libavcodec/hevc_ps.c:873: error: Integer Overflow L2
  ([1, 64] - [-oo, 64]):unsigned32 by call to `ff_hevc_decode_short_term_rps`.

libavcodec/hevc_ps.c:872:10: Assignment
870.         goto err;
871.     }
872.     for (i = 0; i < sps->nb_st_rps; i++) {
              ^
873.         if ((ret = ff_hevc_decode_short_term_rps(gb, avctx, &sps->st_rps[i],
874.                                                  sps, 0)) < 0)

libavcodec/hevc_ps.c:873:20: Call
871.     }
872.     for (i = 0; i < sps->nb_st_rps; i++) {
873.         if ((ret = ff_hevc_decode_short_term_rps(gb, avctx, &sps->st_rps[i],
                        ^
874.                                                  sps, 0)) < 0)
875.             goto err;

libavcodec/hevc_ps.c:109:1: <LHS trace>
107. }
108. 
109. int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx,
     ^
110.                                   ShortTermRPS *rps, const HEVCSPS *sps, int is_slice_header)
111. {

libavcodec/hevc_ps.c:109:1: Parameter `sps->nb_st_rps`
  107. }
  108. 
  109. int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx,
       ^
  110.                                   ShortTermRPS *rps, const HEVCSPS *sps, int is_slice_header)
  111. {

libavcodec/hevc_ps.c:109:1: <RHS trace>
107. }
108. 
109. int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx,
     ^
110.                                   ShortTermRPS *rps, const HEVCSPS *sps, int is_slice_header)
111. {

libavcodec/hevc_ps.c:109:1: Parameter `sps->nb_st_rps`
  107. }
  108. 
  109. int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx,
       ^
  110.                                   ShortTermRPS *rps, const HEVCSPS *sps, int is_slice_header)
  111. {

libavcodec/hevc_ps.c:136:13: Binary operation: ([1, 64] - [-oo, 64]):unsigned32 by call to `ff_hevc_decode_short_term_rps` 
  134.                 return AVERROR_INVALIDDATA;
  135.             }
  136.             rps_ridx = &sps->st_rps[sps->nb_st_rps - delta_idx];
                   ^
  137.             rps->rps_idx_num_delta_pocs = rps_ridx->num_delta_pocs;
  138.         } else
