libavcodec/h264_mb_template.c:166: error: Buffer Overrun L1
  Offset: -1 Size: 2 by call to `hl_decode_mb_predict_luma`.

libavcodec/h264_mb_template.c:166:13: Call
164.             }
165. 
166.             hl_decode_mb_predict_luma(h, sl, mb_type, SIMPLE,
                 ^
167.                                       transform_bypass, PIXEL_SHIFT,
168.                                       block_offset, linesize, dest_y, 0);

libavcodec/h264_mb.c:611:1: <Offset trace>
609. }
610. 
611. static av_always_inline void hl_decode_mb_predict_luma(const H264Context *h,
     ^
612.                                                        H264SliceContext *sl,
613.                                                        int mb_type, int simple,

libavcodec/h264_mb.c:611:1: Parameter `p`
  609. }
  610. 
  611. static av_always_inline void hl_decode_mb_predict_luma(const H264Context *h,
       ^
  612.                                                        H264SliceContext *sl,
  613.                                                        int mb_type, int simple,

libavcodec/h264_mb.c:611:1: <Length trace>
609. }
610. 
611. static av_always_inline void hl_decode_mb_predict_luma(const H264Context *h,
     ^
612.                                                        H264SliceContext *sl,
613.                                                        int mb_type, int simple,

libavcodec/h264_mb.c:611:1: Parameter `sl->chroma_qp[*]`
  609. }
  610. 
  611. static av_always_inline void hl_decode_mb_predict_luma(const H264Context *h,
       ^
  612.                                                        H264SliceContext *sl,
  613.                                                        int mb_type, int simple,

libavcodec/h264_mb.c:623:40: Array access: Offset: -1 Size: 2 by call to `hl_decode_mb_predict_luma` 
  621.     void (*idct_dc_add)(uint8_t *dst, int16_t *block, int stride);
  622.     int i;
  623.     int qscale = p == 0 ? sl->qscale : sl->chroma_qp[p - 1];
                                              ^
  624.     block_offset += 16 * p;
  625.     if (IS_INTRA4x4(mb_type)) {

static av_always_inline void hl_decode_mb_predict_luma(const H264Context *h,
                                                       H264SliceContext *sl,
                                                       int mb_type, int simple,
                                                       int transform_bypass,
                                                       int pixel_shift,
                                                       const int *block_offset,
                                                       int linesize,
                                                       uint8_t *dest_y, int p)
{
    void (*idct_add)(uint8_t *dst, int16_t *block, int stride);
    void (*idct_dc_add)(uint8_t *dst, int16_t *block, int stride);
    int i;
    int qscale = p == 0 ? sl->qscale : sl->chroma_qp[p - 1];
    block_offset += 16 * p;
    if (IS_INTRA4x4(mb_type)) {
        if (IS_8x8DCT(mb_type)) {
            if (transform_bypass) {
                idct_dc_add =
                idct_add    = h->h264dsp.h264_add_pixels8_clear;
            } else {
                idct_dc_add = h->h264dsp.h264_idct8_dc_add;
                idct_add    = h->h264dsp.h264_idct8_add;
            }
            for (i = 0; i < 16; i += 4) {
                uint8_t *const ptr = dest_y + block_offset[i];
                const int dir      = sl->intra4x4_pred_mode_cache[scan8[i]];
                if (transform_bypass && h->sps.profile_idc == 244 && dir <= 1) {
                    h->hpc.pred8x8l_add[dir](ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);
                } else {
                    const int nnz = sl->non_zero_count_cache[scan8[i + p * 16]];
                    h->hpc.pred8x8l[dir](ptr, (sl->topleft_samples_available << i) & 0x8000,
                                         (sl->topright_samples_available << i) & 0x4000, linesize);
                    if (nnz) {
                        if (nnz == 1 && dctcoef_get(sl->mb, pixel_shift, i * 16 + p * 256))
                            idct_dc_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);
                        else
                            idct_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);
                    }
                }
            }
        } else {
            if (transform_bypass) {
                idct_dc_add  =
                idct_add     = h->h264dsp.h264_add_pixels4_clear;
            } else {
                idct_dc_add = h->h264dsp.h264_idct_dc_add;
                idct_add    = h->h264dsp.h264_idct_add;
            }
            for (i = 0; i < 16; i++) {
                uint8_t *const ptr = dest_y + block_offset[i];
                const int dir      = sl->intra4x4_pred_mode_cache[scan8[i]];
                if (transform_bypass && h->sps.profile_idc == 244 && dir <= 1) {
                    h->hpc.pred4x4_add[dir](ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);
                } else {
                    uint8_t *topright;
                    int nnz, tr;
                    uint64_t tr_high;
                    if (dir == DIAG_DOWN_LEFT_PRED || dir == VERT_LEFT_PRED) {
                        const int topright_avail = (sl->topright_samples_available << i) & 0x8000;
                        assert(sl->mb_y || linesize <= block_offset[i]);
                        if (!topright_avail) {
                            if (pixel_shift) {
                                tr_high  = ((uint16_t *)ptr)[3 - linesize / 2] * 0x0001000100010001ULL;
                                topright = (uint8_t *)&tr_high;
                            } else {
                                tr       = ptr[3 - linesize] * 0x01010101u;
                                topright = (uint8_t *)&tr;
                            }
                        } else
                            topright = ptr + (4 << pixel_shift) - linesize;
                    } else
                        topright = NULL;
                    h->hpc.pred4x4[dir](ptr, topright, linesize);
                    nnz = sl->non_zero_count_cache[scan8[i + p * 16]];
                    if (nnz) {
                        if (nnz == 1 && dctcoef_get(sl->mb, pixel_shift, i * 16 + p * 256))
                            idct_dc_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);
                        else
                            idct_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);
                    }
                }
            }
        }
    } else {
        h->hpc.pred16x16[sl->intra16x16_pred_mode](dest_y, linesize);
        if (sl->non_zero_count_cache[scan8[LUMA_DC_BLOCK_INDEX + p]]) {
            if (!transform_bypass)
                h->h264dsp.h264_luma_dc_dequant_idct(sl->mb + (p * 256 << pixel_shift),
                                                     sl->mb_luma_dc[p],
                                                     h->dequant4_coeff[p][qscale][0]);
            else {
                static const uint8_t dc_mapping[16] = {
                     0 * 16,  1 * 16,  4 * 16,  5 * 16,
                     2 * 16,  3 * 16,  6 * 16,  7 * 16,
                     8 * 16,  9 * 16, 12 * 16, 13 * 16,
                    10 * 16, 11 * 16, 14 * 16, 15 * 16
                };
                for (i = 0; i < 16; i++)
                    dctcoef_set(sl->mb + (p * 256 << pixel_shift),
                                pixel_shift, dc_mapping[i],
                                dctcoef_get(sl->mb_luma_dc[p],
                                            pixel_shift, i));
            }
        }
    }
}
['static av_noinline void FUNC(hl_decode_mb)(const H264Context *h, H264SliceContext *sl)\n{\n    const int mb_x    = sl->mb_x;\n    const int mb_y    = sl->mb_y;\n    const int mb_xy   = sl->mb_xy;\n    const int mb_type = h->cur_pic.mb_type[mb_xy];\n    uint8_t *dest_y, *dest_cb, *dest_cr;\n    int linesize, uvlinesize  ;\n    int i, j;\n    const int *block_offset = &h->block_offset[0];\n    const int transform_bypass = !SIMPLE && (sl->qscale == 0 && h->sps.transform_bypass);\n    void (*idct_add)(uint8_t *dst, int16_t *block, int stride);\n    const int block_h   = 16 >> h->chroma_y_shift;\n    const int chroma422 = CHROMA422(h);\n    dest_y  = h->cur_pic.f->data[0] + ((mb_x << PIXEL_SHIFT)     + mb_y * sl->linesize)  * 16;\n    dest_cb = h->cur_pic.f->data[1] +  (mb_x << PIXEL_SHIFT) * 8 + mb_y * sl->uvlinesize * block_h;\n    dest_cr = h->cur_pic.f->data[2] +  (mb_x << PIXEL_SHIFT) * 8 + mb_y * sl->uvlinesize * block_h;\n    h->vdsp.prefetch(dest_y  + (sl->mb_x & 3) * 4 * sl->linesize   + (64 << PIXEL_SHIFT), sl->linesize,       4);\n    h->vdsp.prefetch(dest_cb + (sl->mb_x & 7)     * sl->uvlinesize + (64 << PIXEL_SHIFT), dest_cr - dest_cb, 2);\n    h->list_counts[mb_xy] = sl->list_count;\n    if (!SIMPLE && MB_FIELD(sl)) {\n        linesize     = sl->mb_linesize = sl->linesize * 2;\n        uvlinesize   = sl->mb_uvlinesize = sl->uvlinesize * 2;\n        block_offset = &h->block_offset[48];\n        if (mb_y & 1) {\n            dest_y  -= sl->linesize * 15;\n            dest_cb -= sl->uvlinesize * (block_h - 1);\n            dest_cr -= sl->uvlinesize * (block_h - 1);\n        }\n        if (FRAME_MBAFF(h)) {\n            int list;\n            for (list = 0; list < sl->list_count; list++) {\n                if (!USES_LIST(mb_type, list))\n                    continue;\n                if (IS_16X16(mb_type)) {\n                    int8_t *ref = &sl->ref_cache[list][scan8[0]];\n                    fill_rectangle(ref, 4, 4, 8, (16 + *ref) ^ (sl->mb_y & 1), 1);\n                } else {\n                    for (i = 0; i < 16; i += 4) {\n                        int ref = sl->ref_cache[list][scan8[i]];\n                        if (ref >= 0)\n                            fill_rectangle(&sl->ref_cache[list][scan8[i]], 2, 2,\n                                           8, (16 + ref) ^ (sl->mb_y & 1), 1);\n                    }\n                }\n            }\n        }\n    } else {\n        linesize   = sl->mb_linesize   = sl->linesize;\n        uvlinesize = sl->mb_uvlinesize = sl->uvlinesize;\n    }\n    if (!SIMPLE && IS_INTRA_PCM(mb_type)) {\n        if (PIXEL_SHIFT) {\n            const int bit_depth = h->sps.bit_depth_luma;\n            int j;\n            GetBitContext gb;\n            init_get_bits(&gb, sl->intra_pcm_ptr,\n                          ff_h264_mb_sizes[h->sps.chroma_format_idc] * bit_depth);\n            for (i = 0; i < 16; i++) {\n                uint16_t *tmp_y = (uint16_t *)(dest_y + i * linesize);\n                for (j = 0; j < 16; j++)\n                    tmp_y[j] = get_bits(&gb, bit_depth);\n            }\n            if (SIMPLE || !CONFIG_GRAY || !(h->flags & AV_CODEC_FLAG_GRAY)) {\n                if (!h->sps.chroma_format_idc) {\n                    for (i = 0; i < block_h; i++) {\n                        uint16_t *tmp_cb = (uint16_t *)(dest_cb + i * uvlinesize);\n                        for (j = 0; j < 8; j++)\n                            tmp_cb[j] = 1 << (bit_depth - 1);\n                    }\n                    for (i = 0; i < block_h; i++) {\n                        uint16_t *tmp_cr = (uint16_t *)(dest_cr + i * uvlinesize);\n                        for (j = 0; j < 8; j++)\n                            tmp_cr[j] = 1 << (bit_depth - 1);\n                    }\n                } else {\n                    for (i = 0; i < block_h; i++) {\n                        uint16_t *tmp_cb = (uint16_t *)(dest_cb + i * uvlinesize);\n                        for (j = 0; j < 8; j++)\n                            tmp_cb[j] = get_bits(&gb, bit_depth);\n                    }\n                    for (i = 0; i < block_h; i++) {\n                        uint16_t *tmp_cr = (uint16_t *)(dest_cr + i * uvlinesize);\n                        for (j = 0; j < 8; j++)\n                            tmp_cr[j] = get_bits(&gb, bit_depth);\n                    }\n                }\n            }\n        } else {\n            for (i = 0; i < 16; i++)\n                memcpy(dest_y + i * linesize, sl->intra_pcm_ptr + i * 16, 16);\n            if (SIMPLE || !CONFIG_GRAY || !(h->flags & AV_CODEC_FLAG_GRAY)) {\n                if (!h->sps.chroma_format_idc) {\n                    for (i = 0; i < block_h; i++) {\n                        memset(dest_cb + i * uvlinesize, 128, 8);\n                        memset(dest_cr + i * uvlinesize, 128, 8);\n                    }\n                } else {\n                    const uint8_t *src_cb = sl->intra_pcm_ptr + 256;\n                    const uint8_t *src_cr = sl->intra_pcm_ptr + 256 + block_h * 8;\n                    for (i = 0; i < block_h; i++) {\n                        memcpy(dest_cb + i * uvlinesize, src_cb + i * 8, 8);\n                        memcpy(dest_cr + i * uvlinesize, src_cr + i * 8, 8);\n                    }\n                }\n            }\n        }\n    } else {\n        if (IS_INTRA(mb_type)) {\n            if (sl->deblocking_filter)\n                xchg_mb_border(h, sl, dest_y, dest_cb, dest_cr, linesize,\n                               uvlinesize, 1, 0, SIMPLE, PIXEL_SHIFT);\n            if (SIMPLE || !CONFIG_GRAY || !(h->flags & AV_CODEC_FLAG_GRAY)) {\n                h->hpc.pred8x8[sl->chroma_pred_mode](dest_cb, uvlinesize);\n                h->hpc.pred8x8[sl->chroma_pred_mode](dest_cr, uvlinesize);\n            }\n            hl_decode_mb_predict_luma(h, sl, mb_type, SIMPLE,\n                                      transform_bypass, PIXEL_SHIFT,\n                                      block_offset, linesize, dest_y, 0);\n            if (sl->deblocking_filter)\n                xchg_mb_border(h, sl, dest_y, dest_cb, dest_cr, linesize,\n                               uvlinesize, 0, 0, SIMPLE, PIXEL_SHIFT);\n        } else {\n            if (chroma422) {\n                FUNC(hl_motion_422)(h, sl, dest_y, dest_cb, dest_cr,\n                              h->qpel_put, h->h264chroma.put_h264_chroma_pixels_tab,\n                              h->qpel_avg, h->h264chroma.avg_h264_chroma_pixels_tab,\n                              h->h264dsp.weight_h264_pixels_tab,\n                              h->h264dsp.biweight_h264_pixels_tab);\n            } else {\n                FUNC(hl_motion_420)(h, sl, dest_y, dest_cb, dest_cr,\n                              h->qpel_put, h->h264chroma.put_h264_chroma_pixels_tab,\n                              h->qpel_avg, h->h264chroma.avg_h264_chroma_pixels_tab,\n                              h->h264dsp.weight_h264_pixels_tab,\n                              h->h264dsp.biweight_h264_pixels_tab);\n            }\n        }\n        hl_decode_mb_idct_luma(h, sl, mb_type, SIMPLE, transform_bypass,\n                               PIXEL_SHIFT, block_offset, linesize, dest_y, 0);\n        if ((SIMPLE || !CONFIG_GRAY || !(h->flags & AV_CODEC_FLAG_GRAY)) &&\n            (sl->cbp & 0x30)) {\n            uint8_t *dest[2] = { dest_cb, dest_cr };\n            if (transform_bypass) {\n                if (IS_INTRA(mb_type) && h->sps.profile_idc == 244 &&\n                    (sl->chroma_pred_mode == VERT_PRED8x8 ||\n                     sl->chroma_pred_mode == HOR_PRED8x8)) {\n                    h->hpc.pred8x8_add[sl->chroma_pred_mode](dest[0],\n                                                            block_offset + 16,\n                                                            sl->mb + (16 * 16 * 1 << PIXEL_SHIFT),\n                                                            uvlinesize);\n                    h->hpc.pred8x8_add[sl->chroma_pred_mode](dest[1],\n                                                            block_offset + 32,\n                                                            sl->mb + (16 * 16 * 2 << PIXEL_SHIFT),\n                                                            uvlinesize);\n                } else {\n                    idct_add = h->h264dsp.h264_add_pixels4_clear;\n                    for (j = 1; j < 3; j++) {\n                        for (i = j * 16; i < j * 16 + 4; i++)\n                            if (sl->non_zero_count_cache[scan8[i]] ||\n                                dctcoef_get(sl->mb, PIXEL_SHIFT, i * 16))\n                                idct_add(dest[j - 1] + block_offset[i],\n                                         sl->mb + (i * 16 << PIXEL_SHIFT),\n                                         uvlinesize);\n                        if (chroma422) {\n                            for (i = j * 16 + 4; i < j * 16 + 8; i++)\n                                if (sl->non_zero_count_cache[scan8[i + 4]] ||\n                                    dctcoef_get(sl->mb, PIXEL_SHIFT, i * 16))\n                                    idct_add(dest[j - 1] + block_offset[i + 4],\n                                             sl->mb + (i * 16 << PIXEL_SHIFT),\n                                             uvlinesize);\n                        }\n                    }\n                }\n            } else {\n                int qp[2];\n                if (chroma422) {\n                    qp[0] = sl->chroma_qp[0] + 3;\n                    qp[1] = sl->chroma_qp[1] + 3;\n                } else {\n                    qp[0] = sl->chroma_qp[0];\n                    qp[1] = sl->chroma_qp[1];\n                }\n                if (sl->non_zero_count_cache[scan8[CHROMA_DC_BLOCK_INDEX + 0]])\n                    h->h264dsp.h264_chroma_dc_dequant_idct(sl->mb + (16 * 16 * 1 << PIXEL_SHIFT),\n                                                           h->dequant4_coeff[IS_INTRA(mb_type) ? 1 : 4][qp[0]][0]);\n                if (sl->non_zero_count_cache[scan8[CHROMA_DC_BLOCK_INDEX + 1]])\n                    h->h264dsp.h264_chroma_dc_dequant_idct(sl->mb + (16 * 16 * 2 << PIXEL_SHIFT),\n                                                           h->dequant4_coeff[IS_INTRA(mb_type) ? 2 : 5][qp[1]][0]);\n                h->h264dsp.h264_idct_add8(dest, block_offset,\n                                          sl->mb, uvlinesize,\n                                          sl->non_zero_count_cache);\n            }\n        }\n    }\n}', 'static av_always_inline void hl_decode_mb_predict_luma(const H264Context *h,\n                                                       H264SliceContext *sl,\n                                                       int mb_type, int simple,\n                                                       int transform_bypass,\n                                                       int pixel_shift,\n                                                       const int *block_offset,\n                                                       int linesize,\n                                                       uint8_t *dest_y, int p)\n{\n    void (*idct_add)(uint8_t *dst, int16_t *block, int stride);\n    void (*idct_dc_add)(uint8_t *dst, int16_t *block, int stride);\n    int i;\n    int qscale = p == 0 ? sl->qscale : sl->chroma_qp[p - 1];\n    block_offset += 16 * p;\n    if (IS_INTRA4x4(mb_type)) {\n        if (IS_8x8DCT(mb_type)) {\n            if (transform_bypass) {\n                idct_dc_add =\n                idct_add    = h->h264dsp.h264_add_pixels8_clear;\n            } else {\n                idct_dc_add = h->h264dsp.h264_idct8_dc_add;\n                idct_add    = h->h264dsp.h264_idct8_add;\n            }\n            for (i = 0; i < 16; i += 4) {\n                uint8_t *const ptr = dest_y + block_offset[i];\n                const int dir      = sl->intra4x4_pred_mode_cache[scan8[i]];\n                if (transform_bypass && h->sps.profile_idc == 244 && dir <= 1) {\n                    h->hpc.pred8x8l_add[dir](ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);\n                } else {\n                    const int nnz = sl->non_zero_count_cache[scan8[i + p * 16]];\n                    h->hpc.pred8x8l[dir](ptr, (sl->topleft_samples_available << i) & 0x8000,\n                                         (sl->topright_samples_available << i) & 0x4000, linesize);\n                    if (nnz) {\n                        if (nnz == 1 && dctcoef_get(sl->mb, pixel_shift, i * 16 + p * 256))\n                            idct_dc_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);\n                        else\n                            idct_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);\n                    }\n                }\n            }\n        } else {\n            if (transform_bypass) {\n                idct_dc_add  =\n                idct_add     = h->h264dsp.h264_add_pixels4_clear;\n            } else {\n                idct_dc_add = h->h264dsp.h264_idct_dc_add;\n                idct_add    = h->h264dsp.h264_idct_add;\n            }\n            for (i = 0; i < 16; i++) {\n                uint8_t *const ptr = dest_y + block_offset[i];\n                const int dir      = sl->intra4x4_pred_mode_cache[scan8[i]];\n                if (transform_bypass && h->sps.profile_idc == 244 && dir <= 1) {\n                    h->hpc.pred4x4_add[dir](ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);\n                } else {\n                    uint8_t *topright;\n                    int nnz, tr;\n                    uint64_t tr_high;\n                    if (dir == DIAG_DOWN_LEFT_PRED || dir == VERT_LEFT_PRED) {\n                        const int topright_avail = (sl->topright_samples_available << i) & 0x8000;\n                        assert(sl->mb_y || linesize <= block_offset[i]);\n                        if (!topright_avail) {\n                            if (pixel_shift) {\n                                tr_high  = ((uint16_t *)ptr)[3 - linesize / 2] * 0x0001000100010001ULL;\n                                topright = (uint8_t *)&tr_high;\n                            } else {\n                                tr       = ptr[3 - linesize] * 0x01010101u;\n                                topright = (uint8_t *)&tr;\n                            }\n                        } else\n                            topright = ptr + (4 << pixel_shift) - linesize;\n                    } else\n                        topright = NULL;\n                    h->hpc.pred4x4[dir](ptr, topright, linesize);\n                    nnz = sl->non_zero_count_cache[scan8[i + p * 16]];\n                    if (nnz) {\n                        if (nnz == 1 && dctcoef_get(sl->mb, pixel_shift, i * 16 + p * 256))\n                            idct_dc_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);\n                        else\n                            idct_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize);\n                    }\n                }\n            }\n        }\n    } else {\n        h->hpc.pred16x16[sl->intra16x16_pred_mode](dest_y, linesize);\n        if (sl->non_zero_count_cache[scan8[LUMA_DC_BLOCK_INDEX + p]]) {\n            if (!transform_bypass)\n                h->h264dsp.h264_luma_dc_dequant_idct(sl->mb + (p * 256 << pixel_shift),\n                                                     sl->mb_luma_dc[p],\n                                                     h->dequant4_coeff[p][qscale][0]);\n            else {\n                static const uint8_t dc_mapping[16] = {\n                     0 * 16,  1 * 16,  4 * 16,  5 * 16,\n                     2 * 16,  3 * 16,  6 * 16,  7 * 16,\n                     8 * 16,  9 * 16, 12 * 16, 13 * 16,\n                    10 * 16, 11 * 16, 14 * 16, 15 * 16\n                };\n                for (i = 0; i < 16; i++)\n                    dctcoef_set(sl->mb + (p * 256 << pixel_shift),\n                                pixel_shift, dc_mapping[i],\n                                dctcoef_get(sl->mb_luma_dc[p],\n                                            pixel_shift, i));\n            }\n        }\n    }\n}']