libavcodec/h264_refs.c:695: error: Integer Overflow L2
  ([0, 1] - 1):unsigned32.

libavcodec/h264_refs.c:695:26: <LHS trace>
693. 
694.     if (h->nal_unit_type == NAL_IDR_SLICE){ // FIXME fields
695.         s->broken_link = get_bits1(gb) - 1;
                              ^
696.         if (get_bits1(gb)){
697.             mmco[0].opcode = MMCO_LONG;

libavcodec/h264_refs.c:695:26: Call
693. 
694.     if (h->nal_unit_type == NAL_IDR_SLICE){ // FIXME fields
695.         s->broken_link = get_bits1(gb) - 1;
                              ^
696.         if (get_bits1(gb)){
697.             mmco[0].opcode = MMCO_LONG;

libavcodec/get_bits.h:271:1: Parameter `s->index`
  269. }
  270. 
  271. static inline unsigned int get_bits1(GetBitContext *s)
       ^
  272. {
  273.     unsigned int index = s->index;

libavcodec/get_bits.h:273:5: Assignment
  271. static inline unsigned int get_bits1(GetBitContext *s)
  272. {
  273.     unsigned int index = s->index;
           ^
  274.     uint8_t result     = s->buffer[index >> 3];
  275. #ifdef BITSTREAM_READER_LE

libavcodec/get_bits.h:276:5: Assignment
  274.     uint8_t result     = s->buffer[index >> 3];
  275. #ifdef BITSTREAM_READER_LE
  276.     result >>= index & 7;
           ^
  277.     result  &= 1;
  278. #else

libavcodec/get_bits.h:277:5: Assignment
  275. #ifdef BITSTREAM_READER_LE
  276.     result >>= index & 7;
  277.     result  &= 1;
           ^
  278. #else
  279.     result <<= index & 7;

libavcodec/get_bits.h:288:5: Assignment
  286.     s->index = index;
  287. 
  288.     return result;
           ^
  289. }
  290. 

libavcodec/h264_refs.c:695:9: Binary operation: ([0, 1] - 1):unsigned32
693. 
694.     if (h->nal_unit_type == NAL_IDR_SLICE){ // FIXME fields
695.         s->broken_link = get_bits1(gb) - 1;
             ^
696.         if (get_bits1(gb)){
697.             mmco[0].opcode = MMCO_LONG;

int ff_h264_decode_ref_pic_marking(H264Context *h, GetBitContext *gb,
                                   int first_slice)
{
    MpegEncContext * const s = &h->s;
    int i, ret;
    MMCO mmco_temp[MAX_MMCO_COUNT], *mmco = first_slice ? h->mmco : mmco_temp;
    int mmco_index = 0;
    if (h->nal_unit_type == NAL_IDR_SLICE){
        s->broken_link = get_bits1(gb) - 1;
        if (get_bits1(gb)){
            mmco[0].opcode = MMCO_LONG;
            mmco[0].long_arg = 0;
            mmco_index = 1;
        }
    } else {
        if (get_bits1(gb)) {
            for (i = 0; i < MAX_MMCO_COUNT; i++) {
                MMCOOpcode opcode = get_ue_golomb_31(gb);
                mmco[i].opcode = opcode;
                if (opcode == MMCO_SHORT2UNUSED || opcode == MMCO_SHORT2LONG){
                    mmco[i].short_pic_num =
                        (h->curr_pic_num - get_ue_golomb(gb) - 1) &
                            (h->max_pic_num - 1);
#if 0
                    if (mmco[i].short_pic_num >= h->short_ref_count ||
                        h->short_ref[ mmco[i].short_pic_num ] == NULL){
                        av_log(s->avctx, AV_LOG_ERROR,
                               "illegal short ref in memory management control "
                               "operation %d\n", mmco);
                        return -1;
                    }
#endif
                }
                if (opcode == MMCO_SHORT2LONG || opcode == MMCO_LONG2UNUSED ||
                    opcode == MMCO_LONG || opcode == MMCO_SET_MAX_LONG) {
                    unsigned int long_arg = get_ue_golomb_31(gb);
                    if (long_arg >= 32 ||
                        (long_arg >= 16 && !(opcode == MMCO_SET_MAX_LONG &&
                                             long_arg == 16) &&
                         !(opcode == MMCO_LONG2UNUSED && FIELD_PICTURE))){
                        av_log(h->s.avctx, AV_LOG_ERROR,
                               "illegal long ref in memory management control "
                               "operation %d\n", opcode);
                        return -1;
                    }
                    mmco[i].long_arg = long_arg;
                }
                if (opcode > (unsigned) MMCO_LONG){
                    av_log(h->s.avctx, AV_LOG_ERROR,
                           "illegal memory management control operation %d\n",
                           opcode);
                    return -1;
                }
                if (opcode == MMCO_END)
                    break;
            }
            mmco_index = i;
        } else {
            if (first_slice) {
                ret = ff_generate_sliding_window_mmcos(h, first_slice);
                if (ret < 0 && s->avctx->err_recognition & AV_EF_EXPLODE)
                    return ret;
            }
            mmco_index = -1;
        }
    }
    if (first_slice && mmco_index != -1) {
        h->mmco_index = mmco_index;
    } else if (!first_slice && mmco_index >= 0 &&
               (mmco_index != h->mmco_index ||
                (i = check_opcodes(h->mmco, mmco_temp, mmco_index)))) {
        av_log(h->s.avctx, AV_LOG_ERROR,
               "Inconsistent MMCO state between slices [%d, %d, %d]\n",
               mmco_index, h->mmco_index, i);
        return AVERROR_INVALIDDATA;
    }
    return 0;
}
['int ff_h264_decode_ref_pic_marking(H264Context *h, GetBitContext *gb,\n                                   int first_slice)\n{\n    MpegEncContext * const s = &h->s;\n    int i, ret;\n    MMCO mmco_temp[MAX_MMCO_COUNT], *mmco = first_slice ? h->mmco : mmco_temp;\n    int mmco_index = 0;\n    if (h->nal_unit_type == NAL_IDR_SLICE){\n        s->broken_link = get_bits1(gb) - 1;\n        if (get_bits1(gb)){\n            mmco[0].opcode = MMCO_LONG;\n            mmco[0].long_arg = 0;\n            mmco_index = 1;\n        }\n    } else {\n        if (get_bits1(gb)) {\n            for (i = 0; i < MAX_MMCO_COUNT; i++) {\n                MMCOOpcode opcode = get_ue_golomb_31(gb);\n                mmco[i].opcode = opcode;\n                if (opcode == MMCO_SHORT2UNUSED || opcode == MMCO_SHORT2LONG){\n                    mmco[i].short_pic_num =\n                        (h->curr_pic_num - get_ue_golomb(gb) - 1) &\n                            (h->max_pic_num - 1);\n#if 0\n                    if (mmco[i].short_pic_num >= h->short_ref_count ||\n                        h->short_ref[ mmco[i].short_pic_num ] == NULL){\n                        av_log(s->avctx, AV_LOG_ERROR,\n                               "illegal short ref in memory management control "\n                               "operation %d\\n", mmco);\n                        return -1;\n                    }\n#endif\n                }\n                if (opcode == MMCO_SHORT2LONG || opcode == MMCO_LONG2UNUSED ||\n                    opcode == MMCO_LONG || opcode == MMCO_SET_MAX_LONG) {\n                    unsigned int long_arg = get_ue_golomb_31(gb);\n                    if (long_arg >= 32 ||\n                        (long_arg >= 16 && !(opcode == MMCO_SET_MAX_LONG &&\n                                             long_arg == 16) &&\n                         !(opcode == MMCO_LONG2UNUSED && FIELD_PICTURE))){\n                        av_log(h->s.avctx, AV_LOG_ERROR,\n                               "illegal long ref in memory management control "\n                               "operation %d\\n", opcode);\n                        return -1;\n                    }\n                    mmco[i].long_arg = long_arg;\n                }\n                if (opcode > (unsigned) MMCO_LONG){\n                    av_log(h->s.avctx, AV_LOG_ERROR,\n                           "illegal memory management control operation %d\\n",\n                           opcode);\n                    return -1;\n                }\n                if (opcode == MMCO_END)\n                    break;\n            }\n            mmco_index = i;\n        } else {\n            if (first_slice) {\n                ret = ff_generate_sliding_window_mmcos(h, first_slice);\n                if (ret < 0 && s->avctx->err_recognition & AV_EF_EXPLODE)\n                    return ret;\n            }\n            mmco_index = -1;\n        }\n    }\n    if (first_slice && mmco_index != -1) {\n        h->mmco_index = mmco_index;\n    } else if (!first_slice && mmco_index >= 0 &&\n               (mmco_index != h->mmco_index ||\n                (i = check_opcodes(h->mmco, mmco_temp, mmco_index)))) {\n        av_log(h->s.avctx, AV_LOG_ERROR,\n               "Inconsistent MMCO state between slices [%d, %d, %d]\\n",\n               mmco_index, h->mmco_index, i);\n        return AVERROR_INVALIDDATA;\n    }\n    return 0;\n}', 'static inline unsigned int get_bits1(GetBitContext *s)\n{\n    unsigned int index = s->index;\n    uint8_t result     = s->buffer[index >> 3];\n#ifdef BITSTREAM_READER_LE\n    result >>= index & 7;\n    result  &= 1;\n#else\n    result <<= index & 7;\n    result >>= 8 - 1;\n#endif\n#if !UNCHECKED_BITSTREAM_READER\n    if (s->index < s->size_in_bits_plus8)\n#endif\n        index++;\n    s->index = index;\n    return result;\n}']