libavcodec/h264dec.c:742: error: Buffer Overrun L2
  Offset: [0, 2147483647] Size: 2 by call to `decode_nal_units`.

libavcodec/h264dec.c:742:17: Call
740.     }
741. 
742.     buf_index = decode_nal_units(h, buf, buf_size);
                     ^
743.     if (buf_index < 0)
744.         return AVERROR_INVALIDDATA;

libavcodec/h264dec.c:528:11: Call
  526.     }
  527. 
  528.     ret = ff_h2645_packet_split(&h->pkt, buf, buf_size, avctx, h->is_avc,
                 ^
  529.                                 h->nal_length_size, avctx->codec_id);
  530.     if (ret < 0) {

libavcodec/h2645_parse.c:301:15: Call
    299.         nal->size_bits = get_bit_length(nal, skip_trailing_zeros);
    300. 
    301.         ret = init_get_bits(&nal->gb, nal->data, nal->size_bits);
                       ^
    302.         if (ret < 0)
    303.             return ret;

libavcodec/get_bits.h:362:1: Parameter `bit_size`
      360.  * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
      361.  */
      362. static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
           ^
      363.                                 int bit_size)
      364. {

libavcodec/get_bits.h:379:5: Assignment
      377.     s->size_in_bits       = bit_size;
      378. #if !UNCHECKED_BITSTREAM_READER
      379.     s->size_in_bits_plus8 = bit_size + 8;
               ^
      380. #endif
      381.     s->buffer_end         = buffer + buffer_size;

libavcodec/h264dec.c:742:17: Call
740.     }
741. 
742.     buf_index = decode_nal_units(h, buf, buf_size);
                     ^
743.     if (buf_index < 0)
744.         return AVERROR_INVALIDDATA;

libavcodec/h264dec.c:515:1: Parameter `h->slice_ctx->list_count`
  513. }
  514. 
  515. static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size)
       ^
  516. {
  517.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264dec.c:573:24: Call
  571.             idr(h); // FIXME ensure we don't lose some frames if there is reordering
  572.         case H264_NAL_SLICE:
  573.             if ((err = ff_h264_queue_decode_slice(h, nal)))
                              ^
  574.                 break;
  575. 

libavcodec/h264_slice.c:1855:1: Parameter `h->slice_ctx->list_count`
    1853. }
    1854. 
    1855. int ff_h264_queue_decode_slice(H264Context *h, const H2645NAL *nal)
          ^
    1856. {
    1857.     H264SliceContext *sl = h->slice_ctx + h->nb_slice_ctx_queued;

libavcodec/h264_slice.c:1862:11: Call
    1860.     sl->gb = nal->gb;
    1861. 
    1862.     ret = h264_slice_header_parse(sl, nal, &h->ps, h->avctx);
                    ^
    1863.     if (ret < 0)
    1864.         return ret;

libavcodec/h264_slice.c:1512:1: Parameter `sl->list_count`
      1510. }
      1511. 
      1512. static int h264_slice_header_parse(H264SliceContext *sl, const H2645NAL *nal,
            ^
      1513.                                    const H264ParamSets *ps, AVCodecContext *avctx)
      1514. {

libavcodec/h264_slice.c:1908:11: Call
    1906.     }
    1907. 
    1908.     ret = h264_slice_init(h, sl, nal);
                    ^
    1909.     if (ret < 0)
    1910.         return ret;

libavcodec/h264_slice.c:1707:1: Parameter `sl->list_count`
      1705. /* do all the per-slice initialization needed before we can start decoding the
      1706.  * actual MBs */
      1707. static int h264_slice_init(H264Context *h, H264SliceContext *sl,
            ^
      1708.                            const H2645NAL *nal)
      1709. {

libavcodec/h264_slice.c:1750:11: Call
      1748.     assert(sl->mb_y < h->mb_height);
      1749. 
      1750.     ret = ff_h264_build_ref_list(h, sl);
                      ^
      1751.     if (ret < 0)
      1752.         return ret;

libavcodec/h264_refs.c:256:1: Parameter `sl->list_count`
        254. }
        255. 
        256. int ff_h264_build_ref_list(const H264Context *h, H264SliceContext *sl)
             ^
        257. {
        258.     int list, index, pic_structure;

libavcodec/h264_slice.c:1765:5: Call
      1763.     if (sl->slice_type_nos == AV_PICTURE_TYPE_B && !sl->direct_spatial_mv_pred)
      1764.         ff_h264_direct_dist_scale_factor(h, sl);
      1765.     ff_h264_direct_ref_list_init(h, sl);
                ^
      1766. 
      1767.     if (h->avctx->skip_loop_filter >= AVDISCARD_ALL ||

libavcodec/h264_direct.c:111:1: <Offset trace>
109. }
110. 
111. void ff_h264_direct_ref_list_init(const H264Context *const h, H264SliceContext *sl)
     ^
112. {
113.     H264Ref *const ref1 = &sl->ref_list[1][0];

libavcodec/h264_direct.c:111:1: Parameter `sl->list_count`
        109. }
        110. 
        111. void ff_h264_direct_ref_list_init(const H264Context *const h, H264SliceContext *sl)
             ^
        112. {
        113.     H264Ref *const ref1 = &sl->ref_list[1][0];

libavcodec/h264_direct.c:111:1: <Length trace>
109. }
110. 
111. void ff_h264_direct_ref_list_init(const H264Context *const h, H264SliceContext *sl)
     ^
112. {
113.     H264Ref *const ref1 = &sl->ref_list[1][0];

libavcodec/h264_direct.c:111:1: Parameter `h->cur_pic_ptr->ref_count[*][*]`
        109. }
        110. 
        111. void ff_h264_direct_ref_list_init(const H264Context *const h, H264SliceContext *sl)
             ^
        112. {
        113.     H264Ref *const ref1 = &sl->ref_list[1][0];

libavcodec/h264_direct.c:120:9: Array access: Offset: [0, 2147483647] Size: 2 by call to `decode_nal_units` 
        118. 
        119.     for (list = 0; list < sl->list_count; list++) {
        120.         cur->ref_count[sidx][list] = sl->ref_count[list];
                     ^
        121.         for (j = 0; j < sl->ref_count[list]; j++)
        122.             cur->ref_poc[sidx][list][j] = 4 * sl->ref_list[list][j].parent->frame_num +

void ff_h264_direct_ref_list_init(const H264Context *const h, H264SliceContext *sl)
{
    H264Ref *const ref1 = &sl->ref_list[1][0];
    H264Picture *const cur = h->cur_pic_ptr;
    int list, j, field;
    int sidx     = (h->picture_structure & 1) ^ 1;
    int ref1sidx = (ref1->reference      & 1) ^ 1;
    for (list = 0; list < sl->list_count; list++) {
        cur->ref_count[sidx][list] = sl->ref_count[list];
        for (j = 0; j < sl->ref_count[list]; j++)
            cur->ref_poc[sidx][list][j] = 4 * sl->ref_list[list][j].parent->frame_num +
                                          (sl->ref_list[list][j].reference & 3);
    }
    if (h->picture_structure == PICT_FRAME) {
        memcpy(cur->ref_count[1], cur->ref_count[0], sizeof(cur->ref_count[0]));
        memcpy(cur->ref_poc[1],   cur->ref_poc[0],   sizeof(cur->ref_poc[0]));
    }
    cur->mbaff = FRAME_MBAFF(h);
    sl->col_fieldoff = 0;
    if (sl->list_count != 2 || !sl->ref_count[1])
        return;
    if (h->picture_structure == PICT_FRAME) {
        int cur_poc  = h->cur_pic_ptr->poc;
        int *col_poc = sl->ref_list[1][0].parent->field_poc;
        sl->col_parity = (FFABS(col_poc[0] - cur_poc) >=
                          FFABS(col_poc[1] - cur_poc));
        ref1sidx =
        sidx     = sl->col_parity;
    } else if (!(h->picture_structure & sl->ref_list[1][0].reference) &&
               !sl->ref_list[1][0].parent->mbaff) {
        sl->col_fieldoff = 2 * sl->ref_list[1][0].reference - 3;
    }
    if (sl->slice_type_nos != AV_PICTURE_TYPE_B || sl->direct_spatial_mv_pred)
        return;
    for (list = 0; list < 2; list++) {
        fill_colmap(h, sl, sl->map_col_to_list0, list, sidx, ref1sidx, 0);
        if (FRAME_MBAFF(h))
            for (field = 0; field < 2; field++)
                fill_colmap(h, sl, sl->map_col_to_list0_field[field], list, field,
                            field, 1);
    }
}
['static int h264_decode_frame(AVCodecContext *avctx, void *data,\n                             int *got_frame, AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size       = avpkt->size;\n    H264Context *h     = avctx->priv_data;\n    AVFrame *pict      = data;\n    int buf_index      = 0;\n    int ret;\n    const uint8_t *new_extradata;\n    int new_extradata_size;\n    h->flags = avctx->flags;\n    h->setup_finished = 0;\n    h->nb_slice_ctx_queued = 0;\nout:\n    if (buf_size == 0) {\n        H264Picture *out;\n        int i, out_idx;\n        h->cur_pic_ptr = NULL;\n        out     = h->delayed_pic[0];\n        out_idx = 0;\n        for (i = 1;\n             h->delayed_pic[i] &&\n             !h->delayed_pic[i]->f->key_frame &&\n             !h->delayed_pic[i]->mmco_reset;\n             i++)\n            if (h->delayed_pic[i]->poc < out->poc) {\n                out     = h->delayed_pic[i];\n                out_idx = i;\n            }\n        for (i = out_idx; h->delayed_pic[i]; i++)\n            h->delayed_pic[i] = h->delayed_pic[i + 1];\n        if (out) {\n            ret = output_frame(h, pict, out->f);\n            if (ret < 0)\n                return ret;\n            *got_frame = 1;\n        }\n        return buf_index;\n    }\n    new_extradata_size = 0;\n    new_extradata = av_packet_get_side_data(avpkt, AV_PKT_DATA_NEW_EXTRADATA,\n                                            &new_extradata_size);\n    if (new_extradata_size > 0 && new_extradata) {\n        ret = ff_h264_decode_extradata(new_extradata, new_extradata_size,\n                                       &h->ps, &h->is_avc, &h->nal_length_size,\n                                       avctx->err_recognition, avctx);\n        if (ret < 0)\n            return ret;\n    }\n    buf_index = decode_nal_units(h, buf, buf_size);\n    if (buf_index < 0)\n        return AVERROR_INVALIDDATA;\n    if (!h->cur_pic_ptr && h->nal_unit_type == H264_NAL_END_SEQUENCE) {\n        buf_size = 0;\n        goto out;\n    }\n    if (!(avctx->flags2 & AV_CODEC_FLAG2_CHUNKS) && !h->cur_pic_ptr) {\n        if (avctx->skip_frame >= AVDISCARD_NONREF)\n            return 0;\n        av_log(avctx, AV_LOG_ERROR, "no frame!\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (!(avctx->flags2 & AV_CODEC_FLAG2_CHUNKS) ||\n        (h->mb_y >= h->mb_height && h->mb_height)) {\n        if (h->field_started)\n            ff_h264_field_end(h, &h->slice_ctx[0], 0);\n        *got_frame = 0;\n        if (h->output_frame->buf[0]) {\n            ret = output_frame(h, pict, h->output_frame) ;\n            av_frame_unref(h->output_frame);\n            if (ret < 0)\n                return ret;\n            *got_frame = 1;\n        }\n    }\n    assert(pict->buf[0] || !*got_frame);\n    return get_consumed_bytes(buf_index, buf_size);\n}', 'static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size)\n{\n    AVCodecContext *const avctx = h->avctx;\n    int nals_needed = 0;\n    int i, ret = 0;\n    if (!(avctx->flags2 & AV_CODEC_FLAG2_CHUNKS)) {\n        h->current_slice = 0;\n        if (!h->first_field)\n            h->cur_pic_ptr = NULL;\n        ff_h264_sei_uninit(&h->sei);\n    }\n    ret = ff_h2645_packet_split(&h->pkt, buf, buf_size, avctx, h->is_avc,\n                                h->nal_length_size, avctx->codec_id);\n    if (ret < 0) {\n        av_log(avctx, AV_LOG_ERROR,\n               "Error splitting the input into NAL units.\\n");\n        if (h->is_avc && !(avctx->err_recognition & AV_EF_EXPLODE)) {\n            int err = ff_h2645_packet_split(&h->pkt, buf, buf_size, avctx, 0, 0,\n                                            avctx->codec_id);\n            if (err >= 0) {\n                av_log(avctx, AV_LOG_WARNING,\n                       "The stream seems to contain AVCC extradata with Annex B "\n                       "formatted data, which is invalid.");\n                h->is_avc = 0;\n                ret       = 0;\n            }\n        }\n        if (ret < 0)\n            return ret;\n    }\n    if (avctx->active_thread_type & FF_THREAD_FRAME)\n        nals_needed = get_last_needed_nal(h);\n    for (i = 0; i < h->pkt.nb_nals; i++) {\n        H2645NAL *nal = &h->pkt.nals[i];\n        int max_slice_ctx, err;\n        if (avctx->skip_frame >= AVDISCARD_NONREF &&\n            nal->ref_idc == 0 && nal->type != H264_NAL_SEI)\n            continue;\n        h->nal_ref_idc   = nal->ref_idc;\n        h->nal_unit_type = nal->type;\n        err = 0;\n        switch (nal->type) {\n        case H264_NAL_IDR_SLICE:\n            idr(h);\n        case H264_NAL_SLICE:\n            if ((err = ff_h264_queue_decode_slice(h, nal)))\n                break;\n            if (avctx->active_thread_type & FF_THREAD_FRAME &&\n                i >= nals_needed && !h->setup_finished && h->cur_pic_ptr) {\n                ff_thread_finish_setup(avctx);\n                h->setup_finished = 1;\n            }\n            max_slice_ctx = avctx->hwaccel ? 1 : h->nb_slice_ctx;\n            if (h->nb_slice_ctx_queued == max_slice_ctx) {\n                if (avctx->hwaccel) {\n                    ret = avctx->hwaccel->decode_slice(avctx, nal->raw_data, nal->raw_size);\n                    h->nb_slice_ctx_queued = 0;\n                } else\n                    ret = ff_h264_execute_decode_slices(h);\n                if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE))\n                    goto end;\n            }\n            break;\n        case H264_NAL_DPA:\n        case H264_NAL_DPB:\n        case H264_NAL_DPC:\n            avpriv_request_sample(avctx, "data partitioning");\n            ret = AVERROR(ENOSYS);\n            goto end;\n            break;\n        case H264_NAL_SEI:\n            ret = ff_h264_sei_decode(&h->sei, &nal->gb, &h->ps, avctx);\n            if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE))\n                goto end;\n            break;\n        case H264_NAL_SPS:\n            ret = ff_h264_decode_seq_parameter_set(&nal->gb, avctx, &h->ps);\n            if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE))\n                goto end;\n            break;\n        case H264_NAL_PPS:\n            ret = ff_h264_decode_picture_parameter_set(&nal->gb, avctx, &h->ps,\n                                                       nal->size_bits);\n            if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE))\n                goto end;\n            break;\n        case H264_NAL_AUD:\n        case H264_NAL_END_SEQUENCE:\n        case H264_NAL_END_STREAM:\n        case H264_NAL_FILLER_DATA:\n        case H264_NAL_SPS_EXT:\n        case H264_NAL_AUXILIARY_SLICE:\n            break;\n        default:\n            av_log(avctx, AV_LOG_DEBUG, "Unknown NAL code: %d (%d bits)\\n",\n                   nal->type, nal->size_bits);\n        }\n        if (err < 0) {\n            av_log(h->avctx, AV_LOG_ERROR, "decode_slice_header error\\n");\n        }\n    }\n    ret = ff_h264_execute_decode_slices(h);\n    if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE))\n        goto end;\n    ret = 0;\nend:\n    if (h->cur_pic_ptr && !h->droppable) {\n        ff_thread_report_progress(&h->cur_pic_ptr->tf, INT_MAX,\n                                  h->picture_structure == PICT_BOTTOM_FIELD);\n    }\n    return (ret < 0) ? ret : buf_size;\n}', 'int ff_h2645_packet_split(H2645Packet *pkt, const uint8_t *buf, int length,\n                          void *logctx, int is_nalff, int nal_length_size,\n                          enum AVCodecID codec_id)\n{\n    int consumed, ret = 0;\n    const uint8_t *next_avc = buf + (is_nalff ? 0 : length);\n    pkt->nb_nals = 0;\n    while (length >= 4) {\n        H2645NAL *nal;\n        int extract_length = 0;\n        int skip_trailing_zeros = 1;\n        if (buf == next_avc) {\n            int i;\n            for (i = 0; i < nal_length_size; i++)\n                extract_length = (extract_length << 8) | buf[i];\n            if (extract_length > length) {\n                av_log(logctx, AV_LOG_ERROR,\n                       "Invalid NAL unit size (%d > %d).\\n",\n                       extract_length, length);\n                return AVERROR_INVALIDDATA;\n            }\n            buf     += nal_length_size;\n            length  -= nal_length_size;\n            next_avc = buf + extract_length;\n        } else {\n            int buf_index = find_next_start_code(buf, next_avc);\n            buf    += buf_index;\n            length -= buf_index;\n            if (buf == next_avc)\n                continue;\n            if (length > 0) {\n                extract_length = length;\n            } else if (pkt->nb_nals == 0) {\n                av_log(logctx, AV_LOG_ERROR, "No NAL unit found\\n");\n                return AVERROR_INVALIDDATA;\n            } else {\n                break;\n            }\n        }\n        if (pkt->nals_allocated < pkt->nb_nals + 1) {\n            int new_size = pkt->nals_allocated + 1;\n            H2645NAL *tmp = av_realloc_array(pkt->nals, new_size, sizeof(*tmp));\n            if (!tmp)\n                return AVERROR(ENOMEM);\n            pkt->nals = tmp;\n            memset(pkt->nals + pkt->nals_allocated, 0,\n                   (new_size - pkt->nals_allocated) * sizeof(*tmp));\n            pkt->nals_allocated = new_size;\n        }\n        nal = &pkt->nals[pkt->nb_nals++];\n        consumed = ff_h2645_extract_rbsp(buf, extract_length, nal);\n        if (consumed < 0)\n            return consumed;\n        if (consumed < length - 3 &&\n            buf[consumed]     == 0x00 && buf[consumed + 1] == 0x00 &&\n            buf[consumed + 2] == 0x01 && buf[consumed + 3] == 0xE0)\n            skip_trailing_zeros = 0;\n        nal->size_bits = get_bit_length(nal, skip_trailing_zeros);\n        ret = init_get_bits(&nal->gb, nal->data, nal->size_bits);\n        if (ret < 0)\n            return ret;\n        if (codec_id == AV_CODEC_ID_HEVC)\n            ret = hevc_parse_nal_header(nal, logctx);\n        else\n            ret = h264_parse_nal_header(nal, logctx);\n        if (ret <= 0) {\n            if (ret < 0) {\n                av_log(logctx, AV_LOG_ERROR, "Invalid NAL unit %d, skipping.\\n",\n                       nal->type);\n            }\n            pkt->nb_nals--;\n        }\n        buf    += consumed;\n        length -= consumed;\n    }\n    return 0;\n}', 'static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,\n                                int bit_size)\n{\n    int buffer_size;\n    int ret = 0;\n    if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {\n        bit_size    = 0;\n        buffer      = NULL;\n        ret         = AVERROR_INVALIDDATA;\n    }\n    buffer_size = (bit_size + 7) >> 3;\n    s->buffer             = buffer;\n    s->size_in_bits       = bit_size;\n#if !UNCHECKED_BITSTREAM_READER\n    s->size_in_bits_plus8 = bit_size + 8;\n#endif\n    s->buffer_end         = buffer + buffer_size;\n    s->index              = 0;\n    return ret;\n}', 'int ff_h264_queue_decode_slice(H264Context *h, const H2645NAL *nal)\n{\n    H264SliceContext *sl = h->slice_ctx + h->nb_slice_ctx_queued;\n    int ret;\n    sl->gb = nal->gb;\n    ret = h264_slice_header_parse(sl, nal, &h->ps, h->avctx);\n    if (ret < 0)\n        return ret;\n    if (sl->redundant_pic_count > 0)\n        return 0;\n    if (!h->setup_finished) {\n        if (sl->first_mb_addr == 0) {\n            if (h->nb_slice_ctx_queued) {\n                H264SliceContext tmp_ctx;\n                ret = ff_h264_execute_decode_slices(h);\n                if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE))\n                    return ret;\n                memcpy(&tmp_ctx, h->slice_ctx, sizeof(tmp_ctx));\n                memcpy(h->slice_ctx, sl, sizeof(tmp_ctx));\n                memcpy(sl, &tmp_ctx, sizeof(tmp_ctx));\n                sl = h->slice_ctx;\n            }\n            if (h->field_started)\n                ff_h264_field_end(h, sl, 1);\n            h->current_slice = 0;\n            if (!h->first_field) {\n                if (h->cur_pic_ptr && !h->droppable) {\n                    ff_thread_report_progress(&h->cur_pic_ptr->tf, INT_MAX,\n                                              h->picture_structure == PICT_BOTTOM_FIELD);\n                }\n                h->cur_pic_ptr = NULL;\n            }\n        }\n        if (h->current_slice == 0) {\n            ret = h264_field_start(h, sl, nal);\n            if (ret < 0)\n                return ret;\n            h->field_started = 1;\n        }\n    }\n    ret = h264_slice_init(h, sl, nal);\n    if (ret < 0)\n        return ret;\n    if ((h->avctx->skip_frame < AVDISCARD_NONREF || nal->ref_idc) &&\n        (h->avctx->skip_frame < AVDISCARD_BIDIR  ||\n         sl->slice_type_nos != AV_PICTURE_TYPE_B) &&\n        (h->avctx->skip_frame < AVDISCARD_NONKEY ||\n         h->cur_pic_ptr->f->key_frame) &&\n        h->avctx->skip_frame < AVDISCARD_ALL) {\n        h->nb_slice_ctx_queued++;\n    }\n    return 0;\n}', 'static int h264_slice_header_parse(H264SliceContext *sl, const H2645NAL *nal,\n                                   const H264ParamSets *ps, AVCodecContext *avctx)\n{\n    const SPS *sps;\n    const PPS *pps;\n    int ret;\n    unsigned int slice_type, tmp, i;\n    int field_pic_flag, bottom_field_flag, picture_structure;\n    sl->first_mb_addr = get_ue_golomb(&sl->gb);\n    slice_type = get_ue_golomb_31(&sl->gb);\n    if (slice_type > 9) {\n        av_log(avctx, AV_LOG_ERROR,\n               "slice type %d too large at %d\\n",\n               slice_type, sl->first_mb_addr);\n        return AVERROR_INVALIDDATA;\n    }\n    if (slice_type > 4) {\n        slice_type -= 5;\n        sl->slice_type_fixed = 1;\n    } else\n        sl->slice_type_fixed = 0;\n    slice_type         = ff_h264_golomb_to_pict_type[slice_type];\n    sl->slice_type     = slice_type;\n    sl->slice_type_nos = slice_type & 3;\n    if (nal->type  == H264_NAL_IDR_SLICE &&\n        sl->slice_type_nos != AV_PICTURE_TYPE_I) {\n        av_log(avctx, AV_LOG_ERROR, "A non-intra slice in an IDR NAL unit.\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    sl->pps_id = get_ue_golomb(&sl->gb);\n    if (sl->pps_id >= MAX_PPS_COUNT) {\n        av_log(avctx, AV_LOG_ERROR, "pps_id %u out of range\\n", sl->pps_id);\n        return AVERROR_INVALIDDATA;\n    }\n    if (!ps->pps_list[sl->pps_id]) {\n        av_log(avctx, AV_LOG_ERROR,\n               "non-existing PPS %u referenced\\n",\n               sl->pps_id);\n        return AVERROR_INVALIDDATA;\n    }\n    pps = (const PPS*)ps->pps_list[sl->pps_id]->data;\n    if (!ps->sps_list[pps->sps_id]) {\n        av_log(avctx, AV_LOG_ERROR,\n               "non-existing SPS %u referenced\\n", pps->sps_id);\n        return AVERROR_INVALIDDATA;\n    }\n    sps = (const SPS*)ps->sps_list[pps->sps_id]->data;\n    sl->frame_num = get_bits(&sl->gb, sps->log2_max_frame_num);\n    sl->mb_mbaff       = 0;\n    if (sps->frame_mbs_only_flag) {\n        picture_structure = PICT_FRAME;\n    } else {\n        field_pic_flag = get_bits1(&sl->gb);\n        if (field_pic_flag) {\n            bottom_field_flag = get_bits1(&sl->gb);\n            picture_structure = PICT_TOP_FIELD + bottom_field_flag;\n        } else {\n            picture_structure = PICT_FRAME;\n        }\n    }\n    sl->picture_structure      = picture_structure;\n    sl->mb_field_decoding_flag = picture_structure != PICT_FRAME;\n    if (picture_structure == PICT_FRAME) {\n        sl->curr_pic_num = sl->frame_num;\n        sl->max_pic_num  = 1 << sps->log2_max_frame_num;\n    } else {\n        sl->curr_pic_num = 2 * sl->frame_num + 1;\n        sl->max_pic_num  = 1 << (sps->log2_max_frame_num + 1);\n    }\n    if (nal->type == H264_NAL_IDR_SLICE)\n        get_ue_golomb(&sl->gb);\n    if (sps->poc_type == 0) {\n        sl->poc_lsb = get_bits(&sl->gb, sps->log2_max_poc_lsb);\n        if (pps->pic_order_present == 1 && picture_structure == PICT_FRAME)\n            sl->delta_poc_bottom = get_se_golomb(&sl->gb);\n    }\n    if (sps->poc_type == 1 && !sps->delta_pic_order_always_zero_flag) {\n        sl->delta_poc[0] = get_se_golomb(&sl->gb);\n        if (pps->pic_order_present == 1 && picture_structure == PICT_FRAME)\n            sl->delta_poc[1] = get_se_golomb(&sl->gb);\n    }\n    sl->redundant_pic_count = 0;\n    if (pps->redundant_pic_cnt_present)\n        sl->redundant_pic_count = get_ue_golomb(&sl->gb);\n    if (sl->slice_type_nos == AV_PICTURE_TYPE_B)\n        sl->direct_spatial_mv_pred = get_bits1(&sl->gb);\n    ret = ff_h264_parse_ref_count(&sl->list_count, sl->ref_count,\n                                  &sl->gb, pps, sl->slice_type_nos,\n                                  picture_structure);\n    if (ret < 0)\n        return ret;\n    if (sl->slice_type_nos != AV_PICTURE_TYPE_I) {\n       ret = ff_h264_decode_ref_pic_list_reordering(sl, avctx);\n       if (ret < 0) {\n           sl->ref_count[1] = sl->ref_count[0] = 0;\n           return ret;\n       }\n    }\n    sl->pwt.use_weight = 0;\n    for (i = 0; i < 2; i++) {\n        sl->pwt.luma_weight_flag[i]   = 0;\n        sl->pwt.chroma_weight_flag[i] = 0;\n    }\n    if ((pps->weighted_pred && sl->slice_type_nos == AV_PICTURE_TYPE_P) ||\n        (pps->weighted_bipred_idc == 1 &&\n         sl->slice_type_nos == AV_PICTURE_TYPE_B))\n        ff_h264_pred_weight_table(&sl->gb, sps, sl->ref_count,\n                                  sl->slice_type_nos, &sl->pwt);\n    sl->explicit_ref_marking = 0;\n    if (nal->ref_idc) {\n        ret = ff_h264_decode_ref_pic_marking(sl, &sl->gb, nal, avctx);\n        if (ret < 0 && (avctx->err_recognition & AV_EF_EXPLODE))\n            return AVERROR_INVALIDDATA;\n    }\n    if (sl->slice_type_nos != AV_PICTURE_TYPE_I && pps->cabac) {\n        tmp = get_ue_golomb_31(&sl->gb);\n        if (tmp > 2) {\n            av_log(avctx, AV_LOG_ERROR, "cabac_init_idc %u overflow\\n", tmp);\n            return AVERROR_INVALIDDATA;\n        }\n        sl->cabac_init_idc = tmp;\n    }\n    sl->last_qscale_diff = 0;\n    tmp = pps->init_qp + get_se_golomb(&sl->gb);\n    if (tmp > 51 + 6 * (sps->bit_depth_luma - 8)) {\n        av_log(avctx, AV_LOG_ERROR, "QP %u out of range\\n", tmp);\n        return AVERROR_INVALIDDATA;\n    }\n    sl->qscale       = tmp;\n    sl->chroma_qp[0] = get_chroma_qp(pps, 0, sl->qscale);\n    sl->chroma_qp[1] = get_chroma_qp(pps, 1, sl->qscale);\n    if (sl->slice_type == AV_PICTURE_TYPE_SP)\n        get_bits1(&sl->gb);\n    if (sl->slice_type == AV_PICTURE_TYPE_SP ||\n        sl->slice_type == AV_PICTURE_TYPE_SI)\n        get_se_golomb(&sl->gb);\n    sl->deblocking_filter     = 1;\n    sl->slice_alpha_c0_offset = 0;\n    sl->slice_beta_offset     = 0;\n    if (pps->deblocking_filter_parameters_present) {\n        tmp = get_ue_golomb_31(&sl->gb);\n        if (tmp > 2) {\n            av_log(avctx, AV_LOG_ERROR,\n                   "deblocking_filter_idc %u out of range\\n", tmp);\n            return AVERROR_INVALIDDATA;\n        }\n        sl->deblocking_filter = tmp;\n        if (sl->deblocking_filter < 2)\n            sl->deblocking_filter ^= 1;\n        if (sl->deblocking_filter) {\n            sl->slice_alpha_c0_offset = get_se_golomb(&sl->gb) * 2;\n            sl->slice_beta_offset     = get_se_golomb(&sl->gb) * 2;\n            if (sl->slice_alpha_c0_offset >  12 ||\n                sl->slice_alpha_c0_offset < -12 ||\n                sl->slice_beta_offset >  12     ||\n                sl->slice_beta_offset < -12) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "deblocking filter parameters %d %d out of range\\n",\n                       sl->slice_alpha_c0_offset, sl->slice_beta_offset);\n                return AVERROR_INVALIDDATA;\n            }\n        }\n    }\n    return 0;\n}', 'static int h264_slice_init(H264Context *h, H264SliceContext *sl,\n                           const H2645NAL *nal)\n{\n    int i, j, ret = 0;\n    if (h->current_slice > 0) {\n        if (h->ps.pps != (const PPS*)h->ps.pps_list[sl->pps_id]->data) {\n            av_log(h->avctx, AV_LOG_ERROR, "PPS changed between slices\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        if (h->picture_structure != sl->picture_structure ||\n            h->droppable         != (nal->ref_idc == 0)) {\n            av_log(h->avctx, AV_LOG_ERROR,\n                   "Changing field mode (%d -> %d) between slices is not allowed\\n",\n                   h->picture_structure, sl->picture_structure);\n            return AVERROR_INVALIDDATA;\n        } else if (!h->cur_pic_ptr) {\n            av_log(h->avctx, AV_LOG_ERROR,\n                   "unset cur_pic_ptr on slice %d\\n",\n                   h->current_slice + 1);\n            return AVERROR_INVALIDDATA;\n        }\n    }\n    if (h->picture_idr && nal->type != H264_NAL_IDR_SLICE) {\n        av_log(h->avctx, AV_LOG_ERROR, "Invalid mix of IDR and non-IDR slices\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    assert(h->mb_num == h->mb_width * h->mb_height);\n    if (sl->first_mb_addr << FIELD_OR_MBAFF_PICTURE(h) >= h->mb_num ||\n        sl->first_mb_addr >= h->mb_num) {\n        av_log(h->avctx, AV_LOG_ERROR, "first_mb_in_slice overflow\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    sl->resync_mb_x = sl->mb_x =  sl->first_mb_addr % h->mb_width;\n    sl->resync_mb_y = sl->mb_y = (sl->first_mb_addr / h->mb_width) <<\n                                 FIELD_OR_MBAFF_PICTURE(h);\n    if (h->picture_structure == PICT_BOTTOM_FIELD)\n        sl->resync_mb_y = sl->mb_y = sl->mb_y + 1;\n    assert(sl->mb_y < h->mb_height);\n    ret = ff_h264_build_ref_list(h, sl);\n    if (ret < 0)\n        return ret;\n    if (h->ps.pps->weighted_bipred_idc == 2 &&\n        sl->slice_type_nos == AV_PICTURE_TYPE_B) {\n        implicit_weight_table(h, sl, -1);\n        if (FRAME_MBAFF(h)) {\n            implicit_weight_table(h, sl, 0);\n            implicit_weight_table(h, sl, 1);\n        }\n    }\n    if (sl->slice_type_nos == AV_PICTURE_TYPE_B && !sl->direct_spatial_mv_pred)\n        ff_h264_direct_dist_scale_factor(h, sl);\n    ff_h264_direct_ref_list_init(h, sl);\n    if (h->avctx->skip_loop_filter >= AVDISCARD_ALL ||\n        (h->avctx->skip_loop_filter >= AVDISCARD_NONKEY &&\n         sl->slice_type_nos != AV_PICTURE_TYPE_I) ||\n        (h->avctx->skip_loop_filter >= AVDISCARD_BIDIR  &&\n         sl->slice_type_nos == AV_PICTURE_TYPE_B) ||\n        (h->avctx->skip_loop_filter >= AVDISCARD_NONREF &&\n         nal->ref_idc == 0))\n        sl->deblocking_filter = 0;\n    if (sl->deblocking_filter == 1 && h->nb_slice_ctx > 1) {\n        if (h->avctx->flags2 & AV_CODEC_FLAG2_FAST) {\n            sl->deblocking_filter = 2;\n        } else {\n            h->postpone_filter = 1;\n        }\n    }\n    sl->qp_thresh = 15 -\n                   FFMIN(sl->slice_alpha_c0_offset, sl->slice_beta_offset) -\n                   FFMAX3(0,\n                          h->ps.pps->chroma_qp_index_offset[0],\n                          h->ps.pps->chroma_qp_index_offset[1]) +\n                   6 * (h->ps.sps->bit_depth_luma - 8);\n    sl->slice_num       = ++h->current_slice;\n    if (sl->slice_num >= MAX_SLICES) {\n        av_log(h->avctx, AV_LOG_ERROR,\n               "Too many slices, increase MAX_SLICES and recompile\\n");\n    }\n    for (j = 0; j < 2; j++) {\n        int id_list[16];\n        int *ref2frm = h->ref2frm[sl->slice_num & (MAX_SLICES - 1)][j];\n        for (i = 0; i < 16; i++) {\n            id_list[i] = 60;\n            if (j < sl->list_count && i < sl->ref_count[j] &&\n                sl->ref_list[j][i].parent->f->buf[0]) {\n                int k;\n                AVBuffer *buf = sl->ref_list[j][i].parent->f->buf[0]->buffer;\n                for (k = 0; k < h->short_ref_count; k++)\n                    if (h->short_ref[k]->f->buf[0]->buffer == buf) {\n                        id_list[i] = k;\n                        break;\n                    }\n                for (k = 0; k < h->long_ref_count; k++)\n                    if (h->long_ref[k] && h->long_ref[k]->f->buf[0]->buffer == buf) {\n                        id_list[i] = h->short_ref_count + k;\n                        break;\n                    }\n            }\n        }\n        ref2frm[0] =\n        ref2frm[1] = -1;\n        for (i = 0; i < 16; i++)\n            ref2frm[i + 2] = 4 * id_list[i] + (sl->ref_list[j][i].reference & 3);\n        ref2frm[18 + 0] =\n        ref2frm[18 + 1] = -1;\n        for (i = 16; i < 48; i++)\n            ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +\n                             (sl->ref_list[j][i].reference & 3);\n    }\n    if (h->avctx->debug & FF_DEBUG_PICT_INFO) {\n        av_log(h->avctx, AV_LOG_DEBUG,\n               "slice:%d %s mb:%d %c%s%s frame:%d poc:%d/%d ref:%d/%d qp:%d loop:%d:%d:%d weight:%d%s %s\\n",\n               sl->slice_num,\n               (h->picture_structure == PICT_FRAME ? "F" : h->picture_structure == PICT_TOP_FIELD ? "T" : "B"),\n               sl->mb_y * h->mb_width + sl->mb_x,\n               av_get_picture_type_char(sl->slice_type),\n               sl->slice_type_fixed ? " fix" : "",\n               nal->type == H264_NAL_IDR_SLICE ? " IDR" : "",\n               h->poc.frame_num,\n               h->cur_pic_ptr->field_poc[0],\n               h->cur_pic_ptr->field_poc[1],\n               sl->ref_count[0], sl->ref_count[1],\n               sl->qscale,\n               sl->deblocking_filter,\n               sl->slice_alpha_c0_offset, sl->slice_beta_offset,\n               sl->pwt.use_weight,\n               sl->pwt.use_weight == 1 && sl->pwt.use_weight_chroma ? "c" : "",\n               sl->slice_type == AV_PICTURE_TYPE_B ? (sl->direct_spatial_mv_pred ? "SPAT" : "TEMP") : "");\n    }\n    return 0;\n}', 'int ff_h264_build_ref_list(const H264Context *h, H264SliceContext *sl)\n{\n    int list, index, pic_structure;\n    print_short_term(h);\n    print_long_term(h);\n    h264_initialise_ref_list(h, sl);\n    for (list = 0; list < sl->list_count; list++) {\n        int pred = sl->curr_pic_num;\n        for (index = 0; index < sl->nb_ref_modifications[list]; index++) {\n            unsigned int modification_of_pic_nums_idc = sl->ref_modifications[list][index].op;\n            unsigned int                          val = sl->ref_modifications[list][index].val;\n            unsigned int pic_id;\n            int i;\n            H264Picture *ref = NULL;\n            switch (modification_of_pic_nums_idc) {\n            case 0:\n            case 1: {\n                const unsigned int abs_diff_pic_num = val + 1;\n                int frame_num;\n                if (abs_diff_pic_num > sl->max_pic_num) {\n                    av_log(h->avctx, AV_LOG_ERROR,\n                           "abs_diff_pic_num overflow\\n");\n                    return AVERROR_INVALIDDATA;\n                }\n                if (modification_of_pic_nums_idc == 0)\n                    pred -= abs_diff_pic_num;\n                else\n                    pred += abs_diff_pic_num;\n                pred &= sl->max_pic_num - 1;\n                frame_num = pic_num_extract(h, pred, &pic_structure);\n                for (i = h->short_ref_count - 1; i >= 0; i--) {\n                    ref = h->short_ref[i];\n                    assert(ref->reference);\n                    assert(!ref->long_ref);\n                    if (ref->frame_num == frame_num &&\n                        (ref->reference & pic_structure))\n                        break;\n                }\n                if (i >= 0)\n                    ref->pic_id = pred;\n                break;\n            }\n            case 2: {\n                int long_idx;\n                pic_id = val;\n                long_idx = pic_num_extract(h, pic_id, &pic_structure);\n                if (long_idx > 31) {\n                    av_log(h->avctx, AV_LOG_ERROR,\n                           "long_term_pic_idx overflow\\n");\n                    return AVERROR_INVALIDDATA;\n                }\n                ref = h->long_ref[long_idx];\n                assert(!(ref && !ref->reference));\n                if (ref && (ref->reference & pic_structure)) {\n                    ref->pic_id = pic_id;\n                    assert(ref->long_ref);\n                    i = 0;\n                } else {\n                    i = -1;\n                }\n                break;\n            }\n            }\n            if (i < 0) {\n                av_log(h->avctx, AV_LOG_ERROR,\n                       "reference picture missing during reorder\\n");\n                memset(&sl->ref_list[list][index], 0, sizeof(sl->ref_list[0][0]));\n            } else {\n                for (i = index; i + 1 < sl->ref_count[list]; i++) {\n                    if (sl->ref_list[list][i].parent &&\n                        ref->long_ref == sl->ref_list[list][i].parent->long_ref &&\n                        ref->pic_id   == sl->ref_list[list][i].pic_id)\n                        break;\n                }\n                for (; i > index; i--) {\n                    sl->ref_list[list][i] = sl->ref_list[list][i - 1];\n                }\n                ref_from_h264pic(&sl->ref_list[list][index], ref);\n                if (FIELD_PICTURE(h)) {\n                    pic_as_field(&sl->ref_list[list][index], pic_structure);\n                }\n            }\n        }\n    }\n    for (list = 0; list < sl->list_count; list++) {\n        for (index = 0; index < sl->ref_count[list]; index++) {\n            if (!sl->ref_list[list][index].parent) {\n                av_log(h->avctx, AV_LOG_ERROR, "Missing reference picture\\n");\n                if (index == 0 || h->avctx->err_recognition & AV_EF_EXPLODE)\n                    return AVERROR_INVALIDDATA;\n                else\n                    sl->ref_list[list][index] = sl->ref_list[list][index - 1];\n            }\n        }\n    }\n    if (FRAME_MBAFF(h))\n        h264_fill_mbaff_ref_list(sl);\n    return 0;\n}', 'void ff_h264_direct_ref_list_init(const H264Context *const h, H264SliceContext *sl)\n{\n    H264Ref *const ref1 = &sl->ref_list[1][0];\n    H264Picture *const cur = h->cur_pic_ptr;\n    int list, j, field;\n    int sidx     = (h->picture_structure & 1) ^ 1;\n    int ref1sidx = (ref1->reference      & 1) ^ 1;\n    for (list = 0; list < sl->list_count; list++) {\n        cur->ref_count[sidx][list] = sl->ref_count[list];\n        for (j = 0; j < sl->ref_count[list]; j++)\n            cur->ref_poc[sidx][list][j] = 4 * sl->ref_list[list][j].parent->frame_num +\n                                          (sl->ref_list[list][j].reference & 3);\n    }\n    if (h->picture_structure == PICT_FRAME) {\n        memcpy(cur->ref_count[1], cur->ref_count[0], sizeof(cur->ref_count[0]));\n        memcpy(cur->ref_poc[1],   cur->ref_poc[0],   sizeof(cur->ref_poc[0]));\n    }\n    cur->mbaff = FRAME_MBAFF(h);\n    sl->col_fieldoff = 0;\n    if (sl->list_count != 2 || !sl->ref_count[1])\n        return;\n    if (h->picture_structure == PICT_FRAME) {\n        int cur_poc  = h->cur_pic_ptr->poc;\n        int *col_poc = sl->ref_list[1][0].parent->field_poc;\n        sl->col_parity = (FFABS(col_poc[0] - cur_poc) >=\n                          FFABS(col_poc[1] - cur_poc));\n        ref1sidx =\n        sidx     = sl->col_parity;\n    } else if (!(h->picture_structure & sl->ref_list[1][0].reference) &&\n               !sl->ref_list[1][0].parent->mbaff) {\n        sl->col_fieldoff = 2 * sl->ref_list[1][0].reference - 3;\n    }\n    if (sl->slice_type_nos != AV_PICTURE_TYPE_B || sl->direct_spatial_mv_pred)\n        return;\n    for (list = 0; list < 2; list++) {\n        fill_colmap(h, sl, sl->map_col_to_list0, list, sidx, ref1sidx, 0);\n        if (FRAME_MBAFF(h))\n            for (field = 0; field < 2; field++)\n                fill_colmap(h, sl, sl->map_col_to_list0_field[field], list, field,\n                            field, 1);\n    }\n}']