libavcodec/h264.c:683: error: Buffer Overrun L3
  Offset added: 60 Size: [0, +oo].

libavcodec/h264.c:432:1: <Length trace>
430.  * ff_thread_finish_setup()
431.  */
432. static void decode_postinit(H264Context *h, int setup_finished)
     ^
433. {
434.     const SPS *sps = h->ps.sps;

libavcodec/h264.c:432:1: Parameter `h->last_pocs[*]`
430.  * ff_thread_finish_setup()
431.  */
432. static void decode_postinit(H264Context *h, int setup_finished)
     ^
433. {
434.     const SPS *sps = h->ps.sps;

libavcodec/h264.c:683:5: Array access: Offset added: 60 Size: [0, +oo]
681.             h->delayed_pic[i] = h->delayed_pic[i + 1];
682.     }
683.     memmove(h->last_pocs, &h->last_pocs[1],
         ^
684.             sizeof(*h->last_pocs) * (MAX_DELAYED_PIC_COUNT - 1));
685.     h->last_pocs[MAX_DELAYED_PIC_COUNT - 1] = cur->poc;

static void decode_postinit(H264Context *h, int setup_finished)
{
    const SPS *sps = h->ps.sps;
    H264Picture *out = h->cur_pic_ptr;
    H264Picture *cur = h->cur_pic_ptr;
    int i, pics, out_of_order, out_idx;
    int invalid = 0, cnt = 0;
    if (h->next_output_pic)
        return;
    if (cur->field_poc[0] == INT_MAX || cur->field_poc[1] == INT_MAX) {
        return;
    }
    cur->f->interlaced_frame = 0;
    cur->f->repeat_pict      = 0;
    if (sps->pic_struct_present_flag) {
        H264SEIPictureTiming *pt = &h->sei.picture_timing;
        switch (pt->pic_struct) {
        case SEI_PIC_STRUCT_FRAME:
            break;
        case SEI_PIC_STRUCT_TOP_FIELD:
        case SEI_PIC_STRUCT_BOTTOM_FIELD:
            cur->f->interlaced_frame = 1;
            break;
        case SEI_PIC_STRUCT_TOP_BOTTOM:
        case SEI_PIC_STRUCT_BOTTOM_TOP:
            if (FIELD_OR_MBAFF_PICTURE(h))
                cur->f->interlaced_frame = 1;
            else
                cur->f->interlaced_frame = h->prev_interlaced_frame;
            break;
        case SEI_PIC_STRUCT_TOP_BOTTOM_TOP:
        case SEI_PIC_STRUCT_BOTTOM_TOP_BOTTOM:
            cur->f->repeat_pict = 1;
            break;
        case SEI_PIC_STRUCT_FRAME_DOUBLING:
            cur->f->repeat_pict = 2;
            break;
        case SEI_PIC_STRUCT_FRAME_TRIPLING:
            cur->f->repeat_pict = 4;
            break;
        }
        if ((pt->ct_type & 3) &&
            pt->pic_struct <= SEI_PIC_STRUCT_BOTTOM_TOP)
            cur->f->interlaced_frame = (pt->ct_type & (1 << 1)) != 0;
    } else {
        cur->f->interlaced_frame = FIELD_OR_MBAFF_PICTURE(h);
    }
    h->prev_interlaced_frame = cur->f->interlaced_frame;
    if (cur->field_poc[0] != cur->field_poc[1]) {
        cur->f->top_field_first = cur->field_poc[0] < cur->field_poc[1];
    } else {
        if (cur->f->interlaced_frame || sps->pic_struct_present_flag) {
            if (h->sei.picture_timing.pic_struct == SEI_PIC_STRUCT_TOP_BOTTOM ||
                h->sei.picture_timing.pic_struct == SEI_PIC_STRUCT_TOP_BOTTOM_TOP)
                cur->f->top_field_first = 1;
            else
                cur->f->top_field_first = 0;
        } else {
            cur->f->top_field_first = 0;
        }
    }
    if (h->sei.frame_packing.present &&
        h->sei.frame_packing.arrangement_type >= 0 &&
        h->sei.frame_packing.arrangement_type <= 6 &&
        h->sei.frame_packing.content_interpretation_type > 0 &&
        h->sei.frame_packing.content_interpretation_type < 3) {
        H264SEIFramePacking *fp = &h->sei.frame_packing;
        AVStereo3D *stereo = av_stereo3d_create_side_data(cur->f);
        if (!stereo)
            return;
        switch (fp->arrangement_type) {
        case 0:
            stereo->type = AV_STEREO3D_CHECKERBOARD;
            break;
        case 1:
            stereo->type = AV_STEREO3D_COLUMNS;
            break;
        case 2:
            stereo->type = AV_STEREO3D_LINES;
            break;
        case 3:
            if (fp->quincunx_subsampling)
                stereo->type = AV_STEREO3D_SIDEBYSIDE_QUINCUNX;
            else
                stereo->type = AV_STEREO3D_SIDEBYSIDE;
            break;
        case 4:
            stereo->type = AV_STEREO3D_TOPBOTTOM;
            break;
        case 5:
            stereo->type = AV_STEREO3D_FRAMESEQUENCE;
            break;
        case 6:
            stereo->type = AV_STEREO3D_2D;
            break;
        }
        if (fp->content_interpretation_type == 2)
            stereo->flags = AV_STEREO3D_FLAG_INVERT;
    }
    if (h->sei.display_orientation.present &&
        (h->sei.display_orientation.anticlockwise_rotation ||
         h->sei.display_orientation.hflip ||
         h->sei.display_orientation.vflip)) {
        H264SEIDisplayOrientation *o = &h->sei.display_orientation;
        double angle = o->anticlockwise_rotation * 360 / (double) (1 << 16);
        AVFrameSideData *rotation = av_frame_new_side_data(cur->f,
                                                           AV_FRAME_DATA_DISPLAYMATRIX,
                                                           sizeof(int32_t) * 9);
        if (!rotation)
            return;
        av_display_rotation_set((int32_t *)rotation->data, angle);
        av_display_matrix_flip((int32_t *)rotation->data,
                               o->hflip, o->vflip);
    }
    if (h->sei.afd.present) {
        AVFrameSideData *sd = av_frame_new_side_data(cur->f, AV_FRAME_DATA_AFD,
                                                     sizeof(uint8_t));
        if (!sd)
            return;
        *sd->data = h->sei.afd.active_format_description;
        h->sei.afd.present = 0;
    }
    if (h->sei.a53_caption.a53_caption) {
        H264SEIA53Caption *a53 = &h->sei.a53_caption;
        AVFrameSideData *sd = av_frame_new_side_data(cur->f,
                                                     AV_FRAME_DATA_A53_CC,
                                                     a53->a53_caption_size);
        if (!sd)
            return;
        memcpy(sd->data, a53->a53_caption, a53->a53_caption_size);
        av_freep(&a53->a53_caption);
        a53->a53_caption_size = 0;
    }
    if (sps->bitstream_restriction_flag ||
        h->avctx->strict_std_compliance >= FF_COMPLIANCE_NORMAL) {
        h->avctx->has_b_frames = FFMAX(h->avctx->has_b_frames, sps->num_reorder_frames);
    }
    pics = 0;
    while (h->delayed_pic[pics])
        pics++;
    assert(pics <= MAX_DELAYED_PIC_COUNT);
    h->delayed_pic[pics++] = cur;
    if (cur->reference == 0)
        cur->reference = DELAYED_PIC_REF;
    for (i = 0; i < MAX_DELAYED_PIC_COUNT; i++) {
        cnt     += out->poc < h->last_pocs[i];
        invalid += out->poc == INT_MIN;
    }
    if (!h->mmco_reset && !cur->f->key_frame &&
        cnt + invalid == MAX_DELAYED_PIC_COUNT && cnt > 0) {
        h->mmco_reset = 2;
        if (pics > 1)
            h->delayed_pic[pics - 2]->mmco_reset = 2;
    }
    if (h->mmco_reset || cur->f->key_frame) {
        for (i = 0; i < MAX_DELAYED_PIC_COUNT; i++)
            h->last_pocs[i] = INT_MIN;
        cnt     = 0;
        invalid = MAX_DELAYED_PIC_COUNT;
    }
    out     = h->delayed_pic[0];
    out_idx = 0;
    for (i = 1; i < MAX_DELAYED_PIC_COUNT &&
                h->delayed_pic[i] &&
                !h->delayed_pic[i - 1]->mmco_reset &&
                !h->delayed_pic[i]->f->key_frame;
         i++)
        if (h->delayed_pic[i]->poc < out->poc) {
            out     = h->delayed_pic[i];
            out_idx = i;
        }
    if (h->avctx->has_b_frames == 0 &&
        (h->delayed_pic[0]->f->key_frame || h->mmco_reset))
        h->next_outputed_poc = INT_MIN;
    out_of_order = !out->f->key_frame && !h->mmco_reset &&
                   (out->poc < h->next_outputed_poc);
    if (sps->bitstream_restriction_flag &&
        h->avctx->has_b_frames >= sps->num_reorder_frames) {
    } else if (out_of_order && pics - 1 == h->avctx->has_b_frames &&
               h->avctx->has_b_frames < MAX_DELAYED_PIC_COUNT) {
        if (invalid + cnt < MAX_DELAYED_PIC_COUNT) {
            h->avctx->has_b_frames = FFMAX(h->avctx->has_b_frames, cnt);
        }
    } else if (!h->avctx->has_b_frames &&
               ((h->next_outputed_poc != INT_MIN &&
                 out->poc > h->next_outputed_poc + 2) ||
                cur->f->pict_type == AV_PICTURE_TYPE_B)) {
        h->avctx->has_b_frames++;
    }
    if (pics > h->avctx->has_b_frames) {
        out->reference &= ~DELAYED_PIC_REF;
        for (i = out_idx; h->delayed_pic[i]; i++)
            h->delayed_pic[i] = h->delayed_pic[i + 1];
    }
    memmove(h->last_pocs, &h->last_pocs[1],
            sizeof(*h->last_pocs) * (MAX_DELAYED_PIC_COUNT - 1));
    h->last_pocs[MAX_DELAYED_PIC_COUNT - 1] = cur->poc;
    if (!out_of_order && pics > h->avctx->has_b_frames) {
        h->next_output_pic = out;
        if (out->mmco_reset) {
            if (out_idx > 0) {
                h->next_outputed_poc                    = out->poc;
                h->delayed_pic[out_idx - 1]->mmco_reset = out->mmco_reset;
            } else {
                h->next_outputed_poc = INT_MIN;
            }
        } else {
            if (out_idx == 0 && pics > 1 && h->delayed_pic[0]->f->key_frame) {
                h->next_outputed_poc = INT_MIN;
            } else {
                h->next_outputed_poc = out->poc;
            }
        }
        h->mmco_reset = 0;
    } else {
        av_log(h->avctx, AV_LOG_DEBUG, "no picture\n");
    }
    if (h->next_output_pic) {
        if (h->next_output_pic->recovered) {
            h->frame_recovered |= FRAME_RECOVERED_SEI;
        }
        h->next_output_pic->recovered |= !!(h->frame_recovered & FRAME_RECOVERED_SEI);
    }
    if (setup_finished && !h->avctx->hwaccel) {
        ff_thread_finish_setup(h->avctx);
        if (h->avctx->active_thread_type & FF_THREAD_FRAME)
            h->setup_finished = 1;
    }
}
['static void decode_postinit(H264Context *h, int setup_finished)\n{\n    const SPS *sps = h->ps.sps;\n    H264Picture *out = h->cur_pic_ptr;\n    H264Picture *cur = h->cur_pic_ptr;\n    int i, pics, out_of_order, out_idx;\n    int invalid = 0, cnt = 0;\n    if (h->next_output_pic)\n        return;\n    if (cur->field_poc[0] == INT_MAX || cur->field_poc[1] == INT_MAX) {\n        return;\n    }\n    cur->f->interlaced_frame = 0;\n    cur->f->repeat_pict      = 0;\n    if (sps->pic_struct_present_flag) {\n        H264SEIPictureTiming *pt = &h->sei.picture_timing;\n        switch (pt->pic_struct) {\n        case SEI_PIC_STRUCT_FRAME:\n            break;\n        case SEI_PIC_STRUCT_TOP_FIELD:\n        case SEI_PIC_STRUCT_BOTTOM_FIELD:\n            cur->f->interlaced_frame = 1;\n            break;\n        case SEI_PIC_STRUCT_TOP_BOTTOM:\n        case SEI_PIC_STRUCT_BOTTOM_TOP:\n            if (FIELD_OR_MBAFF_PICTURE(h))\n                cur->f->interlaced_frame = 1;\n            else\n                cur->f->interlaced_frame = h->prev_interlaced_frame;\n            break;\n        case SEI_PIC_STRUCT_TOP_BOTTOM_TOP:\n        case SEI_PIC_STRUCT_BOTTOM_TOP_BOTTOM:\n            cur->f->repeat_pict = 1;\n            break;\n        case SEI_PIC_STRUCT_FRAME_DOUBLING:\n            cur->f->repeat_pict = 2;\n            break;\n        case SEI_PIC_STRUCT_FRAME_TRIPLING:\n            cur->f->repeat_pict = 4;\n            break;\n        }\n        if ((pt->ct_type & 3) &&\n            pt->pic_struct <= SEI_PIC_STRUCT_BOTTOM_TOP)\n            cur->f->interlaced_frame = (pt->ct_type & (1 << 1)) != 0;\n    } else {\n        cur->f->interlaced_frame = FIELD_OR_MBAFF_PICTURE(h);\n    }\n    h->prev_interlaced_frame = cur->f->interlaced_frame;\n    if (cur->field_poc[0] != cur->field_poc[1]) {\n        cur->f->top_field_first = cur->field_poc[0] < cur->field_poc[1];\n    } else {\n        if (cur->f->interlaced_frame || sps->pic_struct_present_flag) {\n            if (h->sei.picture_timing.pic_struct == SEI_PIC_STRUCT_TOP_BOTTOM ||\n                h->sei.picture_timing.pic_struct == SEI_PIC_STRUCT_TOP_BOTTOM_TOP)\n                cur->f->top_field_first = 1;\n            else\n                cur->f->top_field_first = 0;\n        } else {\n            cur->f->top_field_first = 0;\n        }\n    }\n    if (h->sei.frame_packing.present &&\n        h->sei.frame_packing.arrangement_type >= 0 &&\n        h->sei.frame_packing.arrangement_type <= 6 &&\n        h->sei.frame_packing.content_interpretation_type > 0 &&\n        h->sei.frame_packing.content_interpretation_type < 3) {\n        H264SEIFramePacking *fp = &h->sei.frame_packing;\n        AVStereo3D *stereo = av_stereo3d_create_side_data(cur->f);\n        if (!stereo)\n            return;\n        switch (fp->arrangement_type) {\n        case 0:\n            stereo->type = AV_STEREO3D_CHECKERBOARD;\n            break;\n        case 1:\n            stereo->type = AV_STEREO3D_COLUMNS;\n            break;\n        case 2:\n            stereo->type = AV_STEREO3D_LINES;\n            break;\n        case 3:\n            if (fp->quincunx_subsampling)\n                stereo->type = AV_STEREO3D_SIDEBYSIDE_QUINCUNX;\n            else\n                stereo->type = AV_STEREO3D_SIDEBYSIDE;\n            break;\n        case 4:\n            stereo->type = AV_STEREO3D_TOPBOTTOM;\n            break;\n        case 5:\n            stereo->type = AV_STEREO3D_FRAMESEQUENCE;\n            break;\n        case 6:\n            stereo->type = AV_STEREO3D_2D;\n            break;\n        }\n        if (fp->content_interpretation_type == 2)\n            stereo->flags = AV_STEREO3D_FLAG_INVERT;\n    }\n    if (h->sei.display_orientation.present &&\n        (h->sei.display_orientation.anticlockwise_rotation ||\n         h->sei.display_orientation.hflip ||\n         h->sei.display_orientation.vflip)) {\n        H264SEIDisplayOrientation *o = &h->sei.display_orientation;\n        double angle = o->anticlockwise_rotation * 360 / (double) (1 << 16);\n        AVFrameSideData *rotation = av_frame_new_side_data(cur->f,\n                                                           AV_FRAME_DATA_DISPLAYMATRIX,\n                                                           sizeof(int32_t) * 9);\n        if (!rotation)\n            return;\n        av_display_rotation_set((int32_t *)rotation->data, angle);\n        av_display_matrix_flip((int32_t *)rotation->data,\n                               o->hflip, o->vflip);\n    }\n    if (h->sei.afd.present) {\n        AVFrameSideData *sd = av_frame_new_side_data(cur->f, AV_FRAME_DATA_AFD,\n                                                     sizeof(uint8_t));\n        if (!sd)\n            return;\n        *sd->data = h->sei.afd.active_format_description;\n        h->sei.afd.present = 0;\n    }\n    if (h->sei.a53_caption.a53_caption) {\n        H264SEIA53Caption *a53 = &h->sei.a53_caption;\n        AVFrameSideData *sd = av_frame_new_side_data(cur->f,\n                                                     AV_FRAME_DATA_A53_CC,\n                                                     a53->a53_caption_size);\n        if (!sd)\n            return;\n        memcpy(sd->data, a53->a53_caption, a53->a53_caption_size);\n        av_freep(&a53->a53_caption);\n        a53->a53_caption_size = 0;\n    }\n    if (sps->bitstream_restriction_flag ||\n        h->avctx->strict_std_compliance >= FF_COMPLIANCE_NORMAL) {\n        h->avctx->has_b_frames = FFMAX(h->avctx->has_b_frames, sps->num_reorder_frames);\n    }\n    pics = 0;\n    while (h->delayed_pic[pics])\n        pics++;\n    assert(pics <= MAX_DELAYED_PIC_COUNT);\n    h->delayed_pic[pics++] = cur;\n    if (cur->reference == 0)\n        cur->reference = DELAYED_PIC_REF;\n    for (i = 0; i < MAX_DELAYED_PIC_COUNT; i++) {\n        cnt     += out->poc < h->last_pocs[i];\n        invalid += out->poc == INT_MIN;\n    }\n    if (!h->mmco_reset && !cur->f->key_frame &&\n        cnt + invalid == MAX_DELAYED_PIC_COUNT && cnt > 0) {\n        h->mmco_reset = 2;\n        if (pics > 1)\n            h->delayed_pic[pics - 2]->mmco_reset = 2;\n    }\n    if (h->mmco_reset || cur->f->key_frame) {\n        for (i = 0; i < MAX_DELAYED_PIC_COUNT; i++)\n            h->last_pocs[i] = INT_MIN;\n        cnt     = 0;\n        invalid = MAX_DELAYED_PIC_COUNT;\n    }\n    out     = h->delayed_pic[0];\n    out_idx = 0;\n    for (i = 1; i < MAX_DELAYED_PIC_COUNT &&\n                h->delayed_pic[i] &&\n                !h->delayed_pic[i - 1]->mmco_reset &&\n                !h->delayed_pic[i]->f->key_frame;\n         i++)\n        if (h->delayed_pic[i]->poc < out->poc) {\n            out     = h->delayed_pic[i];\n            out_idx = i;\n        }\n    if (h->avctx->has_b_frames == 0 &&\n        (h->delayed_pic[0]->f->key_frame || h->mmco_reset))\n        h->next_outputed_poc = INT_MIN;\n    out_of_order = !out->f->key_frame && !h->mmco_reset &&\n                   (out->poc < h->next_outputed_poc);\n    if (sps->bitstream_restriction_flag &&\n        h->avctx->has_b_frames >= sps->num_reorder_frames) {\n    } else if (out_of_order && pics - 1 == h->avctx->has_b_frames &&\n               h->avctx->has_b_frames < MAX_DELAYED_PIC_COUNT) {\n        if (invalid + cnt < MAX_DELAYED_PIC_COUNT) {\n            h->avctx->has_b_frames = FFMAX(h->avctx->has_b_frames, cnt);\n        }\n    } else if (!h->avctx->has_b_frames &&\n               ((h->next_outputed_poc != INT_MIN &&\n                 out->poc > h->next_outputed_poc + 2) ||\n                cur->f->pict_type == AV_PICTURE_TYPE_B)) {\n        h->avctx->has_b_frames++;\n    }\n    if (pics > h->avctx->has_b_frames) {\n        out->reference &= ~DELAYED_PIC_REF;\n        for (i = out_idx; h->delayed_pic[i]; i++)\n            h->delayed_pic[i] = h->delayed_pic[i + 1];\n    }\n    memmove(h->last_pocs, &h->last_pocs[1],\n            sizeof(*h->last_pocs) * (MAX_DELAYED_PIC_COUNT - 1));\n    h->last_pocs[MAX_DELAYED_PIC_COUNT - 1] = cur->poc;\n    if (!out_of_order && pics > h->avctx->has_b_frames) {\n        h->next_output_pic = out;\n        if (out->mmco_reset) {\n            if (out_idx > 0) {\n                h->next_outputed_poc                    = out->poc;\n                h->delayed_pic[out_idx - 1]->mmco_reset = out->mmco_reset;\n            } else {\n                h->next_outputed_poc = INT_MIN;\n            }\n        } else {\n            if (out_idx == 0 && pics > 1 && h->delayed_pic[0]->f->key_frame) {\n                h->next_outputed_poc = INT_MIN;\n            } else {\n                h->next_outputed_poc = out->poc;\n            }\n        }\n        h->mmco_reset = 0;\n    } else {\n        av_log(h->avctx, AV_LOG_DEBUG, "no picture\\n");\n    }\n    if (h->next_output_pic) {\n        if (h->next_output_pic->recovered) {\n            h->frame_recovered |= FRAME_RECOVERED_SEI;\n        }\n        h->next_output_pic->recovered |= !!(h->frame_recovered & FRAME_RECOVERED_SEI);\n    }\n    if (setup_finished && !h->avctx->hwaccel) {\n        ff_thread_finish_setup(h->avctx);\n        if (h->avctx->active_thread_type & FF_THREAD_FRAME)\n            h->setup_finished = 1;\n    }\n}']