libavcodec/h264.c:986: error: Buffer Overrun L2
  Offset: [0, 2] (⇐ [0, 1] + [0, 1]) Size: 2 by call to `fill_colmap`.

libavcodec/h264.c:959:1: Parameter `h->map_col_to_list0_field[*]`
957. }
958. 
959. static inline void direct_ref_list_init(H264Context * const h){
     ^
960.     MpegEncContext * const s = &h->s;
961.     Picture * const ref1 = &h->ref_list[1][0];

libavcodec/h264.c:986:13: Call
984.         fill_colmap(h, h->map_col_to_list0, list, sidx, ref1sidx, 0);
985.         for(field=0; field<2; field++)
986.             fill_colmap(h, h->map_col_to_list0_field[field], list, field, field, 1);
                 ^
987.     }
988. }

libavcodec/h264.c:926:1: <Offset trace>
924. }
925. 
926. static void fill_colmap(H264Context *h, int map[2][16+32], int list, int field, int colfield, int mbafi){
     ^
927.     MpegEncContext * const s = &h->s;
928.     Picture * const ref1 = &h->ref_list[1][0];

libavcodec/h264.c:926:1: Parameter `list`
  924. }
  925. 
  926. static void fill_colmap(H264Context *h, int map[2][16+32], int list, int field, int colfield, int mbafi){
       ^
  927.     MpegEncContext * const s = &h->s;
  928.     Picture * const ref1 = &h->ref_list[1][0];

libavcodec/h264.c:926:1: <Length trace>
924. }
925. 
926. static void fill_colmap(H264Context *h, int map[2][16+32], int list, int field, int colfield, int mbafi){
     ^
927.     MpegEncContext * const s = &h->s;
928.     Picture * const ref1 = &h->ref_list[1][0];

libavcodec/h264.c:926:1: Parameter `*map`
  924. }
  925. 
  926. static void fill_colmap(H264Context *h, int map[2][16+32], int list, int field, int colfield, int mbafi){
       ^
  927.     MpegEncContext * const s = &h->s;
  928.     Picture * const ref1 = &h->ref_list[1][0];

libavcodec/h264.c:949:21: Array access: Offset: [0, 2] (⇐ [0, 1] + [0, 1]) Size: 2 by call to `fill_colmap` 
  947.                 if(4*h->ref_list[list][j].frame_num + (h->ref_list[list][j].reference&3) == poc){
  948.                     int cur_ref= mbafi ? (j-16)^field : j;
  949.                     map[list][2*old_ref + (rfield^field) + 16] = cur_ref;
                           ^
  950.                     if(rfield == field)
  951.                         map[list][old_ref] = cur_ref;

static void fill_colmap(H264Context *h, int map[2][16+32], int list, int field, int colfield, int mbafi){
    MpegEncContext * const s = &h->s;
    Picture * const ref1 = &h->ref_list[1][0];
    int j, old_ref, rfield;
    int start= mbafi ? 16                      : 0;
    int end  = mbafi ? 16+2*h->ref_count[list] : h->ref_count[list];
    int interl= mbafi || s->picture_structure != PICT_FRAME;
    memset(map[list], 0, sizeof(map[list]));
    for(rfield=0; rfield<2; rfield++){
        for(old_ref=0; old_ref<ref1->ref_count[colfield][list]; old_ref++){
            int poc = ref1->ref_poc[colfield][list][old_ref];
            if     (!interl)
                poc |= 3;
            else if( interl && (poc&3) == 3)
                poc= (poc&~3) + rfield + 1;
            for(j=start; j<end; j++){
                if(4*h->ref_list[list][j].frame_num + (h->ref_list[list][j].reference&3) == poc){
                    int cur_ref= mbafi ? (j-16)^field : j;
                    map[list][2*old_ref + (rfield^field) + 16] = cur_ref;
                    if(rfield == field)
                        map[list][old_ref] = cur_ref;
                    break;
                }
            }
        }
    }
}
['static inline void direct_ref_list_init(H264Context * const h){\n    MpegEncContext * const s = &h->s;\n    Picture * const ref1 = &h->ref_list[1][0];\n    Picture * const cur = s->current_picture_ptr;\n    int list, j, field;\n    int sidx= (s->picture_structure&1)^1;\n    int ref1sidx= (ref1->reference&1)^1;\n    for(list=0; list<2; list++){\n        cur->ref_count[sidx][list] = h->ref_count[list];\n        for(j=0; j<h->ref_count[list]; j++)\n            cur->ref_poc[sidx][list][j] = 4*h->ref_list[list][j].frame_num + (h->ref_list[list][j].reference&3);\n    }\n    if(s->picture_structure == PICT_FRAME){\n        memcpy(cur->ref_count[1], cur->ref_count[0], sizeof(cur->ref_count[0]));\n        memcpy(cur->ref_poc  [1], cur->ref_poc  [0], sizeof(cur->ref_poc  [0]));\n    }\n    cur->mbaff= FRAME_MBAFF;\n    if(cur->pict_type != FF_B_TYPE || h->direct_spatial_mv_pred)\n        return;\n    for(list=0; list<2; list++){\n        fill_colmap(h, h->map_col_to_list0, list, sidx, ref1sidx, 0);\n        for(field=0; field<2; field++)\n            fill_colmap(h, h->map_col_to_list0_field[field], list, field, field, 1);\n    }\n}', 'static void fill_colmap(H264Context *h, int map[2][16+32], int list, int field, int colfield, int mbafi){\n    MpegEncContext * const s = &h->s;\n    Picture * const ref1 = &h->ref_list[1][0];\n    int j, old_ref, rfield;\n    int start= mbafi ? 16                      : 0;\n    int end  = mbafi ? 16+2*h->ref_count[list] : h->ref_count[list];\n    int interl= mbafi || s->picture_structure != PICT_FRAME;\n    memset(map[list], 0, sizeof(map[list]));\n    for(rfield=0; rfield<2; rfield++){\n        for(old_ref=0; old_ref<ref1->ref_count[colfield][list]; old_ref++){\n            int poc = ref1->ref_poc[colfield][list][old_ref];\n            if     (!interl)\n                poc |= 3;\n            else if( interl && (poc&3) == 3)\n                poc= (poc&~3) + rfield + 1;\n            for(j=start; j<end; j++){\n                if(4*h->ref_list[list][j].frame_num + (h->ref_list[list][j].reference&3) == poc){\n                    int cur_ref= mbafi ? (j-16)^field : j;\n                    map[list][2*old_ref + (rfield^field) + 16] = cur_ref;\n                    if(rfield == field)\n                        map[list][old_ref] = cur_ref;\n                    break;\n                }\n            }\n        }\n    }\n}']