libavcodec/h264.c:3998: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `decode_slice_header`.

libavcodec/h264.c:3847:1: Parameter `h->s.list_count`
3845. }
3846. 
3847. static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size,
      ^
3848.                             int parse_extradata)
3849. {

libavcodec/h264.c:3998:28: Call
3996.                 hx->s.data_partitioning = 0;
3997. 
3998.                 if ((err = decode_slice_header(hx, h)))
                                 ^
3999.                     break;
4000. 

libavcodec/h264.c:2598:1: Parameter `h->s.list_count`
  2596.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
  2597.  */
  2598. static int decode_slice_header(H264Context *h, H264Context *h0)
        ^
  2599. {
  2600.     MpegEncContext *const s  = &h->s;

libavcodec/h264.c:2617:13: Call
  2615.     if (first_mb_in_slice == 0) { // FIXME better field boundary detection
  2616.         if (h0->current_slice && FIELD_PICTURE) {
  2617.             field_end(h, 1);
                    ^
  2618.         }
  2619. 

libavcodec/h264.c:2295:1: Parameter `h->s.list_count`
    2293. }
    2294. 
    2295. static int field_end(H264Context *h, int in_setup)
          ^
    2296. {
    2297.     MpegEncContext *const s     = &h->s;

libavcodec/h264.c:2344:9: Call
    2342.      */
    2343.     if (!FIELD_PICTURE)
    2344.         ff_er_frame_end(s);
                  ^
    2345. 
    2346.     ff_MPV_frame_end(s);

libavcodec/error_resilience.c:878:1: Parameter `s->list_count`
      876. }
      877. 
      878. void ff_er_frame_end(MpegEncContext *s)
           ^
      879. {
      880.     int i, mb_x, mb_y, error, error_type, dc_error, mv_error, ac_error;

libavcodec/error_resilience.c:1056:23: Call
      1054.            dc_error, ac_error, mv_error);
      1055. 
      1056.     is_intra_likely = is_intra_more_likely(s);
                                  ^
      1057. 
      1058.     /* set unknown mb-type to most likely */

libavcodec/error_resilience.c:715:1: Parameter `s->list_count`
        713. }
        714. 
        715. static int is_intra_more_likely(MpegEncContext *s)
             ^
        716. {
        717.     int is_intra_likely, i, j, undamaged_count, skip_amount, mb_x, mb_y;

libavcodec/error_resilience.c:1121:13: Call
      1119.             s->mb_x = mb_x;
      1120.             s->mb_y = mb_y;
      1121.             decode_mb(s, 0 /* FIXME h264 partitioned slices need this set */);
                        ^
      1122.         }
      1123.     }

libavcodec/error_resilience.c:43:1: Parameter `s->list_count`
        41. #undef mb_intra
        42. 
        43. static void decode_mb(MpegEncContext *s, int ref)
            ^
        44. {
        45.     s->dest[0] = s->current_picture.f.data[0] + (s->mb_y *  16                       * s->linesize)   + s->mb_x *  16;

libavcodec/error_resilience.c:66:9: Call
        64.                        pack16to32(s->mv[0][0][0], s->mv[0][0][1]), 4);
        65.         assert(!FRAME_MBAFF);
        66.         ff_h264_hl_decode_mb(h);
                    ^
        67.     } else {
        68.         assert(ref == 0);

libavcodec/h264.c:1983:1: Parameter `h->list_count`
          1981. #include "h264_mb_template.c"
          1982. 
          1983. void ff_h264_hl_decode_mb(H264Context *h)
                ^
          1984. {
          1985.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:1992:13: Call
          1990.     if (CHROMA444) {
          1991.         if (is_complex || h->pixel_shift)
          1992.             hl_decode_mb_444_complex(h);
                            ^
          1993.         else
          1994.             hl_decode_mb_444_simple_8(h);

libavcodec/h264_mb_template.c:278:1: Parameter `h->list_count`
            276. #include "h264_mc_template.c"
            277. 
            278. static av_noinline void FUNC(hl_decode_mb_444)(H264Context *h)
                 ^
            279. {
            280.     MpegEncContext *const s = &h->s;

libavcodec/h264_mb_template.c:362:13: Call
            360.                                linesize, 0, 1, SIMPLE, PIXEL_SHIFT);
            361.         } else {
            362.             FUNC(hl_motion_444)(h, dest[0], dest[1], dest[2],
                             ^
            363.                       s->me.qpel_put, h->h264chroma.put_h264_chroma_pixels_tab,
            364.                       s->me.qpel_avg, h->h264chroma.avg_h264_chroma_pixels_tab,

libavcodec/h264_mc_template.c:61:1: Parameter `h->list_count`
              59. }
              60. 
              61. static void MCFUNC(hl_motion)(H264Context *h, uint8_t *dest_y,
                  ^
              62.                               uint8_t *dest_cb, uint8_t *dest_cr,
              63.                               qpel_mc_func(*qpix_put)[16],

libavcodec/h264_mc_template.c:77:9: Call
              75. 
              76.     if (HAVE_THREADS && (s->avctx->active_thread_type & FF_THREAD_FRAME))
              77.         await_references(h);
                          ^
              78.     prefetch_motion(h, 0, PIXEL_SHIFT, CHROMA_IDC);
              79. 

libavcodec/h264.c:356:1: <LHS trace>
354.  * @param h the H264 context
355.  */
356. static void await_references(H264Context *h)
     ^
357. {
358.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:356:1: Parameter `h->list_count`
                354.  * @param h the H264 context
                355.  */
                356. static void await_references(H264Context *h)
                     ^
                357. {
                358.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:427:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `decode_slice_header` 
                425.     }
                426. 
                427.     for (list = h->list_count - 1; list >= 0; list--)
                              ^
                428.         for (ref = 0; ref < 48 && nrefs[list]; ref++) {
                429.             int row = refs[list][ref];
