libavcodec/h264.c:7667: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: 16 by call to `execute_decode_slices`.

libavcodec/h264.c:7483:5: Assignment
7481.     int buf_index=0;
7482.     H264Context *hx; ///< thread context
7483.     int context_count = 0;
          ^
7484.     int next_avc= h->is_avc ? 0 : buf_size;
7485. 

libavcodec/h264.c:7667:13: Call
7665. 
7666.         if(context_count == h->max_contexts) {
7667.             execute_decode_slices(h, context_count);
                  ^
7668.             context_count = 0;
7669.         }

libavcodec/h264.c:7444:1: <Offset trace>
7442.  * @param context_count number of contexts to execute
7443.  */
7444. static void execute_decode_slices(H264Context *h, int context_count){
      ^
7445.     MpegEncContext * const s = &h->s;
7446.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:7444:1: Parameter `context_count`
  7442.  * @param context_count number of contexts to execute
  7443.  */
  7444. static void execute_decode_slices(H264Context *h, int context_count){
        ^
  7445.     MpegEncContext * const s = &h->s;
  7446.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:7444:1: <Length trace>
7442.  * @param context_count number of contexts to execute
7443.  */
7444. static void execute_decode_slices(H264Context *h, int context_count){
      ^
7445.     MpegEncContext * const s = &h->s;
7446.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:7444:1: Parameter `h->thread_context[*]`
  7442.  * @param context_count number of contexts to execute
  7443.  */
  7444. static void execute_decode_slices(H264Context *h, int context_count){
        ^
  7445.     MpegEncContext * const s = &h->s;
  7446.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:7467:14: Array access: Offset: [-1, +oo] Size: 16 by call to `execute_decode_slices` 
  7465. 
  7466.         /* pull back stuff from slices to master context */
  7467.         hx = h->thread_context[context_count - 1];
                     ^
  7468.         s->mb_x = hx->s.mb_x;
  7469.         s->mb_y = hx->s.mb_y;

static void execute_decode_slices(H264Context *h, int context_count){
    MpegEncContext * const s = &h->s;
    AVCodecContext * const avctx= s->avctx;
    H264Context *hx;
    int i;
    if (s->avctx->hwaccel)
        return;
    if(s->avctx->codec->capabilities&CODEC_CAP_HWACCEL_VDPAU)
        return;
    if(context_count == 1) {
        decode_slice(avctx, &h);
    } else {
        for(i = 1; i < context_count; i++) {
            hx = h->thread_context[i];
            hx->s.error_recognition = avctx->error_recognition;
            hx->s.error_count = 0;
        }
        avctx->execute(avctx, (void *)decode_slice,
                       h->thread_context, NULL, context_count, sizeof(void*));
        hx = h->thread_context[context_count - 1];
        s->mb_x = hx->s.mb_x;
        s->mb_y = hx->s.mb_y;
        s->dropable = hx->s.dropable;
        s->picture_structure = hx->s.picture_structure;
        for(i = 1; i < context_count; i++)
            h->s.error_count += h->thread_context[i]->s.error_count;
    }
}
['static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){\n    MpegEncContext * const s = &h->s;\n    AVCodecContext * const avctx= s->avctx;\n    int buf_index=0;\n    H264Context *hx;\n    int context_count = 0;\n    int next_avc= h->is_avc ? 0 : buf_size;\n    h->max_contexts = avctx->thread_count;\n#if 0\n    int i;\n    for(i=0; i<50; i++){\n        av_log(NULL, AV_LOG_ERROR,"%02X ", buf[i]);\n    }\n#endif\n    if(!(s->flags2 & CODEC_FLAG2_CHUNKS)){\n        h->current_slice = 0;\n        if (!s->first_field)\n            s->current_picture_ptr= NULL;\n        reset_sei(h);\n    }\n    for(;;){\n        int consumed;\n        int dst_length;\n        int bit_length;\n        const uint8_t *ptr;\n        int i, nalsize = 0;\n        int err;\n        if(buf_index >= next_avc) {\n            if(buf_index >= buf_size) break;\n            nalsize = 0;\n            for(i = 0; i < h->nal_length_size; i++)\n                nalsize = (nalsize << 8) | buf[buf_index++];\n            if(nalsize <= 1 || nalsize > buf_size - buf_index){\n                if(nalsize == 1){\n                    buf_index++;\n                    continue;\n                }else{\n                    av_log(h->s.avctx, AV_LOG_ERROR, "AVC: nal size %d\\n", nalsize);\n                    break;\n                }\n            }\n            next_avc= buf_index + nalsize;\n        } else {\n            for(; buf_index + 3 < buf_size; buf_index++){\n                if(buf[buf_index] == 0 && buf[buf_index+1] == 0 && buf[buf_index+2] == 1)\n                    break;\n            }\n            if(buf_index+3 >= buf_size) break;\n            buf_index+=3;\n        }\n        hx = h->thread_context[context_count];\n        ptr= ff_h264_decode_nal(hx, buf + buf_index, &dst_length, &consumed, next_avc - buf_index);\n        if (ptr==NULL || dst_length < 0){\n            return -1;\n        }\n        while(ptr[dst_length - 1] == 0 && dst_length > 0)\n            dst_length--;\n        bit_length= !dst_length ? 0 : (8*dst_length - ff_h264_decode_rbsp_trailing(h, ptr + dst_length - 1));\n        if(s->avctx->debug&FF_DEBUG_STARTCODE){\n            av_log(h->s.avctx, AV_LOG_DEBUG, "NAL %d at %d/%d length %d\\n", hx->nal_unit_type, buf_index, buf_size, dst_length);\n        }\n        if (h->is_avc && (nalsize != consumed) && nalsize){\n            int i, debug_level = AV_LOG_DEBUG;\n            for (i = consumed; i < nalsize; i++)\n                if (buf[buf_index+i])\n                    debug_level = AV_LOG_ERROR;\n            av_log(h->s.avctx, debug_level, "AVC: Consumed only %d bytes instead of %d\\n", consumed, nalsize);\n        }\n        buf_index += consumed;\n        if(  (s->hurry_up == 1 && h->nal_ref_idc  == 0)\n           ||(avctx->skip_frame >= AVDISCARD_NONREF && h->nal_ref_idc  == 0))\n            continue;\n      again:\n        err = 0;\n        switch(hx->nal_unit_type){\n        case NAL_IDR_SLICE:\n            if (h->nal_unit_type != NAL_IDR_SLICE) {\n                av_log(h->s.avctx, AV_LOG_ERROR, "Invalid mix of idr and non-idr slices");\n                return -1;\n            }\n            idr(h);\n        case NAL_SLICE:\n            init_get_bits(&hx->s.gb, ptr, bit_length);\n            hx->intra_gb_ptr=\n            hx->inter_gb_ptr= &hx->s.gb;\n            hx->s.data_partitioning = 0;\n            if((err = decode_slice_header(hx, h)))\n               break;\n            if (s->avctx->hwaccel && h->current_slice == 1) {\n                if (s->avctx->hwaccel->start_frame(s->avctx, NULL, 0) < 0)\n                    return -1;\n            }\n            s->current_picture_ptr->key_frame |=\n                    (hx->nal_unit_type == NAL_IDR_SLICE) ||\n                    (h->sei_recovery_frame_cnt >= 0);\n            if(hx->redundant_pic_count==0 && hx->s.hurry_up < 5\n               && (avctx->skip_frame < AVDISCARD_NONREF || hx->nal_ref_idc)\n               && (avctx->skip_frame < AVDISCARD_BIDIR  || hx->slice_type_nos!=FF_B_TYPE)\n               && (avctx->skip_frame < AVDISCARD_NONKEY || hx->slice_type_nos==FF_I_TYPE)\n               && avctx->skip_frame < AVDISCARD_ALL){\n                if(avctx->hwaccel) {\n                    if (avctx->hwaccel->decode_slice(avctx, &buf[buf_index - consumed], consumed) < 0)\n                        return -1;\n                }else\n                if(CONFIG_H264_VDPAU_DECODER && s->avctx->codec->capabilities&CODEC_CAP_HWACCEL_VDPAU){\n                    static const uint8_t start_code[] = {0x00, 0x00, 0x01};\n                    ff_vdpau_add_data_chunk(s, start_code, sizeof(start_code));\n                    ff_vdpau_add_data_chunk(s, &buf[buf_index - consumed], consumed );\n                }else\n                    context_count++;\n            }\n            break;\n        case NAL_DPA:\n            init_get_bits(&hx->s.gb, ptr, bit_length);\n            hx->intra_gb_ptr=\n            hx->inter_gb_ptr= NULL;\n            if ((err = decode_slice_header(hx, h)) < 0)\n                break;\n            hx->s.data_partitioning = 1;\n            break;\n        case NAL_DPB:\n            init_get_bits(&hx->intra_gb, ptr, bit_length);\n            hx->intra_gb_ptr= &hx->intra_gb;\n            break;\n        case NAL_DPC:\n            init_get_bits(&hx->inter_gb, ptr, bit_length);\n            hx->inter_gb_ptr= &hx->inter_gb;\n            if(hx->redundant_pic_count==0 && hx->intra_gb_ptr && hx->s.data_partitioning\n               && s->context_initialized\n               && s->hurry_up < 5\n               && (avctx->skip_frame < AVDISCARD_NONREF || hx->nal_ref_idc)\n               && (avctx->skip_frame < AVDISCARD_BIDIR  || hx->slice_type_nos!=FF_B_TYPE)\n               && (avctx->skip_frame < AVDISCARD_NONKEY || hx->slice_type_nos==FF_I_TYPE)\n               && avctx->skip_frame < AVDISCARD_ALL)\n                context_count++;\n            break;\n        case NAL_SEI:\n            init_get_bits(&s->gb, ptr, bit_length);\n            ff_h264_decode_sei(h);\n            break;\n        case NAL_SPS:\n            init_get_bits(&s->gb, ptr, bit_length);\n            ff_h264_decode_seq_parameter_set(h);\n            if(s->flags& CODEC_FLAG_LOW_DELAY)\n                s->low_delay=1;\n            if(avctx->has_b_frames < 2)\n                avctx->has_b_frames= !s->low_delay;\n            break;\n        case NAL_PPS:\n            init_get_bits(&s->gb, ptr, bit_length);\n            ff_h264_decode_picture_parameter_set(h, bit_length);\n            break;\n        case NAL_AUD:\n        case NAL_END_SEQUENCE:\n        case NAL_END_STREAM:\n        case NAL_FILLER_DATA:\n        case NAL_SPS_EXT:\n        case NAL_AUXILIARY_SLICE:\n            break;\n        default:\n            av_log(avctx, AV_LOG_DEBUG, "Unknown NAL code: %d (%d bits)\\n", h->nal_unit_type, bit_length);\n        }\n        if(context_count == h->max_contexts) {\n            execute_decode_slices(h, context_count);\n            context_count = 0;\n        }\n        if (err < 0)\n            av_log(h->s.avctx, AV_LOG_ERROR, "decode_slice_header error\\n");\n        else if(err == 1) {\n            h->nal_unit_type = hx->nal_unit_type;\n            h->nal_ref_idc   = hx->nal_ref_idc;\n            hx = h;\n            goto again;\n        }\n    }\n    if(context_count)\n        execute_decode_slices(h, context_count);\n    return buf_index;\n}', 'static void execute_decode_slices(H264Context *h, int context_count){\n    MpegEncContext * const s = &h->s;\n    AVCodecContext * const avctx= s->avctx;\n    H264Context *hx;\n    int i;\n    if (s->avctx->hwaccel)\n        return;\n    if(s->avctx->codec->capabilities&CODEC_CAP_HWACCEL_VDPAU)\n        return;\n    if(context_count == 1) {\n        decode_slice(avctx, &h);\n    } else {\n        for(i = 1; i < context_count; i++) {\n            hx = h->thread_context[i];\n            hx->s.error_recognition = avctx->error_recognition;\n            hx->s.error_count = 0;\n        }\n        avctx->execute(avctx, (void *)decode_slice,\n                       h->thread_context, NULL, context_count, sizeof(void*));\n        hx = h->thread_context[context_count - 1];\n        s->mb_x = hx->s.mb_x;\n        s->mb_y = hx->s.mb_y;\n        s->dropable = hx->s.dropable;\n        s->picture_structure = hx->s.picture_structure;\n        for(i = 1; i < context_count; i++)\n            h->s.error_count += h->thread_context[i]->s.error_count;\n    }\n}']