup_finished) {\n        ff_h264_init_poc(h->cur_pic_ptr->field_poc, &h->cur_pic_ptr->poc,\n                         h->ps.sps, &h->poc, h->picture_structure, h->nal_ref_idc);\n        memcpy(h->mmco, sl->mmco, sl->nb_mmco * sizeof(*h->mmco));\n        h->nb_mmco = sl->nb_mmco;\n        h->explicit_ref_marking = sl->explicit_ref_marking;\n    }\n    ret = ff_h264_build_ref_list(h, sl);\n    if (ret < 0)\n        return ret;\n    if (h->ps.pps->weighted_bipred_idc == 2 &&\n        sl->slice_type_nos == AV_PICTURE_TYPE_B) {\n        implicit_weight_table(h, sl, -1);\n        if (FRAME_MBAFF(h)) {\n            implicit_weight_table(h, sl, 0);\n            implicit_weight_table(h, sl, 1);\n        }\n    }\n    if (sl->slice_type_nos == AV_PICTURE_TYPE_B && !sl->direct_spatial_mv_pred)\n        ff_h264_direct_dist_scale_factor(h, sl);\n    ff_h264_direct_ref_list_init(h, sl);\n    if (h->avctx->skip_loop_filter >= AVDISCARD_ALL ||\n        (h->avctx->skip_loop_filter >= AVDISCARD_NONKEY &&\n         sl->slice_type_nos != AV_PICTURE_TYPE_I) ||\n        (h->avctx->skip_loop_filter >= AVDISCARD_BIDIR  &&\n         sl->slice_type_nos == AV_PICTURE_TYPE_B) ||\n        (h->avctx->skip_loop_filter >= AVDISCARD_NONREF &&\n         h->nal_ref_idc == 0))\n        sl->deblocking_filter = 0;\n    if (sl->deblocking_filter == 1 && h->nb_slice_ctx > 1) {\n        if (h->avctx->flags2 & AV_CODEC_FLAG2_FAST) {\n            sl->deblocking_filter = 2;\n        } else {\n            h->postpone_filter = 1;\n        }\n    }\n    sl->qp_thresh = 15 -\n                   FFMIN(sl->slice_alpha_c0_offset, sl->slice_beta_offset) -\n                   FFMAX3(0,\n                          h->ps.pps->chroma_qp_index_offset[0],\n                          h->ps.pps->chroma_qp_index_offset[1]) +\n                   6 * (h->ps.sps->bit_depth_luma - 8);\n    sl->slice_num       = ++h->current_slice;\n    if (sl->slice_num >= MAX_SLICES) {\n        av_log(h->avctx, AV_LOG_ERROR,\n               "Too many slices, increase MAX_SLICES and recompile\\n");\n    }\n    for (j = 0; j < 2; j++) {\n        int id_list[16];\n        int *ref2frm = h->ref2frm[sl->slice_num & (MAX_SLICES - 1)][j];\n        for (i = 0; i < 16; i++) {\n            id_list[i] = 60;\n            if (j < sl->list_count && i < sl->ref_count[j] &&\n                sl->ref_list[j][i].parent->f->buf[0]) {\n                int k;\n                AVBuffer *buf = sl->ref_list[j][i].parent->f->buf[0]->buffer;\n                for (k = 0; k < h->short_ref_count; k++)\n                    if (h->short_ref[k]->f->buf[0]->buffer == buf) {\n                        id_list[i] = k;\n                        break;\n                    }\n                for (k = 0; k < h->long_ref_count; k++)\n                    if (h->long_ref[k] && h->long_ref[k]->f->buf[0]->buffer == buf) {\n                        id_list[i] = h->short_ref_count + k;\n                        break;\n                    }\n            }\n        }\n        ref2frm[0] =\n        ref2frm[1] = -1;\n        for (i = 0; i < 16; i++)\n            ref2frm[i + 2] = 4 * id_list[i] + (sl->ref_list[j][i].reference & 3);\n        ref2frm[18 + 0] =\n        ref2frm[18 + 1] = -1;\n        for (i = 16; i < 48; i++)\n            ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +\n                             (sl->ref_list[j][i].reference & 3);\n    }\n    if (h->avctx->debug & FF_DEBUG_PICT_INFO) {\n        av_log(h->avctx, AV_LOG_DEBUG,\n               "slice:%d %s mb:%d %c%s%s frame:%d poc:%d/%d ref:%d/%d qp:%d loop:%d:%d:%d weight:%d%s %s\\n",\n               sl->slice_num,\n               (h->picture_structure == PICT_FRAME ? "F" : h->picture_structure == PICT_TOP_FIELD ? "T" : "B"),\n               sl->mb_y * h->mb_width + sl->mb_x,\n               av_get_picture_type_char(sl->slice_type),\n               sl->slice_type_fixed ? " fix" : "",\n               h->nal_unit_type == NAL_IDR_SLICE ? " IDR" : "",\n               h->poc.frame_num,\n               h->cur_pic_ptr->field_poc[0],\n               h->cur_pic_ptr->field_poc[1],\n               sl->ref_count[0], sl->ref_count[1],\n               sl->qscale,\n               sl->deblocking_filter,\n               sl->slice_alpha_c0_offset, sl->slice_beta_offset,\n               sl->pwt.use_weight,\n               sl->pwt.use_weight == 1 && sl->pwt.use_weight_chroma ? "c" : "",\n               sl->slice_type == AV_PICTURE_TYPE_B ? (sl->direct_spatial_mv_pred ? "SPAT" : "TEMP") : "");\n    }\n    return 0;\n}']