libavcodec/h264.c:4902: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: 16 by call to `decode_nal_units`.

libavcodec/h264.c:4856:1: Parameter `avctx->priv_data->slice_context_count`
4854. }
4855. 
4856. static int decode_frame(AVCodecContext *avctx, void *data,
      ^
4857.                         int *got_frame, AVPacket *avpkt)
4858. {

libavcodec/h264.c:4902:17: Call
4900.     }
4901. 
4902.     buf_index = decode_nal_units(h, buf, buf_size, 0);
                      ^
4903.     if (buf_index < 0)
4904.         return AVERROR_INVALIDDATA;

libavcodec/h264.c:4541:9: Assignment
  4539.     for (; pass <= 1; pass++) {
  4540.         buf_index     = 0;
  4541.         context_count = 0;
                ^
  4542.         next_avc      = h->is_avc ? 0 : buf_size;
  4543.         nal_index     = 0;

libavcodec/h264.c:4792:17: Call
  4790. 
  4791.             if (context_count == h->max_contexts) {
  4792.                 execute_decode_slices(h, context_count);
                        ^
  4793.                 context_count = 0;
  4794.             }

libavcodec/h264.c:4486:1: <Offset trace>
4484.  * @param context_count number of contexts to execute
4485.  */
4486. static int execute_decode_slices(H264Context *h, int context_count)
      ^
4487. {
4488.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264.c:4486:1: Parameter `context_count`
    4484.  * @param context_count number of contexts to execute
    4485.  */
    4486. static int execute_decode_slices(H264Context *h, int context_count)
          ^
    4487. {
    4488.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264.c:4486:1: <Length trace>
4484.  * @param context_count number of contexts to execute
4485.  */
4486. static int execute_decode_slices(H264Context *h, int context_count)
      ^
4487. {
4488.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264.c:4486:1: Parameter `h->thread_context[*]`
    4484.  * @param context_count number of contexts to execute
    4485.  */
    4486. static int execute_decode_slices(H264Context *h, int context_count)
          ^
    4487. {
    4488.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264.c:4506:32: Array access: Offset: [-1, +oo] Size: 16 by call to `decode_nal_units` 
    4504. 
    4505.         /* pull back stuff from slices to master context */
    4506.         hx                   = h->thread_context[context_count - 1];
                                         ^
    4507.         h->mb_x              = hx->mb_x;
    4508.         h->mb_y              = hx->mb_y;

static int execute_decode_slices(H264Context *h, int context_count)
{
    AVCodecContext *const avctx = h->avctx;
    H264Context *hx;
    int i;
    if (h->avctx->hwaccel)
        return 0;
    if (context_count == 1) {
        return decode_slice(avctx, &h);
    } else {
        for (i = 1; i < context_count; i++) {
            hx                 = h->thread_context[i];
            hx->er.error_count = 0;
        }
        avctx->execute(avctx, decode_slice, h->thread_context,
                       NULL, context_count, sizeof(void *));
        hx                   = h->thread_context[context_count - 1];
        h->mb_x              = hx->mb_x;
        h->mb_y              = hx->mb_y;
        h->droppable         = hx->droppable;
        h->picture_structure = hx->picture_structure;
        for (i = 1; i < context_count; i++)
            h->er.error_count += h->thread_context[i]->er.error_count;
    }
    return 0;
}
['static int decode_frame(AVCodecContext *avctx, void *data,\n                        int *got_frame, AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size       = avpkt->size;\n    H264Context *h     = avctx->priv_data;\n    AVFrame *pict      = data;\n    int buf_index      = 0;\n    int ret;\n    h->flags = avctx->flags;\nout:\n    if (buf_size == 0) {\n        Picture *out;\n        int i, out_idx;\n        h->cur_pic_ptr = NULL;\n        out     = h->delayed_pic[0];\n        out_idx = 0;\n        for (i = 1;\n             h->delayed_pic[i] &&\n             !h->delayed_pic[i]->f.key_frame &&\n             !h->delayed_pic[i]->mmco_reset;\n             i++)\n            if (h->delayed_pic[i]->poc < out->poc) {\n                out     = h->delayed_pic[i];\n                out_idx = i;\n            }\n        for (i = out_idx; h->delayed_pic[i]; i++)\n            h->delayed_pic[i] = h->delayed_pic[i + 1];\n        if (out) {\n            ret = output_frame(h, pict, &out->f);\n            if (ret < 0)\n                return ret;\n            *got_frame = 1;\n        }\n        return buf_index;\n    }\n    buf_index = decode_nal_units(h, buf, buf_size, 0);\n    if (buf_index < 0)\n        return AVERROR_INVALIDDATA;\n    if (!h->cur_pic_ptr && h->nal_unit_type == NAL_END_SEQUENCE) {\n        buf_size = 0;\n        goto out;\n    }\n    if (!(avctx->flags2 & CODEC_FLAG2_CHUNKS) && !h->cur_pic_ptr) {\n        if (avctx->skip_frame >= AVDISCARD_NONREF)\n            return 0;\n        av_log(avctx, AV_LOG_ERROR, "no frame!\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (!(avctx->flags2 & CODEC_FLAG2_CHUNKS) ||\n        (h->mb_y >= h->mb_height && h->mb_height)) {\n        if (avctx->flags2 & CODEC_FLAG2_CHUNKS)\n            decode_postinit(h, 1);\n        field_end(h, 0);\n        *got_frame = 0;\n        if (h->next_output_pic && ((avctx->flags & CODEC_FLAG_OUTPUT_CORRUPT) ||\n                                   h->next_output_pic->recovered)) {\n            if (!h->next_output_pic->recovered)\n                h->next_output_pic->f.flags |= AV_FRAME_FLAG_CORRUPT;\n            ret = output_frame(h, pict, &h->next_output_pic->f);\n            if (ret < 0)\n                return ret;\n            *got_frame = 1;\n        }\n    }\n    assert(pict->buf[0] || !*got_frame);\n    return get_consumed_bytes(buf_index, buf_size);\n}', 'static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size,\n                            int parse_extradata)\n{\n    AVCodecContext *const avctx = h->avctx;\n    H264Context *hx;\n    int buf_index;\n    int context_count;\n    int next_avc;\n    int pass = !(avctx->active_thread_type & FF_THREAD_FRAME);\n    int nals_needed = 0;\n    int nal_index;\n    int ret = 0;\n    h->max_contexts = h->slice_context_count;\n    if (!(avctx->flags2 & CODEC_FLAG2_CHUNKS)) {\n        h->current_slice = 0;\n        if (!h->first_field)\n            h->cur_pic_ptr = NULL;\n        ff_h264_reset_sei(h);\n    }\n    for (; pass <= 1; pass++) {\n        buf_index     = 0;\n        context_count = 0;\n        next_avc      = h->is_avc ? 0 : buf_size;\n        nal_index     = 0;\n        for (;;) {\n            int consumed;\n            int dst_length;\n            int bit_length;\n            const uint8_t *ptr;\n            int i, nalsize = 0;\n            int err;\n            if (buf_index >= next_avc) {\n                if (buf_index >= buf_size - h->nal_length_size)\n                    break;\n                nalsize = 0;\n                for (i = 0; i < h->nal_length_size; i++)\n                    nalsize = (nalsize << 8) | buf[buf_index++];\n                if (nalsize <= 0 || nalsize > buf_size - buf_index) {\n                    av_log(h->avctx, AV_LOG_ERROR,\n                           "AVC: nal size %d\\n", nalsize);\n                    break;\n                }\n                next_avc = buf_index + nalsize;\n            } else {\n                for (; buf_index + 3 < next_avc; buf_index++)\n                    if (buf[buf_index]     == 0 &&\n                        buf[buf_index + 1] == 0 &&\n                        buf[buf_index + 2] == 1)\n                        break;\n                if (buf_index + 3 >= buf_size) {\n                    buf_index = buf_size;\n                    break;\n                }\n                buf_index += 3;\n                if (buf_index >= next_avc)\n                    continue;\n            }\n            hx = h->thread_context[context_count];\n            ptr = ff_h264_decode_nal(hx, buf + buf_index, &dst_length,\n                                     &consumed, next_avc - buf_index);\n            if (ptr == NULL || dst_length < 0) {\n                ret = -1;\n                goto end;\n            }\n            i = buf_index + consumed;\n            if ((h->workaround_bugs & FF_BUG_AUTODETECT) && i + 3 < next_avc &&\n                buf[i]     == 0x00 && buf[i + 1] == 0x00 &&\n                buf[i + 2] == 0x01 && buf[i + 3] == 0xE0)\n                h->workaround_bugs |= FF_BUG_TRUNCATED;\n            if (!(h->workaround_bugs & FF_BUG_TRUNCATED))\n                while (dst_length > 0 && ptr[dst_length - 1] == 0)\n                    dst_length--;\n            bit_length = !dst_length ? 0\n                                     : (8 * dst_length -\n                                        decode_rbsp_trailing(h, ptr + dst_length - 1));\n            if (h->avctx->debug & FF_DEBUG_STARTCODE)\n                av_log(h->avctx, AV_LOG_DEBUG,\n                       "NAL %d at %d/%d length %d\\n",\n                       hx->nal_unit_type, buf_index, buf_size, dst_length);\n            if (h->is_avc && (nalsize != consumed) && nalsize)\n                av_log(h->avctx, AV_LOG_DEBUG,\n                       "AVC: Consumed only %d bytes instead of %d\\n",\n                       consumed, nalsize);\n            buf_index += consumed;\n            nal_index++;\n            if (pass == 0) {\n                switch (hx->nal_unit_type) {\n                case NAL_SPS:\n                case NAL_PPS:\n                    nals_needed = nal_index;\n                    break;\n                case NAL_DPA:\n                case NAL_IDR_SLICE:\n                case NAL_SLICE:\n                    init_get_bits(&hx->gb, ptr, bit_length);\n                    if (!get_ue_golomb(&hx->gb))\n                        nals_needed = nal_index;\n                }\n                continue;\n            }\n            if (avctx->skip_frame >= AVDISCARD_NONREF &&\n                h->nal_ref_idc == 0 &&\n                h->nal_unit_type != NAL_SEI)\n                continue;\nagain:\n            if (parse_extradata && HAVE_THREADS &&\n                (h->avctx->active_thread_type & FF_THREAD_FRAME) &&\n                (hx->nal_unit_type != NAL_PPS &&\n                 hx->nal_unit_type != NAL_SPS)) {\n                if (hx->nal_unit_type < NAL_AUD ||\n                    hx->nal_unit_type > NAL_AUXILIARY_SLICE)\n                    av_log(avctx, AV_LOG_INFO,\n                           "Ignoring NAL unit %d during extradata parsing\\n",\n                           hx->nal_unit_type);\n                hx->nal_unit_type = NAL_FF_IGNORE;\n            }\n            err = 0;\n            switch (hx->nal_unit_type) {\n            case NAL_IDR_SLICE:\n                if (h->nal_unit_type != NAL_IDR_SLICE) {\n                    av_log(h->avctx, AV_LOG_ERROR,\n                           "Invalid mix of idr and non-idr slices\\n");\n                    ret = -1;\n                    goto end;\n                }\n                idr(h);\n            case NAL_SLICE:\n                init_get_bits(&hx->gb, ptr, bit_length);\n                hx->intra_gb_ptr      =\n                hx->inter_gb_ptr      = &hx->gb;\n                hx->data_partitioning = 0;\n                if ((err = decode_slice_header(hx, h)))\n                    break;\n                if (h->sei_recovery_frame_cnt >= 0 && h->recovery_frame < 0) {\n                    h->recovery_frame = (h->frame_num + h->sei_recovery_frame_cnt) &\n                                        ((1 << h->sps.log2_max_frame_num) - 1);\n                }\n                h->cur_pic_ptr->f.key_frame |=\n                    (hx->nal_unit_type == NAL_IDR_SLICE) ||\n                    (h->sei_recovery_frame_cnt >= 0);\n                if (hx->nal_unit_type == NAL_IDR_SLICE ||\n                    h->recovery_frame == h->frame_num) {\n                    h->recovery_frame         = -1;\n                    h->cur_pic_ptr->recovered = 1;\n                }\n                if (hx->nal_unit_type == NAL_IDR_SLICE)\n                    h->frame_recovered |= FRAME_RECOVERED_IDR;\n                h->cur_pic_ptr->recovered |= !!(h->frame_recovered & FRAME_RECOVERED_IDR);\n                if (h->current_slice == 1) {\n                    if (!(avctx->flags2 & CODEC_FLAG2_CHUNKS))\n                        decode_postinit(h, nal_index >= nals_needed);\n                    if (h->avctx->hwaccel &&\n                        (ret = h->avctx->hwaccel->start_frame(h->avctx, NULL, 0)) < 0)\n                        return ret;\n                }\n                if (hx->redundant_pic_count == 0 &&\n                    (avctx->skip_frame < AVDISCARD_NONREF ||\n                     hx->nal_ref_idc) &&\n                    (avctx->skip_frame < AVDISCARD_BIDIR  ||\n                     hx->slice_type_nos != AV_PICTURE_TYPE_B) &&\n                    (avctx->skip_frame < AVDISCARD_NONKEY ||\n                     hx->slice_type_nos == AV_PICTURE_TYPE_I) &&\n                    avctx->skip_frame < AVDISCARD_ALL) {\n                    if (avctx->hwaccel) {\n                        ret = avctx->hwaccel->decode_slice(avctx,\n                                                           &buf[buf_index - consumed],\n                                                           consumed);\n                        if (ret < 0)\n                            return ret;\n                    } else\n                        context_count++;\n                }\n                break;\n            case NAL_DPA:\n                init_get_bits(&hx->gb, ptr, bit_length);\n                hx->intra_gb_ptr =\n                hx->inter_gb_ptr = NULL;\n                if ((err = decode_slice_header(hx, h)) < 0)\n                    break;\n                hx->data_partitioning = 1;\n                break;\n            case NAL_DPB:\n                init_get_bits(&hx->intra_gb, ptr, bit_length);\n                hx->intra_gb_ptr = &hx->intra_gb;\n                break;\n            case NAL_DPC:\n                init_get_bits(&hx->inter_gb, ptr, bit_length);\n                hx->inter_gb_ptr = &hx->inter_gb;\n                if (hx->redundant_pic_count == 0 &&\n                    hx->intra_gb_ptr &&\n                    hx->data_partitioning &&\n                    h->cur_pic_ptr && h->context_initialized &&\n                    (avctx->skip_frame < AVDISCARD_NONREF || hx->nal_ref_idc) &&\n                    (avctx->skip_frame < AVDISCARD_BIDIR  ||\n                     hx->slice_type_nos != AV_PICTURE_TYPE_B) &&\n                    (avctx->skip_frame < AVDISCARD_NONKEY ||\n                     hx->slice_type_nos == AV_PICTURE_TYPE_I) &&\n                    avctx->skip_frame < AVDISCARD_ALL)\n                    context_count++;\n                break;\n            case NAL_SEI:\n                init_get_bits(&h->gb, ptr, bit_length);\n                ff_h264_decode_sei(h);\n                break;\n            case NAL_SPS:\n                init_get_bits(&h->gb, ptr, bit_length);\n                ret = ff_h264_decode_seq_parameter_set(h);\n                if (ret < 0 && h->is_avc && (nalsize != consumed) && nalsize) {\n                    av_log(h->avctx, AV_LOG_DEBUG,\n                           "SPS decoding failure, trying again with the complete NAL\\n");\n                    init_get_bits(&h->gb, buf + buf_index + 1 - consumed,\n                                  8 * (nalsize - 1));\n                    ff_h264_decode_seq_parameter_set(h);\n                }\n                ret = h264_set_parameter_from_sps(h);\n                if (ret < 0)\n                    goto end;\n                break;\n            case NAL_PPS:\n                init_get_bits(&h->gb, ptr, bit_length);\n                ff_h264_decode_picture_parameter_set(h, bit_length);\n                break;\n            case NAL_AUD:\n            case NAL_END_SEQUENCE:\n            case NAL_END_STREAM:\n            case NAL_FILLER_DATA:\n            case NAL_SPS_EXT:\n            case NAL_AUXILIARY_SLICE:\n                break;\n            case NAL_FF_IGNORE:\n                break;\n            default:\n                av_log(avctx, AV_LOG_DEBUG, "Unknown NAL code: %d (%d bits)\\n",\n                       hx->nal_unit_type, bit_length);\n            }\n            if (context_count == h->max_contexts) {\n                execute_decode_slices(h, context_count);\n                context_count = 0;\n            }\n            if (err < 0)\n                av_log(h->avctx, AV_LOG_ERROR, "decode_slice_header error\\n");\n            else if (err == 1) {\n                h->nal_unit_type = hx->nal_unit_type;\n                h->nal_ref_idc   = hx->nal_ref_idc;\n                hx               = h;\n                goto again;\n            }\n        }\n    }\n    if (context_count)\n        execute_decode_slices(h, context_count);\nend:\n    if (h->cur_pic_ptr && !h->droppable) {\n        ff_thread_report_progress(&h->cur_pic_ptr->tf, INT_MAX,\n                                  h->picture_structure == PICT_BOTTOM_FIELD);\n    }\n    return (ret < 0) ? ret : buf_index;\n}', 'static int execute_decode_slices(H264Context *h, int context_count)\n{\n    AVCodecContext *const avctx = h->avctx;\n    H264Context *hx;\n    int i;\n    if (h->avctx->hwaccel)\n        return 0;\n    if (context_count == 1) {\n        return decode_slice(avctx, &h);\n    } else {\n        for (i = 1; i < context_count; i++) {\n            hx                 = h->thread_context[i];\n            hx->er.error_count = 0;\n        }\n        avctx->execute(avctx, decode_slice, h->thread_context,\n                       NULL, context_count, sizeof(void *));\n        hx                   = h->thread_context[context_count - 1];\n        h->mb_x              = hx->mb_x;\n        h->mb_y              = hx->mb_y;\n        h->droppable         = hx->droppable;\n        h->picture_structure = hx->picture_structure;\n        for (i = 1; i < context_count; i++)\n            h->er.error_count += h->thread_context[i]->er.error_count;\n    }\n    return 0;\n}']