libavcodec/h264_direct.c:139: error: Buffer Overrun L2
  Offset: [0, 2] (⇐ [0, 1] + [0, 1]) Size: 2 by call to `fill_colmap`.

libavcodec/h264_direct.c:102:1: Parameter `h->map_col_to_list0_field[*]`
100. }
101. 
102. void ff_h264_direct_ref_list_init(H264Context * const h){
     ^
103.     H264Picture * const ref1 = &h->ref_list[1][0];
104.     H264Picture * const cur = h->cur_pic_ptr;

libavcodec/h264_direct.c:139:13: Call
137.         if (FRAME_MBAFF(h))
138.         for(field=0; field<2; field++)
139.             fill_colmap(h, h->map_col_to_list0_field[field], list, field, field, 1);
                 ^
140.     }
141. }

libavcodec/h264_direct.c:69:1: <Offset trace>
67. }
68. 
69. static void fill_colmap(H264Context *h, int map[2][16+32], int list, int field, int colfield, int mbafi){
    ^
70.     H264Picture * const ref1 = &h->ref_list[1][0];
71.     int j, old_ref, rfield;

libavcodec/h264_direct.c:69:1: Parameter `list`
  67. }
  68. 
  69. static void fill_colmap(H264Context *h, int map[2][16+32], int list, int field, int colfield, int mbafi){
      ^
  70.     H264Picture * const ref1 = &h->ref_list[1][0];
  71.     int j, old_ref, rfield;

libavcodec/h264_direct.c:69:1: <Length trace>
67. }
68. 
69. static void fill_colmap(H264Context *h, int map[2][16+32], int list, int field, int colfield, int mbafi){
    ^
70.     H264Picture * const ref1 = &h->ref_list[1][0];
71.     int j, old_ref, rfield;

libavcodec/h264_direct.c:69:1: Parameter `*map`
  67. }
  68. 
  69. static void fill_colmap(H264Context *h, int map[2][16+32], int list, int field, int colfield, int mbafi){
      ^
  70.     H264Picture * const ref1 = &h->ref_list[1][0];
  71.     int j, old_ref, rfield;

libavcodec/h264_direct.c:92:25: Array access: Offset: [0, 2] (⇐ [0, 1] + [0, 1]) Size: 2 by call to `fill_colmap` 
  90.                     int cur_ref= mbafi ? (j-16)^field : j;
  91.                     if (ref1->mbaff)
  92.                         map[list][2 * old_ref + (rfield^field) + 16] = cur_ref;
                              ^
  93.                     if(rfield == field || !interl)
  94.                         map[list][old_ref] = cur_ref;

static void fill_colmap(H264Context *h, int map[2][16+32], int list, int field, int colfield, int mbafi){
    H264Picture * const ref1 = &h->ref_list[1][0];
    int j, old_ref, rfield;
    int start= mbafi ? 16                      : 0;
    int end  = mbafi ? 16+2*h->ref_count[0]    : h->ref_count[0];
    int interl= mbafi || h->picture_structure != PICT_FRAME;
    memset(map[list], 0, sizeof(map[list]));
    for(rfield=0; rfield<2; rfield++){
        for(old_ref=0; old_ref<ref1->ref_count[colfield][list]; old_ref++){
            int poc = ref1->ref_poc[colfield][list][old_ref];
            if     (!interl)
                poc |= 3;
            else if( interl && (poc&3) == 3)
                poc= (poc&~3) + rfield + 1;
            for(j=start; j<end; j++){
                if (4 * h->ref_list[0][j].frame_num + (h->ref_list[0][j].reference & 3) == poc) {
                    int cur_ref= mbafi ? (j-16)^field : j;
                    if (ref1->mbaff)
                        map[list][2 * old_ref + (rfield^field) + 16] = cur_ref;
                    if(rfield == field || !interl)
                        map[list][old_ref] = cur_ref;
                    break;
                }
            }
        }
    }
}
['void ff_h264_direct_ref_list_init(H264Context * const h){\n    H264Picture * const ref1 = &h->ref_list[1][0];\n    H264Picture * const cur = h->cur_pic_ptr;\n    int list, j, field;\n    int sidx= (h->picture_structure&1)^1;\n    int ref1sidx = (ref1->reference&1)^1;\n    for(list=0; list<2; list++){\n        cur->ref_count[sidx][list] = h->ref_count[list];\n        for(j=0; j<h->ref_count[list]; j++)\n            cur->ref_poc[sidx][list][j] = 4 * h->ref_list[list][j].frame_num + (h->ref_list[list][j].reference & 3);\n    }\n    if(h->picture_structure == PICT_FRAME){\n        memcpy(cur->ref_count[1], cur->ref_count[0], sizeof(cur->ref_count[0]));\n        memcpy(cur->ref_poc  [1], cur->ref_poc  [0], sizeof(cur->ref_poc  [0]));\n    }\n    cur->mbaff = FRAME_MBAFF(h);\n    h->col_fieldoff= 0;\n    if(h->picture_structure == PICT_FRAME){\n        int cur_poc = h->cur_pic_ptr->poc;\n        int *col_poc = h->ref_list[1]->field_poc;\n        h->col_parity= (FFABS(col_poc[0] - cur_poc) >= FFABS(col_poc[1] - cur_poc));\n        ref1sidx=sidx= h->col_parity;\n    } else if (!(h->picture_structure & h->ref_list[1][0].reference) && !h->ref_list[1][0].mbaff) {\n        h->col_fieldoff = 2 * h->ref_list[1][0].reference - 3;\n    }\n    if (h->slice_type_nos != AV_PICTURE_TYPE_B || h->direct_spatial_mv_pred)\n        return;\n    for(list=0; list<2; list++){\n        fill_colmap(h, h->map_col_to_list0, list, sidx, ref1sidx, 0);\n        if (FRAME_MBAFF(h))\n        for(field=0; field<2; field++)\n            fill_colmap(h, h->map_col_to_list0_field[field], list, field, field, 1);\n    }\n}', 'static void fill_colmap(H264Context *h, int map[2][16+32], int list, int field, int colfield, int mbafi){\n    H264Picture * const ref1 = &h->ref_list[1][0];\n    int j, old_ref, rfield;\n    int start= mbafi ? 16                      : 0;\n    int end  = mbafi ? 16+2*h->ref_count[0]    : h->ref_count[0];\n    int interl= mbafi || h->picture_structure != PICT_FRAME;\n    memset(map[list], 0, sizeof(map[list]));\n    for(rfield=0; rfield<2; rfield++){\n        for(old_ref=0; old_ref<ref1->ref_count[colfield][list]; old_ref++){\n            int poc = ref1->ref_poc[colfield][list][old_ref];\n            if     (!interl)\n                poc |= 3;\n            else if( interl && (poc&3) == 3)\n                poc= (poc&~3) + rfield + 1;\n            for(j=start; j<end; j++){\n                if (4 * h->ref_list[0][j].frame_num + (h->ref_list[0][j].reference & 3) == poc) {\n                    int cur_ref= mbafi ? (j-16)^field : j;\n                    if (ref1->mbaff)\n                        map[list][2 * old_ref + (rfield^field) + 16] = cur_ref;\n                    if(rfield == field || !interl)\n                        map[list][old_ref] = cur_ref;\n                    break;\n                }\n            }\n        }\n    }\n}']