libavcodec/h264.c:3655: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `field_end`.

libavcodec/h264.c:3635:15: Call
3633.     }
3634. 
3635.     buf_index=decode_nal_units(h, buf, buf_size);
                    ^
3636.     if(buf_index < 0)
3637.         return -1;

libavcodec/h264.c:3337:1: Parameter `h->s.list_count`
  3335. 
  3336. 
  3337. static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
        ^
  3338.     MpegEncContext * const s = &h->s;
  3339.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:3655:9: Call
3653.         if(s->flags2 & CODEC_FLAG2_CHUNKS) decode_postinit(h, 1);
3654. 
3655.         field_end(h, 0);
              ^
3656. 
3657.         if (!h->next_output_pic) {

libavcodec/h264.c:2126:1: Parameter `h->s.list_count`
  2124. }
  2125. 
  2126. static void field_end(H264Context *h, int in_setup){
        ^
  2127.     MpegEncContext * const s = &h->s;
  2128.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:2170:9: Call
  2168.      */
  2169.     if (!FIELD_PICTURE)
  2170.         ff_er_frame_end(s);
                ^
  2171. 
  2172.     MPV_frame_end(s);

libavcodec/error_resilience.c:776:1: Parameter `s->list_count`
    774. }
    775. 
    776. void ff_er_frame_end(MpegEncContext *s){
         ^
    777.     int i, mb_x, mb_y, error, error_type, dc_error, mv_error, ac_error;
    778.     int distance;

libavcodec/error_resilience.c:995:13: Call
    993.             s->mb_x= mb_x;
    994.             s->mb_y= mb_y;
    995.             decode_mb(s, 0/*FIXME h264 partitioned slices need this set*/);
                     ^
    996.         }
    997.     }

libavcodec/error_resilience.c:43:1: Parameter `s->list_count`
      41. #undef mb_intra
      42. 
      43. static void decode_mb(MpegEncContext *s, int ref){
          ^
      44.     s->dest[0] = s->current_picture.data[0] + (s->mb_y * 16* s->linesize  ) + s->mb_x * 16;
      45.     s->dest[1] = s->current_picture.data[1] + (s->mb_y * (16>>s->chroma_y_shift) * s->uvlinesize) + s->mb_x * (16>>s->chroma_x_shift);

libavcodec/error_resilience.c:59:9: Call
      57.         fill_rectangle(h->mv_cache[0][ scan8[0] ], 4, 4, 8, pack16to32(s->mv[0][0][0],s->mv[0][0][1]), 4);
      58.         assert(!FRAME_MBAFF);
      59.         ff_h264_hl_decode_mb(h);
                  ^
      60.     }else{
      61.         assert(ref==0);

libavcodec/h264.c:1847:1: Parameter `h->list_count`
        1845. }
        1846. 
        1847. void ff_h264_hl_decode_mb(H264Context *h){
              ^
        1848.     MpegEncContext * const s = &h->s;
        1849.     const int mb_xy= h->mb_xy;

libavcodec/h264.c:1854:9: Call
        1852. 
        1853.     if (is_complex) {
        1854.         hl_decode_mb_complex(h);
                      ^
        1855.     } else if (h->pixel_shift) {
        1856.         hl_decode_mb_simple_16(h);

libavcodec/h264.c:1843:1: Parameter `h->list_count`
          1841.  * Process a macroblock; this handles edge cases, such as interlacing.
          1842.  */
          1843. static void av_noinline hl_decode_mb_complex(H264Context *h){
                ^
          1844.     hl_decode_mb_internal(h, 0, h->pixel_shift);
          1845. }

libavcodec/h264.c:1844:5: Call
          1842.  */
          1843. static void av_noinline hl_decode_mb_complex(H264Context *h){
          1844.     hl_decode_mb_internal(h, 0, h->pixel_shift);
                    ^
          1845. }
          1846. 

libavcodec/h264.c:1541:1: Parameter `h->list_count`
            1539. }
            1540. 
            1541. static av_always_inline void hl_decode_mb_internal(H264Context *h, int simple, int pixel_shift){
                  ^
            1542.     MpegEncContext * const s = &h->s;
            1543.     const int mb_x= s->mb_x;

libavcodec/h264.c:1735:17: Call
            1733.         }else if(is_h264){
            1734.             if (pixel_shift) {
            1735.                 hl_motion_16(h, dest_y, dest_cb, dest_cr,
                                  ^
            1736.                              s->me.qpel_put, s->dsp.put_h264_chroma_pixels_tab,
            1737.                              s->me.qpel_avg, s->dsp.avg_h264_chroma_pixels_tab,

libavcodec/h264.c:762:1: Parameter `h->list_count`
              760. }
              761. hl_motion_fn(0, 8);
              762. hl_motion_fn(1, 16);
                   ^
              763. 
              764. static void free_tables(H264Context *h, int free_rbsp){

libavcodec/h264.c:762:1: Call
              760. }
              761. hl_motion_fn(0, 8);
              762. hl_motion_fn(1, 16);
                   ^
              763. 
              764. static void free_tables(H264Context *h, int free_rbsp){

libavcodec/h264.c:646:1: Parameter `h->list_count`
                644. }
                645. 
                646. static av_always_inline void hl_motion(H264Context *h, uint8_t *dest_y, uint8_t *dest_cb, uint8_t *dest_cr,
                     ^
                647.                       qpel_mc_func (*qpix_put)[16], h264_chroma_mc_func (*chroma_put),
                648.                       qpel_mc_func (*qpix_avg)[16], h264_chroma_mc_func (*chroma_avg),

libavcodec/h264.c:658:9: Call
                656. 
                657.     if(HAVE_PTHREADS && (s->avctx->active_thread_type & FF_THREAD_FRAME))
                658.         await_references(h);
                             ^
                659.     prefetch_motion(h, 0, pixel_shift);
                660. 

libavcodec/h264.c:299:1: <LHS trace>
297.  * @param h the H264 context
298.  */
299. static void await_references(H264Context *h){
     ^
300.     MpegEncContext * const s = &h->s;
301.     const int mb_xy= h->mb_xy;

libavcodec/h264.c:299:1: Parameter `h->list_count`
                  297.  * @param h the H264 context
                  298.  */
                  299. static void await_references(H264Context *h){
                       ^
                  300.     MpegEncContext * const s = &h->s;
                  301.     const int mb_xy= h->mb_xy;

libavcodec/h264.c:357:9: Binary operation: ([0, +oo] - 1):unsigned32 by call to `field_end` 
                  355.     }
                  356. 
                  357.     for(list=h->list_count-1; list>=0; list--){
                               ^
                  358.         for(ref=0; ref<48 && nrefs[list]; ref++){
                  359.             int row = refs[list][ref];
