libavcodec/h264_mb_template.c:350: error: Buffer Overrun L3
  Offset: [-1, 1] Size: 2 by call to `hl_decode_mb_predict_luma`.

libavcodec/h264_mb_template.c:288:10: Assignment
286.     const int plane_count      = (SIMPLE || !CONFIG_GRAY || !(h->flags & AV_CODEC_FLAG_GRAY)) ? 3 : 1;
287. 
288.     for (p = 0; p < plane_count; p++) {
              ^
289.         dest[p] = h->cur_pic.f->data[p] +
290.                   ((mb_x << PIXEL_SHIFT) + mb_y * sl->linesize) * 16;

libavcodec/h264_mb_template.c:350:17: Call
348. 
349.             for (p = 0; p < plane_count; p++)
350.                 hl_decode_mb_predict_luma(h, sl, mb_type, 1, SIMPLE,
                     ^
351.                                           transform_bypass, PIXEL_SHIFT,
352.                                           block_offset, linesize, dest[p], p);

libavcodec/h264_mb.c:612:1: <Offset trace>
610. }
611. 
612. static av_always_inline void hl_decode_mb_predict_luma(const H264Context *h,
     ^
613.                                                        H264SliceContext *sl,
614.                                                        int mb_type, int is_h264,

libavcodec/h264_mb.c:612:1: Parameter `p`
  610. }
  611. 
  612. static av_always_inline void hl_decode_mb_predict_luma(const H264Context *h,
       ^
  613.                                                        H264SliceContext *sl,
  614.                                                        int mb_type, int is_h264,

libavcodec/h264_mb.c:612:1: <Length trace>
610. }
611. 
612. static av_always_inline void hl_decode_mb_predict_luma(const H264Context *h,
     ^
613.                                                        H264SliceContext *sl,
614.                                                        int mb_type, int is_h264,

libavcodec/h264_mb.c:612:1: Parameter `sl->chroma_qp[*]`
  610. }
  611. 
  612. static av_always_inline void hl_decode_mb_predict_luma(const H264Context *h,
       ^
  613.                                                        H264SliceContext *sl,
  614.                                                        int mb_type, int is_h264,

libavcodec/h264_mb.c:625:40: Array access: Offset: [-1, 1] Size: 2 by call to `hl_decode_mb_predict_luma` 
  623.     void (*idct_dc_add)(uint8_t *dst, int16_t *block, int stride);
  624.     int i;
  625.     int qscale = p == 0 ? sl->qscale : sl->chroma_qp[p - 1];
                                              ^
  626.     block_offset += 16 * p;
  627.     if (IS_INTRA4x4(mb_type)) {

static av_always_inline void hl_decode_mb_predict_luma(const H264Context *h,
                                                       H264SliceContext *sl,
                                                       int mb_type, int is_h264,
                                                       int simple,
                                                       int transform_bypass,
                                                       int pixel_shift,
                                                       const int *block_offset,
                                                       int linesize,
                                                       uint8_t *dest_y, int p)
{
    void (*idct_add)(uint8_t *dst, int16_t *block, int stride);
    void (*idct_dc_add)(uint8_t *dst, int16_t *block, int stride);
    int i;
    int qscale = p == 0 ? sl->qscale : sl->chroma_qp[p - 1];
    block_offset += 16 * p;
    if (IS_INTRA4x4(mb_type)) {
        if (IS_8x8DCT(mb_type)) {
            if (transform_bypass) {
                idct_dc_add =
                idct_add    = h->h264dsp.h264_add_pixels8_clear;
            } else {
                idct_dc_add = h->h264dsp.h264_idct8_dc_add;
                idct_add    = h->h264dsp.h264_idct8_add;
            }
            for (i = 0; i < 16; i += 4) {
                uint8_t *const ptr = dest_y + block_offset[i];
                const int dir      = sl->intra4x4_pred_mode_cache[scan8[i]];
                if (transform_bypass && h->sps.profile_idc == 244 && dir <= 1) {
                    h->hpc.pred8x8l_add[dir](ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);
                } else {
                    const int nnz = sl->non_zero_count_cache[scan8[i + p * 16]];
                    h->hpc.pred8x8l[dir](ptr, (sl->topleft_samples_available << i) & 0x8000,
                                         (sl->topright_samples_available << i) & 0x4000, linesize);
                    if (nnz) {
                        if (nnz == 1 && dctcoef_get(sl->mb, pixel_shift, i * 16 + p * 256))
                            idct_dc_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);
                        else
                            idct_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);
                    }
                }
            }
        } else {
            if (transform_bypass) {
                idct_dc_add  =
                idct_add     = h->h264dsp.h264_add_pixels4_clear;
            } else {
                idct_dc_add = h->h264dsp.h264_idct_dc_add;
                idct_add    = h->h264dsp.h264_idct_add;
            }
            for (i = 0; i < 16; i++) {
                uint8_t *const ptr = dest_y + block_offset[i];
                const int dir      = sl->intra4x4_pred_mode_cache[scan8[i]];
                if (transform_bypass && h->sps.profile_idc == 244 && dir <= 1) {
                    h->hpc.pred4x4_add[dir](ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);
                } else {
                    uint8_t *topright;
                    int nnz, tr;
                    uint64_t tr_high;
                    if (dir == DIAG_DOWN_LEFT_PRED || dir == VERT_LEFT_PRED) {
                        const int topright_avail = (sl->topright_samples_available << i) & 0x8000;
                        assert(sl->mb_y || linesize <= block_offset[i]);
                        if (!topright_avail) {
                            if (pixel_shift) {
                                tr_high  = ((uint16_t *)ptr)[3 - linesize / 2] * 0x0001000100010001ULL;
                                topright = (uint8_t *)&tr_high;
                            } else {
                                tr       = ptr[3 - linesize] * 0x01010101u;
                                topright = (uint8_t *)&tr;
                            }
                        } else
                            topright = ptr + (4 << pixel_shift) - linesize;
                    } else
                        topright = NULL;
                    h->hpc.pred4x4[dir](ptr, topright, linesize);
                    nnz = sl->non_zero_count_cache[scan8[i + p * 16]];
                    if (nnz) {
                        if (is_h264) {
                            if (nnz == 1 && dctcoef_get(sl->mb, pixel_shift, i * 16 + p * 256))
                                idct_dc_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);
                            else
                                idct_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);
                        } else if (CONFIG_SVQ3_DECODER)
                            ff_svq3_add_idct_c(ptr, sl->mb + i * 16 + p * 256, linesize, qscale, 0);
                    }
                }
            }
        }
    } else {
        h->hpc.pred16x16[sl->intra16x16_pred_mode](dest_y, linesize);
        if (is_h264) {
            if (sl->non_zero_count_cache[scan8[LUMA_DC_BLOCK_INDEX + p]]) {
                if (!transform_bypass)
                    h->h264dsp.h264_luma_dc_dequant_idct(sl->mb + (p * 256 << pixel_shift),
                                                         sl->mb_luma_dc[p],
                                                         h->dequant4_coeff[p][qscale][0]);
                else {
                    static const uint8_t dc_mapping[16] = {
                         0 * 16,  1 * 16,  4 * 16,  5 * 16,
                         2 * 16,  3 * 16,  6 * 16,  7 * 16,
                         8 * 16,  9 * 16, 12 * 16, 13 * 16,
                        10 * 16, 11 * 16, 14 * 16, 15 * 16
                    };
                    for (i = 0; i < 16; i++)
                        dctcoef_set(sl->mb + (p * 256 << pixel_shift),
                                    pixel_shift, dc_mapping[i],
                                    dctcoef_get(sl->mb_luma_dc[p],
                                                pixel_shift, i));
                }
            }
        } else if (CONFIG_SVQ3_DECODER)
            ff_svq3_luma_dc_dequant_idct_c(sl->mb + p * 256,
                                           sl->mb_luma_dc[p], qscale);
    }
}
['static av_noinline void FUNC(hl_decode_mb_444)(const H264Context *h, H264SliceContext *sl)\n{\n    const int mb_x    = sl->mb_x;\n    const int mb_y    = sl->mb_y;\n    const int mb_xy   = sl->mb_xy;\n    const int mb_type = h->cur_pic.mb_type[mb_xy];\n    uint8_t *dest[3];\n    int linesize;\n    int i, j, p;\n    const int *block_offset = &h->block_offset[0];\n    const int transform_bypass = !SIMPLE && (sl->qscale == 0 && h->sps.transform_bypass);\n    const int plane_count      = (SIMPLE || !CONFIG_GRAY || !(h->flags & AV_CODEC_FLAG_GRAY)) ? 3 : 1;\n    for (p = 0; p < plane_count; p++) {\n        dest[p] = h->cur_pic.f->data[p] +\n                  ((mb_x << PIXEL_SHIFT) + mb_y * sl->linesize) * 16;\n        h->vdsp.prefetch(dest[p] + (sl->mb_x & 3) * 4 * sl->linesize + (64 << PIXEL_SHIFT),\n                         sl->linesize, 4);\n    }\n    h->list_counts[mb_xy] = sl->list_count;\n    if (!SIMPLE && MB_FIELD(sl)) {\n        linesize     = sl->mb_linesize = sl->mb_uvlinesize = sl->linesize * 2;\n        block_offset = &h->block_offset[48];\n        if (mb_y & 1)\n            for (p = 0; p < 3; p++)\n                dest[p] -= sl->linesize * 15;\n        if (FRAME_MBAFF(h)) {\n            int list;\n            for (list = 0; list < sl->list_count; list++) {\n                if (!USES_LIST(mb_type, list))\n                    continue;\n                if (IS_16X16(mb_type)) {\n                    int8_t *ref = &sl->ref_cache[list][scan8[0]];\n                    fill_rectangle(ref, 4, 4, 8, (16 + *ref) ^ (sl->mb_y & 1), 1);\n                } else {\n                    for (i = 0; i < 16; i += 4) {\n                        int ref = sl->ref_cache[list][scan8[i]];\n                        if (ref >= 0)\n                            fill_rectangle(&sl->ref_cache[list][scan8[i]], 2, 2,\n                                           8, (16 + ref) ^ (sl->mb_y & 1), 1);\n                    }\n                }\n            }\n        }\n    } else {\n        linesize = sl->mb_linesize = sl->mb_uvlinesize = sl->linesize;\n    }\n    if (!SIMPLE && IS_INTRA_PCM(mb_type)) {\n        if (PIXEL_SHIFT) {\n            const int bit_depth = h->sps.bit_depth_luma;\n            GetBitContext gb;\n            init_get_bits(&gb, sl->intra_pcm_ptr, 768 * bit_depth);\n            for (p = 0; p < plane_count; p++)\n                for (i = 0; i < 16; i++) {\n                    uint16_t *tmp = (uint16_t *)(dest[p] + i * linesize);\n                    for (j = 0; j < 16; j++)\n                        tmp[j] = get_bits(&gb, bit_depth);\n                }\n        } else {\n            for (p = 0; p < plane_count; p++)\n                for (i = 0; i < 16; i++)\n                    memcpy(dest[p] + i * linesize,\n                           sl->intra_pcm_ptr + p * 256 + i * 16, 16);\n        }\n    } else {\n        if (IS_INTRA(mb_type)) {\n            if (sl->deblocking_filter)\n                xchg_mb_border(h, sl, dest[0], dest[1], dest[2], linesize,\n                               linesize, 1, 1, SIMPLE, PIXEL_SHIFT);\n            for (p = 0; p < plane_count; p++)\n                hl_decode_mb_predict_luma(h, sl, mb_type, 1, SIMPLE,\n                                          transform_bypass, PIXEL_SHIFT,\n                                          block_offset, linesize, dest[p], p);\n            if (sl->deblocking_filter)\n                xchg_mb_border(h, sl, dest[0], dest[1], dest[2], linesize,\n                               linesize, 0, 1, SIMPLE, PIXEL_SHIFT);\n        } else {\n            FUNC(hl_motion_444)(h, sl, dest[0], dest[1], dest[2],\n                      h->qpel_put, h->h264chroma.put_h264_chroma_pixels_tab,\n                      h->qpel_avg, h->h264chroma.avg_h264_chroma_pixels_tab,\n                      h->h264dsp.weight_h264_pixels_tab,\n                      h->h264dsp.biweight_h264_pixels_tab);\n        }\n        for (p = 0; p < plane_count; p++)\n            hl_decode_mb_idct_luma(h, sl, mb_type, 1, SIMPLE, transform_bypass,\n                                   PIXEL_SHIFT, block_offset, linesize,\n                                   dest[p], p);\n    }\n}', 'static av_always_inline void hl_decode_mb_predict_luma(const H264Context *h,\n                                                       H264SliceContext *sl,\n                                                       int mb_type, int is_h264,\n                                                       int simple,\n                                                       int transform_bypass,\n                                                       int pixel_shift,\n                                                       const int *block_offset,\n                                                       int linesize,\n                                                       uint8_t *dest_y, int p)\n{\n    void (*idct_add)(uint8_t *dst, int16_t *block, int stride);\n    void (*idct_dc_add)(uint8_t *dst, int16_t *block, int stride);\n    int i;\n    int qscale = p == 0 ? sl->qscale : sl->chroma_qp[p - 1];\n    block_offset += 16 * p;\n    if (IS_INTRA4x4(mb_type)) {\n        if (IS_8x8DCT(mb_type)) {\n            if (transform_bypass) {\n                idct_dc_add =\n                idct_add    = h->h264dsp.h264_add_pixels8_clear;\n            } else {\n                idct_dc_add = h->h264dsp.h264_idct8_dc_add;\n                idct_add    = h->h264dsp.h264_idct8_add;\n            }\n            for (i = 0; i < 16; i += 4) {\n                uint8_t *const ptr = dest_y + block_offset[i];\n                const int dir      = sl->intra4x4_pred_mode_cache[scan8[i]];\n                if (transform_bypass && h->sps.profile_idc == 244 && dir <= 1) {\n                    h->hpc.pred8x8l_add[dir](ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);\n                } else {\n                    const int nnz = sl->non_zero_count_cache[scan8[i + p * 16]];\n                    h->hpc.pred8x8l[dir](ptr, (sl->topleft_samples_available << i) & 0x8000,\n                                         (sl->topright_samples_available << i) & 0x4000, linesize);\n                    if (nnz) {\n                        if (nnz == 1 && dctcoef_get(sl->mb, pixel_shift, i * 16 + p * 256))\n                            idct_dc_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);\n                        else\n                            idct_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);\n                    }\n                }\n            }\n        } else {\n            if (transform_bypass) {\n                idct_dc_add  =\n                idct_add     = h->h264dsp.h264_add_pixels4_clear;\n            } else {\n                idct_dc_add = h->h264dsp.h264_idct_dc_add;\n                idct_add    = h->h264dsp.h264_idct_add;\n            }\n            for (i = 0; i < 16; i++) {\n                uint8_t *const ptr = dest_y + block_offset[i];\n                const int dir      = sl->intra4x4_pred_mode_cache[scan8[i]];\n                if (transform_bypass && h->sps.profile_idc == 244 && dir <= 1) {\n                    h->hpc.pred4x4_add[dir](ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);\n                } else {\n                    uint8_t *topright;\n                    int nnz, tr;\n                    uint64_t tr_high;\n                    if (dir == DIAG_DOWN_LEFT_PRED || dir == VERT_LEFT_PRED) {\n                        const int topright_avail = (sl->topright_samples_available << i) & 0x8000;\n                        assert(sl->mb_y || linesize <= block_offset[i]);\n                        if (!topright_avail) {\n                            if (pixel_shift) {\n                                tr_high  = ((uint16_t *)ptr)[3 - linesize / 2] * 0x0001000100010001ULL;\n                                topright = (uint8_t *)&tr_high;\n                            } else {\n                                tr       = ptr[3 - linesize] * 0x01010101u;\n                                topright = (uint8_t *)&tr;\n                            }\n                        } else\n                            topright = ptr + (4 << pixel_shift) - linesize;\n                    } else\n                        topright = NULL;\n                    h->hpc.pred4x4[dir](ptr, topright, linesize);\n                    nnz = sl->non_zero_count_cache[scan8[i + p * 16]];\n                    if (nnz) {\n                        if (is_h264) {\n                            if (nnz == 1 && dctcoef_get(sl->mb, pixel_shift, i * 16 + p * 256))\n                                idct_dc_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);\n                            else\n                                idct_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);\n                        } else if (CONFIG_SVQ3_DECODER)\n                            ff_svq3_add_idct_c(ptr, sl->mb + i * 16 + p * 256, linesize, qscale, 0);\n                    }\n                }\n            }\n        }\n    } else {\n        h->hpc.pred16x16[sl->intra16x16_pred_mode](dest_y, linesize);\n        if (is_h264) {\n            if (sl->non_zero_count_cache[scan8[LUMA_DC_BLOCK_INDEX + p]]) {\n                if (!transform_bypass)\n                    h->h264dsp.h264_luma_dc_dequant_idct(sl->mb + (p * 256 << pixel_shift),\n                                                         sl->mb_luma_dc[p],\n                                                         h->dequant4_coeff[p][qscale][0]);\n                else {\n                    static const uint8_t dc_mapping[16] = {\n                         0 * 16,  1 * 16,  4 * 16,  5 * 16,\n                         2 * 16,  3 * 16,  6 * 16,  7 * 16,\n                         8 * 16,  9 * 16, 12 * 16, 13 * 16,\n                        10 * 16, 11 * 16, 14 * 16, 15 * 16\n                    };\n                    for (i = 0; i < 16; i++)\n                        dctcoef_set(sl->mb + (p * 256 << pixel_shift),\n                                    pixel_shift, dc_mapping[i],\n                                    dctcoef_get(sl->mb_luma_dc[p],\n                                                pixel_shift, i));\n                }\n            }\n        } else if (CONFIG_SVQ3_DECODER)\n            ff_svq3_luma_dc_dequant_idct_c(sl->mb + p * 256,\n                                           sl->mb_luma_dc[p], qscale);\n    }\n}']