libavcodec/h264.c:1478: error: Buffer Overrun L3
  Offset: [-1, 0] Size: 16 by call to `ff_h264_decode_extradata`.

libavcodec/h264.c:1448:5: Assignment
1446. 
1447.     h->picture_structure   = PICT_FRAME;
1448.     h->slice_context_count = 1;
          ^
1449.     h->workaround_bugs     = avctx->workaround_bugs;
1450.     h->flags               = avctx->flags;

libavcodec/h264.c:1478:9: Call
1476. 
1477.     if (avctx->extradata_size > 0 && avctx->extradata &&
1478.         ff_h264_decode_extradata(h))
              ^
1479.         return -1;
1480. 

libavcodec/h264.c:1366:1: Parameter `h->slice_context_count`
  1364.                             int parse_extradata);
  1365. 
  1366. int ff_h264_decode_extradata(H264Context *h)
        ^
  1367. {
  1368.     AVCodecContext *avctx = h->avctx;

libavcodec/h264.c:1414:13: Call
  1412.     } else {
  1413.         h->is_avc = 0;
  1414.         if (decode_nal_units(h, avctx->extradata, avctx->extradata_size, 1) < 0)
                    ^
  1415.             return -1;
  1416.     }

libavcodec/h264.c:4321:9: Assignment
    4319.     for (; pass <= 1; pass++) {
    4320.         buf_index     = 0;
    4321.         context_count = 0;
                  ^
    4322.         next_avc      = h->is_avc ? 0 : buf_size;
    4323.         nal_index     = 0;

libavcodec/h264.c:4562:17: Call
    4560. 
    4561.             if (context_count == h->max_contexts) {
    4562.                 execute_decode_slices(h, context_count);
                          ^
    4563.                 context_count = 0;
    4564.             }

libavcodec/h264.c:4266:1: <Offset trace>
4264.  * @param context_count number of contexts to execute
4265.  */
4266. static int execute_decode_slices(H264Context *h, int context_count)
      ^
4267. {
4268.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264.c:4266:1: Parameter `context_count`
      4264.  * @param context_count number of contexts to execute
      4265.  */
      4266. static int execute_decode_slices(H264Context *h, int context_count)
            ^
      4267. {
      4268.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264.c:4266:1: <Length trace>
4264.  * @param context_count number of contexts to execute
4265.  */
4266. static int execute_decode_slices(H264Context *h, int context_count)
      ^
4267. {
4268.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264.c:4266:1: Parameter `h->thread_context[*]`
      4264.  * @param context_count number of contexts to execute
      4265.  */
      4266. static int execute_decode_slices(H264Context *h, int context_count)
            ^
      4267. {
      4268.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264.c:4287:32: Array access: Offset: [-1, 0] Size: 16 by call to `ff_h264_decode_extradata` 
      4285. 
      4286.         /* pull back stuff from slices to master context */
      4287.         hx                   = h->thread_context[context_count - 1];
                                           ^
      4288.         h->mb_x              = hx->mb_x;
      4289.         h->mb_y              = hx->mb_y;

static int execute_decode_slices(H264Context *h, int context_count)
{
    AVCodecContext *const avctx = h->avctx;
    H264Context *hx;
    int i;
    if (h->avctx->hwaccel ||
        h->avctx->codec->capabilities & CODEC_CAP_HWACCEL_VDPAU)
        return 0;
    if (context_count == 1) {
        return decode_slice(avctx, &h);
    } else {
        for (i = 1; i < context_count; i++) {
            hx                    = h->thread_context[i];
            hx->er.error_count  = 0;
        }
        avctx->execute(avctx, decode_slice, h->thread_context,
                       NULL, context_count, sizeof(void *));
        hx                   = h->thread_context[context_count - 1];
        h->mb_x              = hx->mb_x;
        h->mb_y              = hx->mb_y;
        h->droppable         = hx->droppable;
        h->picture_structure = hx->picture_structure;
        for (i = 1; i < context_count; i++)
            h->er.error_count += h->thread_context[i]->er.error_count;
    }
    return 0;
}
['int ff_h264_decode_init(AVCodecContext *avctx)\n{\n    H264Context *h = avctx->priv_data;\n    int i;\n    h->avctx = avctx;\n    h->width    = h->avctx->width;\n    h->height   = h->avctx->height;\n    h->bit_depth_luma    = 8;\n    h->chroma_format_idc = 1;\n    ff_h264dsp_init(&h->h264dsp, 8, 1);\n    ff_h264chroma_init(&h->h264chroma, h->sps.bit_depth_chroma);\n    ff_h264qpel_init(&h->h264qpel, 8);\n    ff_h264_pred_init(&h->hpc, h->avctx->codec_id, 8, 1);\n    h->dequant_coeff_pps = -1;\n    ff_dsputil_init(&h->dsp, h->avctx);\n    ff_videodsp_init(&h->vdsp, 8);\n    memset(h->pps.scaling_matrix4, 16, 6 * 16 * sizeof(uint8_t));\n    memset(h->pps.scaling_matrix8, 16, 2 * 64 * sizeof(uint8_t));\n    h->picture_structure   = PICT_FRAME;\n    h->slice_context_count = 1;\n    h->workaround_bugs     = avctx->workaround_bugs;\n    h->flags               = avctx->flags;\n    if (!avctx->has_b_frames)\n        h->low_delay = 1;\n    avctx->chroma_sample_location = AVCHROMA_LOC_LEFT;\n    ff_h264_decode_init_vlc();\n    h->pixel_shift = 0;\n    h->sps.bit_depth_luma = avctx->bits_per_raw_sample = 8;\n    h->thread_context[0] = h;\n    h->outputed_poc      = h->next_outputed_poc = INT_MIN;\n    for (i = 0; i < MAX_DELAYED_PIC_COUNT; i++)\n        h->last_pocs[i] = INT_MIN;\n    h->prev_poc_msb = 1 << 16;\n    h->x264_build   = -1;\n    ff_h264_reset_sei(h);\n    if (avctx->codec_id == AV_CODEC_ID_H264) {\n        if (avctx->ticks_per_frame == 1)\n            h->avctx->time_base.den *= 2;\n        avctx->ticks_per_frame = 2;\n    }\n    if (avctx->extradata_size > 0 && avctx->extradata &&\n        ff_h264_decode_extradata(h))\n        return -1;\n    if (h->sps.bitstream_restriction_flag &&\n        h->avctx->has_b_frames < h->sps.num_reorder_frames) {\n        h->avctx->has_b_frames = h->sps.num_reorder_frames;\n        h->low_delay           = 0;\n    }\n    avctx->internal->allocate_progress = 1;\n    return 0;\n}', 'int ff_h264_decode_extradata(H264Context *h)\n{\n    AVCodecContext *avctx = h->avctx;\n    if (avctx->extradata[0] == 1) {\n        int i, cnt, nalsize;\n        unsigned char *p = avctx->extradata;\n        h->is_avc = 1;\n        if (avctx->extradata_size < 7) {\n            av_log(avctx, AV_LOG_ERROR, "avcC too short\\n");\n            return -1;\n        }\n        h->nal_length_size = 2;\n        cnt = *(p + 5) & 0x1f;\n        p  += 6;\n        for (i = 0; i < cnt; i++) {\n            nalsize = AV_RB16(p) + 2;\n            if (p - avctx->extradata + nalsize > avctx->extradata_size)\n                return -1;\n            if (decode_nal_units(h, p, nalsize, 1) < 0) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "Decoding sps %d from avcC failed\\n", i);\n                return -1;\n            }\n            p += nalsize;\n        }\n        cnt = *(p++);\n        for (i = 0; i < cnt; i++) {\n            nalsize = AV_RB16(p) + 2;\n            if (p - avctx->extradata + nalsize > avctx->extradata_size)\n                return -1;\n            if (decode_nal_units(h, p, nalsize, 1) < 0) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "Decoding pps %d from avcC failed\\n", i);\n                return -1;\n            }\n            p += nalsize;\n        }\n        h->nal_length_size = (avctx->extradata[4] & 0x03) + 1;\n    } else {\n        h->is_avc = 0;\n        if (decode_nal_units(h, avctx->extradata, avctx->extradata_size, 1) < 0)\n            return -1;\n    }\n    return 0;\n}', 'static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size,\n                            int parse_extradata)\n{\n    AVCodecContext *const avctx = h->avctx;\n    H264Context *hx;\n    int buf_index;\n    int context_count;\n    int next_avc;\n    int pass = !(avctx->active_thread_type & FF_THREAD_FRAME);\n    int nals_needed = 0;\n    int nal_index;\n    h->max_contexts = h->slice_context_count;\n    if (!(avctx->flags2 & CODEC_FLAG2_CHUNKS)) {\n        h->current_slice = 0;\n        if (!h->first_field)\n            h->cur_pic_ptr = NULL;\n        ff_h264_reset_sei(h);\n    }\n    for (; pass <= 1; pass++) {\n        buf_index     = 0;\n        context_count = 0;\n        next_avc      = h->is_avc ? 0 : buf_size;\n        nal_index     = 0;\n        for (;;) {\n            int consumed;\n            int dst_length;\n            int bit_length;\n            const uint8_t *ptr;\n            int i, nalsize = 0;\n            int err;\n            if (buf_index >= next_avc) {\n                if (buf_index >= buf_size - h->nal_length_size)\n                    break;\n                nalsize = 0;\n                for (i = 0; i < h->nal_length_size; i++)\n                    nalsize = (nalsize << 8) | buf[buf_index++];\n                if (nalsize <= 0 || nalsize > buf_size - buf_index) {\n                    av_log(h->avctx, AV_LOG_ERROR,\n                           "AVC: nal size %d\\n", nalsize);\n                    break;\n                }\n                next_avc = buf_index + nalsize;\n            } else {\n                for (; buf_index + 3 < next_avc; buf_index++)\n                    if (buf[buf_index]     == 0 &&\n                        buf[buf_index + 1] == 0 &&\n                        buf[buf_index + 2] == 1)\n                        break;\n                if (buf_index + 3 >= buf_size) {\n                    buf_index = buf_size;\n                    break;\n                }\n                buf_index += 3;\n                if (buf_index >= next_avc)\n                    continue;\n            }\n            hx = h->thread_context[context_count];\n            ptr = ff_h264_decode_nal(hx, buf + buf_index, &dst_length,\n                                     &consumed, next_avc - buf_index);\n            if (ptr == NULL || dst_length < 0) {\n                buf_index = -1;\n                goto end;\n            }\n            i = buf_index + consumed;\n            if ((h->workaround_bugs & FF_BUG_AUTODETECT) && i + 3 < next_avc &&\n                buf[i]     == 0x00 && buf[i + 1] == 0x00 &&\n                buf[i + 2] == 0x01 && buf[i + 3] == 0xE0)\n                h->workaround_bugs |= FF_BUG_TRUNCATED;\n            if (!(h->workaround_bugs & FF_BUG_TRUNCATED))\n                while (ptr[dst_length - 1] == 0 && dst_length > 0)\n                    dst_length--;\n            bit_length = !dst_length ? 0\n                                     : (8 * dst_length -\n                                        decode_rbsp_trailing(h, ptr + dst_length - 1));\n            if (h->avctx->debug & FF_DEBUG_STARTCODE)\n                av_log(h->avctx, AV_LOG_DEBUG,\n                       "NAL %d at %d/%d length %d\\n",\n                       hx->nal_unit_type, buf_index, buf_size, dst_length);\n            if (h->is_avc && (nalsize != consumed) && nalsize)\n                av_log(h->avctx, AV_LOG_DEBUG,\n                       "AVC: Consumed only %d bytes instead of %d\\n",\n                       consumed, nalsize);\n            buf_index += consumed;\n            nal_index++;\n            if (pass == 0) {\n                switch (hx->nal_unit_type) {\n                case NAL_SPS:\n                case NAL_PPS:\n                    nals_needed = nal_index;\n                    break;\n                case NAL_DPA:\n                case NAL_IDR_SLICE:\n                case NAL_SLICE:\n                    init_get_bits(&hx->gb, ptr, bit_length);\n                    if (!get_ue_golomb(&hx->gb))\n                        nals_needed = nal_index;\n                }\n                continue;\n            }\n            if (avctx->skip_frame >= AVDISCARD_NONREF && h->nal_ref_idc == 0)\n                continue;\nagain:\n            if (parse_extradata && HAVE_THREADS &&\n                (h->avctx->active_thread_type & FF_THREAD_FRAME) &&\n                (hx->nal_unit_type != NAL_PPS &&\n                 hx->nal_unit_type != NAL_SPS)) {\n                av_log(avctx, AV_LOG_INFO, "Ignoring NAL unit %d during "\n                       "extradata parsing\\n", hx->nal_unit_type);\n                hx->nal_unit_type = NAL_FF_IGNORE;\n            }\n            err = 0;\n            switch (hx->nal_unit_type) {\n            case NAL_IDR_SLICE:\n                if (h->nal_unit_type != NAL_IDR_SLICE) {\n                    av_log(h->avctx, AV_LOG_ERROR,\n                           "Invalid mix of idr and non-idr slices\\n");\n                    buf_index = -1;\n                    goto end;\n                }\n                idr(h);\n            case NAL_SLICE:\n                init_get_bits(&hx->gb, ptr, bit_length);\n                hx->intra_gb_ptr        =\n                    hx->inter_gb_ptr    = &hx->gb;\n                hx->data_partitioning = 0;\n                if ((err = decode_slice_header(hx, h)))\n                    break;\n                h->cur_pic_ptr->f.key_frame |=\n                    (hx->nal_unit_type == NAL_IDR_SLICE) ||\n                    (h->sei_recovery_frame_cnt >= 0);\n                if (h->current_slice == 1) {\n                    if (!(avctx->flags2 & CODEC_FLAG2_CHUNKS))\n                        decode_postinit(h, nal_index >= nals_needed);\n                    if (h->avctx->hwaccel &&\n                        h->avctx->hwaccel->start_frame(h->avctx, NULL, 0) < 0)\n                        return -1;\n                    if (CONFIG_H264_VDPAU_DECODER &&\n                        h->avctx->codec->capabilities & CODEC_CAP_HWACCEL_VDPAU)\n                        ff_vdpau_h264_picture_start(h);\n                }\n                if (hx->redundant_pic_count == 0 &&\n                    (avctx->skip_frame < AVDISCARD_NONREF ||\n                     hx->nal_ref_idc) &&\n                    (avctx->skip_frame < AVDISCARD_BIDIR  ||\n                     hx->slice_type_nos != AV_PICTURE_TYPE_B) &&\n                    (avctx->skip_frame < AVDISCARD_NONKEY ||\n                     hx->slice_type_nos == AV_PICTURE_TYPE_I) &&\n                    avctx->skip_frame < AVDISCARD_ALL) {\n                    if (avctx->hwaccel) {\n                        if (avctx->hwaccel->decode_slice(avctx,\n                                                         &buf[buf_index - consumed],\n                                                         consumed) < 0)\n                            return -1;\n                    } else if (CONFIG_H264_VDPAU_DECODER &&\n                               h->avctx->codec->capabilities & CODEC_CAP_HWACCEL_VDPAU) {\n                        static const uint8_t start_code[] = {\n                            0x00, 0x00, 0x01 };\n                        ff_vdpau_add_data_chunk(h->cur_pic_ptr->f.data[0], start_code,\n                                                sizeof(start_code));\n                        ff_vdpau_add_data_chunk(h->cur_pic_ptr->f.data[0], &buf[buf_index - consumed],\n                                                consumed);\n                    } else\n                        context_count++;\n                }\n                break;\n            case NAL_DPA:\n                init_get_bits(&hx->gb, ptr, bit_length);\n                hx->intra_gb_ptr =\n                hx->inter_gb_ptr = NULL;\n                if ((err = decode_slice_header(hx, h)) < 0)\n                    break;\n                hx->data_partitioning = 1;\n                break;\n            case NAL_DPB:\n                init_get_bits(&hx->intra_gb, ptr, bit_length);\n                hx->intra_gb_ptr = &hx->intra_gb;\n                break;\n            case NAL_DPC:\n                init_get_bits(&hx->inter_gb, ptr, bit_length);\n                hx->inter_gb_ptr = &hx->inter_gb;\n                if (hx->redundant_pic_count == 0 &&\n                    hx->intra_gb_ptr &&\n                    hx->data_partitioning &&\n                    h->cur_pic_ptr && h->context_initialized &&\n                    (avctx->skip_frame < AVDISCARD_NONREF || hx->nal_ref_idc) &&\n                    (avctx->skip_frame < AVDISCARD_BIDIR  ||\n                     hx->slice_type_nos != AV_PICTURE_TYPE_B) &&\n                    (avctx->skip_frame < AVDISCARD_NONKEY ||\n                     hx->slice_type_nos == AV_PICTURE_TYPE_I) &&\n                    avctx->skip_frame < AVDISCARD_ALL)\n                    context_count++;\n                break;\n            case NAL_SEI:\n                init_get_bits(&h->gb, ptr, bit_length);\n                ff_h264_decode_sei(h);\n                break;\n            case NAL_SPS:\n                init_get_bits(&h->gb, ptr, bit_length);\n                if (ff_h264_decode_seq_parameter_set(h) < 0 &&\n                    h->is_avc && (nalsize != consumed) && nalsize) {\n                    av_log(h->avctx, AV_LOG_DEBUG,\n                           "SPS decoding failure, trying again with the complete NAL\\n");\n                    init_get_bits(&h->gb, buf + buf_index + 1 - consumed,\n                                  8 * (nalsize - 1));\n                    ff_h264_decode_seq_parameter_set(h);\n                }\n                if (h264_set_parameter_from_sps(h) < 0) {\n                    buf_index = -1;\n                    goto end;\n                }\n                break;\n            case NAL_PPS:\n                init_get_bits(&h->gb, ptr, bit_length);\n                ff_h264_decode_picture_parameter_set(h, bit_length);\n                break;\n            case NAL_AUD:\n            case NAL_END_SEQUENCE:\n            case NAL_END_STREAM:\n            case NAL_FILLER_DATA:\n            case NAL_SPS_EXT:\n            case NAL_AUXILIARY_SLICE:\n                break;\n            case NAL_FF_IGNORE:\n                break;\n            default:\n                av_log(avctx, AV_LOG_DEBUG, "Unknown NAL code: %d (%d bits)\\n",\n                       hx->nal_unit_type, bit_length);\n            }\n            if (context_count == h->max_contexts) {\n                execute_decode_slices(h, context_count);\n                context_count = 0;\n            }\n            if (err < 0)\n                av_log(h->avctx, AV_LOG_ERROR, "decode_slice_header error\\n");\n            else if (err == 1) {\n                h->nal_unit_type = hx->nal_unit_type;\n                h->nal_ref_idc   = hx->nal_ref_idc;\n                hx               = h;\n                goto again;\n            }\n        }\n    }\n    if (context_count)\n        execute_decode_slices(h, context_count);\nend:\n    if (h->cur_pic_ptr && !h->droppable) {\n        ff_thread_report_progress(&h->cur_pic_ptr->tf, INT_MAX,\n                                  h->picture_structure == PICT_BOTTOM_FIELD);\n    }\n    return buf_index;\n}', 'static int execute_decode_slices(H264Context *h, int context_count)\n{\n    AVCodecContext *const avctx = h->avctx;\n    H264Context *hx;\n    int i;\n    if (h->avctx->hwaccel ||\n        h->avctx->codec->capabilities & CODEC_CAP_HWACCEL_VDPAU)\n        return 0;\n    if (context_count == 1) {\n        return decode_slice(avctx, &h);\n    } else {\n        for (i = 1; i < context_count; i++) {\n            hx                    = h->thread_context[i];\n            hx->er.error_count  = 0;\n        }\n        avctx->execute(avctx, decode_slice, h->thread_context,\n                       NULL, context_count, sizeof(void *));\n        hx                   = h->thread_context[context_count - 1];\n        h->mb_x              = hx->mb_x;\n        h->mb_y              = hx->mb_y;\n        h->droppable         = hx->droppable;\n        h->picture_structure = hx->picture_structure;\n        for (i = 1; i < context_count; i++)\n            h->er.error_count += h->thread_context[i]->er.error_count;\n    }\n    return 0;\n}']