libavcodec/h264_loopfilter.c:557: error: Buffer Overrun L1
  Offset: [2, 21] (⇐ [2, 20] + [0, 1]) Size: 2.

libavcodec/h264_loopfilter.c:556:22: <Offset trace>
554.                 int v = 0;
555. 
556.                 for( l = 0; !v && l < 1 + (h->slice_type_nos == FF_B_TYPE); l++ ) {
                          ^
557.                     v |= ref2frm[l][h->ref_cache[l][b_idx]] != ref2frmn[l][h->ref_cache[l][bn_idx]] |
558.                          h->mv_cache[l][b_idx][0] - h->mv_cache[l][bn_idx][0] + 3 >= 7U |

libavcodec/h264_loopfilter.c:556:22: Assignment
554.                 int v = 0;
555. 
556.                 for( l = 0; !v && l < 1 + (h->slice_type_nos == FF_B_TYPE); l++ ) {
                          ^
557.                     v |= ref2frm[l][h->ref_cache[l][b_idx]] != ref2frmn[l][h->ref_cache[l][bn_idx]] |
558.                          h->mv_cache[l][b_idx][0] - h->mv_cache[l][bn_idx][0] + 3 >= 7U |

libavcodec/h264_loopfilter.c:443:1: <Length trace>
441. 
442. 
443. static av_always_inline void filter_mb_dir(H264Context *h, int mb_x, int mb_y, uint8_t *img_y, uint8_t *img_cb, uint8_t *img_cr, unsigned int linesize, unsigned int uvlinesize, int mb_xy, int mb_type, int mvy_limit, int first_vertical_edge_done, int dir) {
     ^
444.     MpegEncContext * const s = &h->s;
445.     int edge;

libavcodec/h264_loopfilter.c:443:1: Parameter `h->ref2frm[*][*]`
441. 
442. 
443. static av_always_inline void filter_mb_dir(H264Context *h, int mb_x, int mb_y, uint8_t *img_y, uint8_t *img_cb, uint8_t *img_cr, unsigned int linesize, unsigned int uvlinesize, int mb_xy, int mb_type, int mvy_limit, int first_vertical_edge_done, int dir) {
     ^
444.     MpegEncContext * const s = &h->s;
445.     int edge;

libavcodec/h264_loopfilter.c:448:5: Assignment
446.     const int mbm_xy = dir == 0 ? mb_xy -1 : h->top_mb_xy;
447.     const int mbm_type = s->current_picture.mb_type[mbm_xy];
448.     int (*ref2frm) [64] = h->ref2frm[ h->slice_num          &(MAX_SLICES-1) ][0] + (MB_MBAFF ? 20 : 2);
         ^
449.     int (*ref2frmm)[64] = h->ref2frm[ h->slice_table[mbm_xy]&(MAX_SLICES-1) ][0] + (MB_MBAFF ? 20 : 2);
450.     int start = h->slice_table[mbm_xy] == 0xFFFF ? 1 : 0;

libavcodec/h264_loopfilter.c:557:26: Array access: Offset: [2, 21] (⇐ [2, 20] + [0, 1]) Size: 2
555. 
556.                 for( l = 0; !v && l < 1 + (h->slice_type_nos == FF_B_TYPE); l++ ) {
557.                     v |= ref2frm[l][h->ref_cache[l][b_idx]] != ref2frmn[l][h->ref_cache[l][bn_idx]] |
                              ^
558.                          h->mv_cache[l][b_idx][0] - h->mv_cache[l][bn_idx][0] + 3 >= 7U |
559.                          FFABS( h->mv_cache[l][b_idx][1] - h->mv_cache[l][bn_idx][1] ) >= mvy_limit;

static av_always_inline void filter_mb_dir(H264Context *h, int mb_x, int mb_y, uint8_t *img_y, uint8_t *img_cb, uint8_t *img_cr, unsigned int linesize, unsigned int uvlinesize, int mb_xy, int mb_type, int mvy_limit, int first_vertical_edge_done, int dir) {
    MpegEncContext * const s = &h->s;
    int edge;
    const int mbm_xy = dir == 0 ? mb_xy -1 : h->top_mb_xy;
    const int mbm_type = s->current_picture.mb_type[mbm_xy];
    int (*ref2frm) [64] = h->ref2frm[ h->slice_num          &(MAX_SLICES-1) ][0] + (MB_MBAFF ? 20 : 2);
    int (*ref2frmm)[64] = h->ref2frm[ h->slice_table[mbm_xy]&(MAX_SLICES-1) ][0] + (MB_MBAFF ? 20 : 2);
    int start = h->slice_table[mbm_xy] == 0xFFFF ? 1 : 0;
    const int edges = (mb_type & (MB_TYPE_16x16|MB_TYPE_SKIP))
                              == (MB_TYPE_16x16|MB_TYPE_SKIP) ? 1 : 4;
    const int mask_edge = (mb_type & (MB_TYPE_16x16 | (MB_TYPE_16x8 << dir))) ? 3 :
                          (mb_type & (MB_TYPE_8x16 >> dir)) ? 1 : 0;
    const int mask_par0 = mb_type & (MB_TYPE_16x16 | (MB_TYPE_8x16 >> dir));
    if (first_vertical_edge_done) {
        start = 1;
    }
    if (h->deblocking_filter==2 && h->slice_table[mbm_xy] != h->slice_table[mb_xy])
        start = 1;
    if (FRAME_MBAFF && (dir == 1) && ((mb_y&1) == 0) && start == 0
        && !IS_INTERLACED(mb_type)
        && IS_INTERLACED(mbm_type)
        ) {
        static const int nnz_idx[4] = {4,5,6,3};
        unsigned int tmp_linesize   = 2 *   linesize;
        unsigned int tmp_uvlinesize = 2 * uvlinesize;
        int mbn_xy = mb_xy - 2 * s->mb_stride;
        int qp;
        int i, j;
        int16_t bS[4];
        for(j=0; j<2; j++, mbn_xy += s->mb_stride){
            if( IS_INTRA(mb_type) ||
                IS_INTRA(s->current_picture.mb_type[mbn_xy]) ) {
                bS[0] = bS[1] = bS[2] = bS[3] = 3;
            } else {
                const uint8_t *mbn_nnz = h->non_zero_count[mbn_xy];
                for( i = 0; i < 4; i++ ) {
                    if( h->non_zero_count_cache[scan8[0]+i] != 0 ||
                        mbn_nnz[nnz_idx[i]] != 0 )
                        bS[i] = 2;
                    else
                        bS[i] = 1;
                }
            }
            qp = ( s->current_picture.qscale_table[mb_xy] + s->current_picture.qscale_table[mbn_xy] + 1 ) >> 1;
            tprintf(s->avctx, "filter mb:%d/%d dir:%d edge:%d, QPy:%d ls:%d uvls:%d", mb_x, mb_y, dir, edge, qp, tmp_linesize, tmp_uvlinesize);
            { int i; for (i = 0; i < 4; i++) tprintf(s->avctx, " bS[%d]:%d", i, bS[i]); tprintf(s->avctx, "\n"); }
            filter_mb_edgeh( h, &img_y[j*linesize], tmp_linesize, bS, qp );
            filter_mb_edgech( h, &img_cb[j*uvlinesize], tmp_uvlinesize, bS,
                              ( h->chroma_qp[0] + get_chroma_qp( h, 0, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1);
            filter_mb_edgech( h, &img_cr[j*uvlinesize], tmp_uvlinesize, bS,
                              ( h->chroma_qp[1] + get_chroma_qp( h, 1, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1);
        }
        start = 1;
    }
    for( edge = start; edge < edges; edge++ ) {
        const int mbn_xy = edge > 0 ? mb_xy : mbm_xy;
        const int mbn_type = s->current_picture.mb_type[mbn_xy];
        int (*ref2frmn)[64] = edge > 0 ? ref2frm : ref2frmm;
        int16_t bS[4];
        int qp;
        if( (edge&1) && IS_8x8DCT(mb_type) )
            continue;
        if( IS_INTRA(mb_type) ||
            IS_INTRA(mbn_type) ) {
            int value;
            if (edge == 0) {
                if (   (!IS_INTERLACED(mb_type) && !IS_INTERLACED(mbm_type))
                    || ((FRAME_MBAFF || (s->picture_structure != PICT_FRAME)) && (dir == 0))
                ) {
                    value = 4;
                } else {
                    value = 3;
                }
            } else {
                value = 3;
            }
            bS[0] = bS[1] = bS[2] = bS[3] = value;
        } else {
            int i, l;
            int mv_done;
            if( edge & mask_edge ) {
                bS[0] = bS[1] = bS[2] = bS[3] = 0;
                mv_done = 1;
            }
            else if( FRAME_MBAFF && IS_INTERLACED(mb_type ^ mbn_type)) {
                bS[0] = bS[1] = bS[2] = bS[3] = 1;
                mv_done = 1;
            }
            else if( mask_par0 && (edge || (mbn_type & (MB_TYPE_16x16 | (MB_TYPE_8x16 >> dir)))) ) {
                int b_idx= 8 + 4 + edge * (dir ? 8:1);
                int bn_idx= b_idx - (dir ? 8:1);
                int v = 0;
                for( l = 0; !v && l < 1 + (h->slice_type_nos == FF_B_TYPE); l++ ) {
                    v |= ref2frm[l][h->ref_cache[l][b_idx]] != ref2frmn[l][h->ref_cache[l][bn_idx]] |
                         h->mv_cache[l][b_idx][0] - h->mv_cache[l][bn_idx][0] + 3 >= 7U |
                         FFABS( h->mv_cache[l][b_idx][1] - h->mv_cache[l][bn_idx][1] ) >= mvy_limit;
                }
                if(h->slice_type_nos == FF_B_TYPE && v){
                    v=0;
                    for( l = 0; !v && l < 2; l++ ) {
                        int ln= 1-l;
                        v |= ref2frm[l][h->ref_cache[l][b_idx]] != ref2frmn[ln][h->ref_cache[ln][bn_idx]] |
                            h->mv_cache[l][b_idx][0] - h->mv_cache[ln][bn_idx][0] + 3 >= 7U |
                            FFABS( h->mv_cache[l][b_idx][1] - h->mv_cache[ln][bn_idx][1] ) >= mvy_limit;
                    }
                }
                bS[0] = bS[1] = bS[2] = bS[3] = v;
                mv_done = 1;
            }
            else
                mv_done = 0;
            for( i = 0; i < 4; i++ ) {
                int x = dir == 0 ? edge : i;
                int y = dir == 0 ? i    : edge;
                int b_idx= 8 + 4 + x + 8*y;
                int bn_idx= b_idx - (dir ? 8:1);
                if( h->non_zero_count_cache[b_idx] |
                    h->non_zero_count_cache[bn_idx] ) {
                    bS[i] = 2;
                }
                else if(!mv_done)
                {
                    bS[i] = 0;
                    for( l = 0; l < 1 + (h->slice_type_nos == FF_B_TYPE); l++ ) {
                        if( ref2frm[l][h->ref_cache[l][b_idx]] != ref2frmn[l][h->ref_cache[l][bn_idx]] |
                            h->mv_cache[l][b_idx][0] - h->mv_cache[l][bn_idx][0] + 3 >= 7U |
                            FFABS( h->mv_cache[l][b_idx][1] - h->mv_cache[l][bn_idx][1] ) >= mvy_limit ) {
                            bS[i] = 1;
                            break;
                        }
                    }
                    if(h->slice_type_nos == FF_B_TYPE && bS[i]){
                        bS[i] = 0;
                        for( l = 0; l < 2; l++ ) {
                            int ln= 1-l;
                            if( ref2frm[l][h->ref_cache[l][b_idx]] != ref2frmn[ln][h->ref_cache[ln][bn_idx]] |
                                h->mv_cache[l][b_idx][0] - h->mv_cache[ln][bn_idx][0] + 3 >= 7U |
                                FFABS( h->mv_cache[l][b_idx][1] - h->mv_cache[ln][bn_idx][1] ) >= mvy_limit ) {
                                bS[i] = 1;
                                break;
                            }
                        }
                    }
                }
            }
            if(bS[0]+bS[1]+bS[2]+bS[3] == 0)
                continue;
        }
        qp = ( s->current_picture.qscale_table[mb_xy] + s->current_picture.qscale_table[mbn_xy] + 1 ) >> 1;
        tprintf(s->avctx, "filter mb:%d/%d dir:%d edge:%d, QPy:%d ls:%d uvls:%d", mb_x, mb_y, dir, edge, qp, linesize, uvlinesize);
        if( dir == 0 ) {
            filter_mb_edgev( h, &img_y[4*edge], linesize, bS, qp );
            if( (edge&1) == 0 ) {
                filter_mb_edgecv( h, &img_cb[2*edge], uvlinesize, bS,
                                  ( h->chroma_qp[0] + get_chroma_qp( h, 0, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1);
                filter_mb_edgecv( h, &img_cr[2*edge], uvlinesize, bS,
                                  ( h->chroma_qp[1] + get_chroma_qp( h, 1, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1);
            }
        } else {
            filter_mb_edgeh( h, &img_y[4*edge*linesize], linesize, bS, qp );
            if( (edge&1) == 0 ) {
                filter_mb_edgech( h, &img_cb[2*edge*uvlinesize], uvlinesize, bS,
                                  ( h->chroma_qp[0] + get_chroma_qp( h, 0, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1);
                filter_mb_edgech( h, &img_cr[2*edge*uvlinesize], uvlinesize, bS,
                                  ( h->chroma_qp[1] + get_chroma_qp( h, 1, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1);
            }
        }
    }
}
['static av_always_inline void filter_mb_dir(H264Context *h, int mb_x, int mb_y, uint8_t *img_y, uint8_t *img_cb, uint8_t *img_cr, unsigned int linesize, unsigned int uvlinesize, int mb_xy, int mb_type, int mvy_limit, int first_vertical_edge_done, int dir) {\n    MpegEncContext * const s = &h->s;\n    int edge;\n    const int mbm_xy = dir == 0 ? mb_xy -1 : h->top_mb_xy;\n    const int mbm_type = s->current_picture.mb_type[mbm_xy];\n    int (*ref2frm) [64] = h->ref2frm[ h->slice_num          &(MAX_SLICES-1) ][0] + (MB_MBAFF ? 20 : 2);\n    int (*ref2frmm)[64] = h->ref2frm[ h->slice_table[mbm_xy]&(MAX_SLICES-1) ][0] + (MB_MBAFF ? 20 : 2);\n    int start = h->slice_table[mbm_xy] == 0xFFFF ? 1 : 0;\n    const int edges = (mb_type & (MB_TYPE_16x16|MB_TYPE_SKIP))\n                              == (MB_TYPE_16x16|MB_TYPE_SKIP) ? 1 : 4;\n    const int mask_edge = (mb_type & (MB_TYPE_16x16 | (MB_TYPE_16x8 << dir))) ? 3 :\n                          (mb_type & (MB_TYPE_8x16 >> dir)) ? 1 : 0;\n    const int mask_par0 = mb_type & (MB_TYPE_16x16 | (MB_TYPE_8x16 >> dir));\n    if (first_vertical_edge_done) {\n        start = 1;\n    }\n    if (h->deblocking_filter==2 && h->slice_table[mbm_xy] != h->slice_table[mb_xy])\n        start = 1;\n    if (FRAME_MBAFF && (dir == 1) && ((mb_y&1) == 0) && start == 0\n        && !IS_INTERLACED(mb_type)\n        && IS_INTERLACED(mbm_type)\n        ) {\n        static const int nnz_idx[4] = {4,5,6,3};\n        unsigned int tmp_linesize   = 2 *   linesize;\n        unsigned int tmp_uvlinesize = 2 * uvlinesize;\n        int mbn_xy = mb_xy - 2 * s->mb_stride;\n        int qp;\n        int i, j;\n        int16_t bS[4];\n        for(j=0; j<2; j++, mbn_xy += s->mb_stride){\n            if( IS_INTRA(mb_type) ||\n                IS_INTRA(s->current_picture.mb_type[mbn_xy]) ) {\n                bS[0] = bS[1] = bS[2] = bS[3] = 3;\n            } else {\n                const uint8_t *mbn_nnz = h->non_zero_count[mbn_xy];\n                for( i = 0; i < 4; i++ ) {\n                    if( h->non_zero_count_cache[scan8[0]+i] != 0 ||\n                        mbn_nnz[nnz_idx[i]] != 0 )\n                        bS[i] = 2;\n                    else\n                        bS[i] = 1;\n                }\n            }\n            qp = ( s->current_picture.qscale_table[mb_xy] + s->current_picture.qscale_table[mbn_xy] + 1 ) >> 1;\n            tprintf(s->avctx, "filter mb:%d/%d dir:%d edge:%d, QPy:%d ls:%d uvls:%d", mb_x, mb_y, dir, edge, qp, tmp_linesize, tmp_uvlinesize);\n            { int i; for (i = 0; i < 4; i++) tprintf(s->avctx, " bS[%d]:%d", i, bS[i]); tprintf(s->avctx, "\\n"); }\n            filter_mb_edgeh( h, &img_y[j*linesize], tmp_linesize, bS, qp );\n            filter_mb_edgech( h, &img_cb[j*uvlinesize], tmp_uvlinesize, bS,\n                              ( h->chroma_qp[0] + get_chroma_qp( h, 0, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1);\n            filter_mb_edgech( h, &img_cr[j*uvlinesize], tmp_uvlinesize, bS,\n                              ( h->chroma_qp[1] + get_chroma_qp( h, 1, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1);\n        }\n        start = 1;\n    }\n    for( edge = start; edge < edges; edge++ ) {\n        const int mbn_xy = edge > 0 ? mb_xy : mbm_xy;\n        const int mbn_type = s->current_picture.mb_type[mbn_xy];\n        int (*ref2frmn)[64] = edge > 0 ? ref2frm : ref2frmm;\n        int16_t bS[4];\n        int qp;\n        if( (edge&1) && IS_8x8DCT(mb_type) )\n            continue;\n        if( IS_INTRA(mb_type) ||\n            IS_INTRA(mbn_type) ) {\n            int value;\n            if (edge == 0) {\n                if (   (!IS_INTERLACED(mb_type) && !IS_INTERLACED(mbm_type))\n                    || ((FRAME_MBAFF || (s->picture_structure != PICT_FRAME)) && (dir == 0))\n                ) {\n                    value = 4;\n                } else {\n                    value = 3;\n                }\n            } else {\n                value = 3;\n            }\n            bS[0] = bS[1] = bS[2] = bS[3] = value;\n        } else {\n            int i, l;\n            int mv_done;\n            if( edge & mask_edge ) {\n                bS[0] = bS[1] = bS[2] = bS[3] = 0;\n                mv_done = 1;\n            }\n            else if( FRAME_MBAFF && IS_INTERLACED(mb_type ^ mbn_type)) {\n                bS[0] = bS[1] = bS[2] = bS[3] = 1;\n                mv_done = 1;\n            }\n            else if( mask_par0 && (edge || (mbn_type & (MB_TYPE_16x16 | (MB_TYPE_8x16 >> dir)))) ) {\n                int b_idx= 8 + 4 + edge * (dir ? 8:1);\n                int bn_idx= b_idx - (dir ? 8:1);\n                int v = 0;\n                for( l = 0; !v && l < 1 + (h->slice_type_nos == FF_B_TYPE); l++ ) {\n                    v |= ref2frm[l][h->ref_cache[l][b_idx]] != ref2frmn[l][h->ref_cache[l][bn_idx]] |\n                         h->mv_cache[l][b_idx][0] - h->mv_cache[l][bn_idx][0] + 3 >= 7U |\n                         FFABS( h->mv_cache[l][b_idx][1] - h->mv_cache[l][bn_idx][1] ) >= mvy_limit;\n                }\n                if(h->slice_type_nos == FF_B_TYPE && v){\n                    v=0;\n                    for( l = 0; !v && l < 2; l++ ) {\n                        int ln= 1-l;\n                        v |= ref2frm[l][h->ref_cache[l][b_idx]] != ref2frmn[ln][h->ref_cache[ln][bn_idx]] |\n                            h->mv_cache[l][b_idx][0] - h->mv_cache[ln][bn_idx][0] + 3 >= 7U |\n                            FFABS( h->mv_cache[l][b_idx][1] - h->mv_cache[ln][bn_idx][1] ) >= mvy_limit;\n                    }\n                }\n                bS[0] = bS[1] = bS[2] = bS[3] = v;\n                mv_done = 1;\n            }\n            else\n                mv_done = 0;\n            for( i = 0; i < 4; i++ ) {\n                int x = dir == 0 ? edge : i;\n                int y = dir == 0 ? i    : edge;\n                int b_idx= 8 + 4 + x + 8*y;\n                int bn_idx= b_idx - (dir ? 8:1);\n                if( h->non_zero_count_cache[b_idx] |\n                    h->non_zero_count_cache[bn_idx] ) {\n                    bS[i] = 2;\n                }\n                else if(!mv_done)\n                {\n                    bS[i] = 0;\n                    for( l = 0; l < 1 + (h->slice_type_nos == FF_B_TYPE); l++ ) {\n                        if( ref2frm[l][h->ref_cache[l][b_idx]] != ref2frmn[l][h->ref_cache[l][bn_idx]] |\n                            h->mv_cache[l][b_idx][0] - h->mv_cache[l][bn_idx][0] + 3 >= 7U |\n                            FFABS( h->mv_cache[l][b_idx][1] - h->mv_cache[l][bn_idx][1] ) >= mvy_limit ) {\n                            bS[i] = 1;\n                            break;\n                        }\n                    }\n                    if(h->slice_type_nos == FF_B_TYPE && bS[i]){\n                        bS[i] = 0;\n                        for( l = 0; l < 2; l++ ) {\n                            int ln= 1-l;\n                            if( ref2frm[l][h->ref_cache[l][b_idx]] != ref2frmn[ln][h->ref_cache[ln][bn_idx]] |\n                                h->mv_cache[l][b_idx][0] - h->mv_cache[ln][bn_idx][0] + 3 >= 7U |\n                                FFABS( h->mv_cache[l][b_idx][1] - h->mv_cache[ln][bn_idx][1] ) >= mvy_limit ) {\n                                bS[i] = 1;\n                                break;\n                            }\n                        }\n                    }\n                }\n            }\n            if(bS[0]+bS[1]+bS[2]+bS[3] == 0)\n                continue;\n        }\n        qp = ( s->current_picture.qscale_table[mb_xy] + s->current_picture.qscale_table[mbn_xy] + 1 ) >> 1;\n        tprintf(s->avctx, "filter mb:%d/%d dir:%d edge:%d, QPy:%d ls:%d uvls:%d", mb_x, mb_y, dir, edge, qp, linesize, uvlinesize);\n        if( dir == 0 ) {\n            filter_mb_edgev( h, &img_y[4*edge], linesize, bS, qp );\n            if( (edge&1) == 0 ) {\n                filter_mb_edgecv( h, &img_cb[2*edge], uvlinesize, bS,\n                                  ( h->chroma_qp[0] + get_chroma_qp( h, 0, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1);\n                filter_mb_edgecv( h, &img_cr[2*edge], uvlinesize, bS,\n                                  ( h->chroma_qp[1] + get_chroma_qp( h, 1, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1);\n            }\n        } else {\n            filter_mb_edgeh( h, &img_y[4*edge*linesize], linesize, bS, qp );\n            if( (edge&1) == 0 ) {\n                filter_mb_edgech( h, &img_cb[2*edge*uvlinesize], uvlinesize, bS,\n                                  ( h->chroma_qp[0] + get_chroma_qp( h, 0, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1);\n                filter_mb_edgech( h, &img_cr[2*edge*uvlinesize], uvlinesize, bS,\n                                  ( h->chroma_qp[1] + get_chroma_qp( h, 1, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1);\n            }\n        }\n    }\n}']