libavcodec/h264.c:3970: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: 16 by call to `execute_decode_slices`.

libavcodec/h264.c:3755:9: Assignment
3753.     for(;pass <= 1;pass++){
3754.         buf_index = 0;
3755.         context_count = 0;
              ^
3756.         next_avc = h->is_avc ? 0 : buf_size;
3757.         nal_index = 0;

libavcodec/h264.c:3970:13: Call
3968. 
3969.         if(context_count == h->max_contexts) {
3970.             execute_decode_slices(h, context_count);
                  ^
3971.             context_count = 0;
3972.         }

libavcodec/h264.c:3700:1: <Offset trace>
3698.  * @param context_count number of contexts to execute
3699.  */
3700. static int execute_decode_slices(H264Context *h, int context_count){
      ^
3701.     MpegEncContext * const s = &h->s;
3702.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:3700:1: Parameter `context_count`
  3698.  * @param context_count number of contexts to execute
  3699.  */
  3700. static int execute_decode_slices(H264Context *h, int context_count){
        ^
  3701.     MpegEncContext * const s = &h->s;
  3702.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:3700:1: <Length trace>
3698.  * @param context_count number of contexts to execute
3699.  */
3700. static int execute_decode_slices(H264Context *h, int context_count){
      ^
3701.     MpegEncContext * const s = &h->s;
3702.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:3700:1: Parameter `h->thread_context[*]`
  3698.  * @param context_count number of contexts to execute
  3699.  */
  3700. static int execute_decode_slices(H264Context *h, int context_count){
        ^
  3701.     MpegEncContext * const s = &h->s;
  3702.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:3721:14: Array access: Offset: [-1, +oo] Size: 16 by call to `execute_decode_slices` 
  3719. 
  3720.         /* pull back stuff from slices to master context */
  3721.         hx = h->thread_context[context_count - 1];
                     ^
  3722.         s->mb_x = hx->s.mb_x;
  3723.         s->mb_y = hx->s.mb_y;

static int execute_decode_slices(H264Context *h, int context_count){
    MpegEncContext * const s = &h->s;
    AVCodecContext * const avctx= s->avctx;
    H264Context *hx;
    int i;
    if (s->avctx->hwaccel || s->avctx->codec->capabilities&CODEC_CAP_HWACCEL_VDPAU)
        return 0;
    if(context_count == 1) {
        return decode_slice(avctx, &h);
    } else {
        for(i = 1; i < context_count; i++) {
            hx = h->thread_context[i];
            hx->s.err_recognition = avctx->err_recognition;
            hx->s.error_count = 0;
        }
        avctx->execute(avctx, decode_slice,
                       h->thread_context, NULL, context_count, sizeof(void*));
        hx = h->thread_context[context_count - 1];
        s->mb_x = hx->s.mb_x;
        s->mb_y = hx->s.mb_y;
        s->dropable = hx->s.dropable;
        s->picture_structure = hx->s.picture_structure;
        for(i = 1; i < context_count; i++)
            h->s.error_count += h->thread_context[i]->s.error_count;
    }
    return 0;
}
['static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){\n    MpegEncContext * const s = &h->s;\n    AVCodecContext * const avctx= s->avctx;\n    H264Context *hx;\n    int buf_index;\n    int context_count;\n    int next_avc;\n    int pass = !(avctx->active_thread_type & FF_THREAD_FRAME);\n    int nals_needed=0;\n    int nal_index;\n    h->max_contexts = (HAVE_THREADS && (s->avctx->active_thread_type&FF_THREAD_SLICE)) ? avctx->thread_count : 1;\n    if(!(s->flags2 & CODEC_FLAG2_CHUNKS)){\n        h->current_slice = 0;\n        if (!s->first_field)\n            s->current_picture_ptr= NULL;\n        ff_h264_reset_sei(h);\n    }\n    for(;pass <= 1;pass++){\n        buf_index = 0;\n        context_count = 0;\n        next_avc = h->is_avc ? 0 : buf_size;\n        nal_index = 0;\n    for(;;){\n        int consumed;\n        int dst_length;\n        int bit_length;\n        uint8_t *ptr;\n        int i, nalsize = 0;\n        int err;\n        if(buf_index >= next_avc) {\n            if (buf_index >= buf_size - h->nal_length_size) break;\n            nalsize = 0;\n            for(i = 0; i < h->nal_length_size; i++)\n                nalsize = (nalsize << 8) | buf[buf_index++];\n            if(nalsize <= 0 || nalsize > buf_size - buf_index){\n                av_log(h->s.avctx, AV_LOG_ERROR, "AVC: nal size %d\\n", nalsize);\n                break;\n            }\n            next_avc= buf_index + nalsize;\n        } else {\n            for(; buf_index + 3 < next_avc; buf_index++){\n                if(buf[buf_index] == 0 && buf[buf_index+1] == 0 && buf[buf_index+2] == 1)\n                    break;\n            }\n            if(buf_index+3 >= buf_size) break;\n            buf_index+=3;\n            if(buf_index >= next_avc) continue;\n        }\n        hx = h->thread_context[context_count];\n        ptr= ff_h264_decode_nal(hx, buf + buf_index, &dst_length, &consumed, next_avc - buf_index);\n        if (ptr==NULL || dst_length < 0){\n            return -1;\n        }\n        i= buf_index + consumed;\n        if((s->workaround_bugs & FF_BUG_AUTODETECT) && i+3<next_avc &&\n           buf[i]==0x00 && buf[i+1]==0x00 && buf[i+2]==0x01 && buf[i+3]==0xE0)\n            s->workaround_bugs |= FF_BUG_TRUNCATED;\n        if(!(s->workaround_bugs & FF_BUG_TRUNCATED)){\n        while(ptr[dst_length - 1] == 0 && dst_length > 0)\n            dst_length--;\n        }\n        bit_length= !dst_length ? 0 : (8*dst_length - ff_h264_decode_rbsp_trailing(h, ptr + dst_length - 1));\n        if(s->avctx->debug&FF_DEBUG_STARTCODE){\n            av_log(h->s.avctx, AV_LOG_DEBUG, "NAL %d at %d/%d length %d\\n", hx->nal_unit_type, buf_index, buf_size, dst_length);\n        }\n        if (h->is_avc && (nalsize != consumed) && nalsize){\n            if (bit_length & 7)\n                ptr[bit_length >> 3] = ptr[bit_length >> 3] & (0xff << 8 - (bit_length & 7));\n            av_log(h->s.avctx, AV_LOG_DEBUG, "AVC: Consumed only %d bytes instead of %d\\n", consumed, nalsize);\n        }\n        buf_index += consumed;\n        nal_index++;\n        if(pass == 0) {\n            switch (hx->nal_unit_type) {\n                case NAL_SPS:\n                case NAL_PPS:\n                    nals_needed = nal_index;\n                    break;\n                case NAL_IDR_SLICE:\n                case NAL_SLICE:\n                    init_get_bits(&hx->s.gb, ptr, bit_length);\n                    if (!get_ue_golomb(&hx->s.gb))\n                        nals_needed = nal_index;\n            }\n            continue;\n        }\n        if(avctx->skip_frame >= AVDISCARD_NONREF && h->nal_ref_idc  == 0)\n            continue;\n      again:\n        err = 0;\n        switch(hx->nal_unit_type){\n        case NAL_IDR_SLICE:\n            if (h->nal_unit_type != NAL_IDR_SLICE) {\n                av_log(h->s.avctx, AV_LOG_ERROR, "Invalid mix of idr and non-idr slices");\n                return -1;\n            }\n            idr(h);\n        case NAL_SLICE:\n            init_get_bits(&hx->s.gb, ptr, bit_length);\n            hx->intra_gb_ptr=\n            hx->inter_gb_ptr= &hx->s.gb;\n            hx->s.data_partitioning = 0;\n            if((err = decode_slice_header(hx, h)))\n               break;\n            s->current_picture_ptr->f.key_frame |=\n                    (hx->nal_unit_type == NAL_IDR_SLICE) ||\n                    (h->sei_recovery_frame_cnt >= 0);\n            if (h->current_slice == 1) {\n                if(!(s->flags2 & CODEC_FLAG2_CHUNKS)) {\n                    decode_postinit(h, nal_index >= nals_needed);\n                }\n                if (s->avctx->hwaccel && s->avctx->hwaccel->start_frame(s->avctx, NULL, 0) < 0)\n                    return -1;\n                if(CONFIG_H264_VDPAU_DECODER && s->avctx->codec->capabilities&CODEC_CAP_HWACCEL_VDPAU)\n                    ff_vdpau_h264_picture_start(s);\n            }\n            if(hx->redundant_pic_count==0\n               && (avctx->skip_frame < AVDISCARD_NONREF || hx->nal_ref_idc)\n               && (avctx->skip_frame < AVDISCARD_BIDIR  || hx->slice_type_nos!=AV_PICTURE_TYPE_B)\n               && (avctx->skip_frame < AVDISCARD_NONKEY || hx->slice_type_nos==AV_PICTURE_TYPE_I)\n               && avctx->skip_frame < AVDISCARD_ALL){\n                if(avctx->hwaccel) {\n                    if (avctx->hwaccel->decode_slice(avctx, &buf[buf_index - consumed], consumed) < 0)\n                        return -1;\n                }else\n                if(CONFIG_H264_VDPAU_DECODER && s->avctx->codec->capabilities&CODEC_CAP_HWACCEL_VDPAU){\n                    static const uint8_t start_code[] = {0x00, 0x00, 0x01};\n                    ff_vdpau_add_data_chunk(s, start_code, sizeof(start_code));\n                    ff_vdpau_add_data_chunk(s, &buf[buf_index - consumed], consumed );\n                }else\n                    context_count++;\n            }\n            break;\n        case NAL_DPA:\n            init_get_bits(&hx->s.gb, ptr, bit_length);\n            hx->intra_gb_ptr=\n            hx->inter_gb_ptr= NULL;\n            if ((err = decode_slice_header(hx, h)) < 0)\n                break;\n            hx->s.data_partitioning = 1;\n            break;\n        case NAL_DPB:\n            init_get_bits(&hx->intra_gb, ptr, bit_length);\n            hx->intra_gb_ptr= &hx->intra_gb;\n            break;\n        case NAL_DPC:\n            init_get_bits(&hx->inter_gb, ptr, bit_length);\n            hx->inter_gb_ptr= &hx->inter_gb;\n            if(hx->redundant_pic_count==0 && hx->intra_gb_ptr && hx->s.data_partitioning\n               && s->context_initialized\n               && (avctx->skip_frame < AVDISCARD_NONREF || hx->nal_ref_idc)\n               && (avctx->skip_frame < AVDISCARD_BIDIR  || hx->slice_type_nos!=AV_PICTURE_TYPE_B)\n               && (avctx->skip_frame < AVDISCARD_NONKEY || hx->slice_type_nos==AV_PICTURE_TYPE_I)\n               && avctx->skip_frame < AVDISCARD_ALL)\n                context_count++;\n            break;\n        case NAL_SEI:\n            init_get_bits(&s->gb, ptr, bit_length);\n            ff_h264_decode_sei(h);\n            break;\n        case NAL_SPS:\n            init_get_bits(&s->gb, ptr, bit_length);\n            ff_h264_decode_seq_parameter_set(h);\n            if (s->flags& CODEC_FLAG_LOW_DELAY ||\n                (h->sps.bitstream_restriction_flag && !h->sps.num_reorder_frames))\n                s->low_delay=1;\n            if(avctx->has_b_frames < 2)\n                avctx->has_b_frames= !s->low_delay;\n            if (avctx->bits_per_raw_sample != h->sps.bit_depth_luma ||\n                h->cur_chroma_format_idc != h->sps.chroma_format_idc) {\n                if (h->sps.bit_depth_luma >= 8 && h->sps.bit_depth_luma <= 10) {\n                    avctx->bits_per_raw_sample = h->sps.bit_depth_luma;\n                    h->cur_chroma_format_idc = h->sps.chroma_format_idc;\n                    h->pixel_shift = h->sps.bit_depth_luma > 8;\n                    ff_h264dsp_init(&h->h264dsp, h->sps.bit_depth_luma, h->sps.chroma_format_idc);\n                    ff_h264_pred_init(&h->hpc, s->codec_id, h->sps.bit_depth_luma, h->sps.chroma_format_idc);\n                    s->dsp.dct_bits = h->sps.bit_depth_luma > 8 ? 32 : 16;\n                    dsputil_init(&s->dsp, s->avctx);\n                } else {\n                    av_log(avctx, AV_LOG_ERROR, "Unsupported bit depth: %d\\n", h->sps.bit_depth_luma);\n                    return -1;\n                }\n            }\n            break;\n        case NAL_PPS:\n            init_get_bits(&s->gb, ptr, bit_length);\n            ff_h264_decode_picture_parameter_set(h, bit_length);\n            break;\n        case NAL_AUD:\n        case NAL_END_SEQUENCE:\n        case NAL_END_STREAM:\n        case NAL_FILLER_DATA:\n        case NAL_SPS_EXT:\n        case NAL_AUXILIARY_SLICE:\n            break;\n        default:\n            av_log(avctx, AV_LOG_DEBUG, "Unknown NAL code: %d (%d bits)\\n", hx->nal_unit_type, bit_length);\n        }\n        if(context_count == h->max_contexts) {\n            execute_decode_slices(h, context_count);\n            context_count = 0;\n        }\n        if (err < 0)\n            av_log(h->s.avctx, AV_LOG_ERROR, "decode_slice_header error\\n");\n        else if(err == 1) {\n            h->nal_unit_type = hx->nal_unit_type;\n            h->nal_ref_idc   = hx->nal_ref_idc;\n            hx = h;\n            goto again;\n        }\n    }\n    }\n    if(context_count)\n        execute_decode_slices(h, context_count);\n    return buf_index;\n}', 'static int execute_decode_slices(H264Context *h, int context_count){\n    MpegEncContext * const s = &h->s;\n    AVCodecContext * const avctx= s->avctx;\n    H264Context *hx;\n    int i;\n    if (s->avctx->hwaccel || s->avctx->codec->capabilities&CODEC_CAP_HWACCEL_VDPAU)\n        return 0;\n    if(context_count == 1) {\n        return decode_slice(avctx, &h);\n    } else {\n        for(i = 1; i < context_count; i++) {\n            hx = h->thread_context[i];\n            hx->s.err_recognition = avctx->err_recognition;\n            hx->s.error_count = 0;\n        }\n        avctx->execute(avctx, decode_slice,\n                       h->thread_context, NULL, context_count, sizeof(void*));\n        hx = h->thread_context[context_count - 1];\n        s->mb_x = hx->s.mb_x;\n        s->mb_y = hx->s.mb_y;\n        s->dropable = hx->s.dropable;\n        s->picture_structure = hx->s.picture_structure;\n        for(i = 1; i < context_count; i++)\n            h->s.error_count += h->thread_context[i]->s.error_count;\n    }\n    return 0;\n}']