libavcodec/h264.c:3705: error: Integer Overflow L2
  ([0, +oo] - [0, 64]):unsigned32 by call to `ff_h264_fill_default_ref_list`.

libavcodec/h264.c:3289:1: Parameter `h->ref_count[*]`
3287.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
3288.  */
3289. static int decode_slice_header(H264Context *h, H264Context *h0)
      ^
3290. {
3291.     unsigned int first_mb_in_slice;

libavcodec/h264.c:3705:9: Call
3703. 
3704.     if (!default_ref_list_done)
3705.         ff_h264_fill_default_ref_list(h);
              ^
3706. 
3707.     if (h->slice_type_nos != AV_PICTURE_TYPE_I) {

libavcodec/h264_refs.c:116:1: <LHS trace>
114. }
115. 
116. int ff_h264_fill_default_ref_list(H264Context *h)
     ^
117. {
118.     int i, len;

libavcodec/h264_refs.c:116:1: Parameter `h->ref_count[*]`
  114. }
  115. 
  116. int ff_h264_fill_default_ref_list(H264Context *h)
       ^
  117. {
  118.     int i, len;

libavcodec/h264_refs.c:116:1: <RHS trace>
114. }
115. 
116. int ff_h264_fill_default_ref_list(H264Context *h)
     ^
117. {
118.     int i, len;

libavcodec/h264_refs.c:116:1: Parameter `h->ref_count[*]`
  114. }
  115. 
  116. int ff_h264_fill_default_ref_list(H264Context *h)
       ^
  117. {
  118.     int i, len;

libavcodec/h264_refs.c:142:17: Binary operation: ([0, +oo] - [0, 64]):unsigned32 by call to `ff_h264_fill_default_ref_list` 
  140. 
  141.             if (len < h->ref_count[list])
  142.                 memset(&h->default_ref_list[list][len], 0, sizeof(Picture) * (h->ref_count[list] - len));
                       ^
  143.             lens[list] = len;
  144.         }
