libavcodec/h264.c:4283: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `decode_slice_header`.

libavcodec/h264.c:4147:1: Parameter `h->s.list_count`
4145. }
4146. 
4147. static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size)
      ^
4148. {
4149.     MpegEncContext *const s     = &h->s;

libavcodec/h264.c:4283:28: Call
4281.                 hx->s.data_partitioning = 0;
4282. 
4283.                 if ((err = decode_slice_header(hx, h)))
                                 ^
4284.                     break;
4285. 

libavcodec/h264.c:2864:1: Parameter `h->s.list_count`
  2862.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
  2863.  */
  2864. static int decode_slice_header(H264Context *h, H264Context *h0)
        ^
  2865. {
  2866.     MpegEncContext *const s  = &h->s;

libavcodec/h264.c:2889:13: Call
  2887.     if (first_mb_in_slice == 0) { // FIXME better field boundary detection
  2888.         if (h0->current_slice && FIELD_PICTURE) {
  2889.             field_end(h, 1);
                    ^
  2890.         }
  2891. 

libavcodec/h264.c:2742:1: Parameter `h->s.list_count`
    2740. }
    2741. 
    2742. static int field_end(H264Context *h, int in_setup)
          ^
    2743. {
    2744.     MpegEncContext *const s     = &h->s;

libavcodec/h264.c:2791:9: Call
    2789.      */
    2790.     if (!FIELD_PICTURE)
    2791.         ff_er_frame_end(s);
                  ^
    2792. 
    2793.     ff_MPV_frame_end(s);

libavcodec/error_resilience.c:882:1: Parameter `s->list_count`
      880. }
      881. 
      882. void ff_er_frame_end(MpegEncContext *s)
           ^
      883. {
      884.     int i, mb_x, mb_y, error, error_type, dc_error, mv_error, ac_error;

libavcodec/error_resilience.c:1060:23: Call
      1058.            dc_error, ac_error, mv_error);
      1059. 
      1060.     is_intra_likely = is_intra_more_likely(s);
                                  ^
      1061. 
      1062.     /* set unknown mb-type to most likely */

libavcodec/error_resilience.c:718:1: Parameter `s->list_count`
        716. }
        717. 
        718. static int is_intra_more_likely(MpegEncContext *s)
             ^
        719. {
        720.     int is_intra_likely, i, j, undamaged_count, skip_amount, mb_x, mb_y;

libavcodec/error_resilience.c:1125:13: Call
      1123.             s->mb_x = mb_x;
      1124.             s->mb_y = mb_y;
      1125.             decode_mb(s, 0 /* FIXME h264 partitioned slices need this set */);
                        ^
      1126.         }
      1127.     }

libavcodec/error_resilience.c:43:1: Parameter `s->list_count`
        41. #undef mb_intra
        42. 
        43. static void decode_mb(MpegEncContext *s, int ref)
            ^
        44. {
        45.     s->dest[0] = s->current_picture.f.data[0] + (s->mb_y *  16                       * s->linesize)   + s->mb_x *  16;

libavcodec/error_resilience.c:66:9: Call
        64.                        pack16to32(s->mv[0][0][0], s->mv[0][0][1]), 4);
        65.         assert(!FRAME_MBAFF);
        66.         ff_h264_hl_decode_mb(h);
                    ^
        67.     } else {
        68.         assert(ref == 0);

libavcodec/h264.c:2442:1: Parameter `h->list_count`
          2440. }
          2441. 
          2442. void ff_h264_hl_decode_mb(H264Context *h)
                ^
          2443. {
          2444.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:2451:13: Call
          2449.     if (CHROMA444) {
          2450.         if (is_complex || h->pixel_shift)
          2451.             hl_decode_mb_444_complex(h);
                            ^
          2452.         else
          2453.             hl_decode_mb_444_simple(h);

libavcodec/h264.c:2432:1: Parameter `h->list_count`
            2430. }
            2431. 
            2432. static av_noinline void hl_decode_mb_444_complex(H264Context *h)
                  ^
            2433. {
            2434.     hl_decode_mb_444_internal(h, 0, h->pixel_shift);

libavcodec/h264.c:2434:5: Call
            2432. static av_noinline void hl_decode_mb_444_complex(H264Context *h)
            2433. {
            2434.     hl_decode_mb_444_internal(h, 0, h->pixel_shift);
                      ^
            2435. }
            2436. 

libavcodec/h264.c:2309:1: Parameter `h->list_count`
              2307. }
              2308. 
              2309. static av_always_inline void hl_decode_mb_444_internal(H264Context *h,
                    ^
              2310.                                                        int simple,
              2311.                                                        int pixel_shift)

libavcodec/h264.c:2394:13: Call
              2392.                                linesize, 0, 1, simple, pixel_shift);
              2393.         } else {
              2394.             hl_motion(h, dest[0], dest[1], dest[2],
                                ^
              2395.                       s->me.qpel_put, s->dsp.put_h264_chroma_pixels_tab,
              2396.                       s->me.qpel_avg, s->dsp.avg_h264_chroma_pixels_tab,

libavcodec/h264.c:769:1: Parameter `h->list_count`
                767. }
                768. 
                769. static av_always_inline void hl_motion(H264Context *h, uint8_t *dest_y,
                     ^
                770.                                        uint8_t *dest_cb, uint8_t *dest_cr,
                771.                                        qpel_mc_func(*qpix_put)[16],

libavcodec/h264.c:786:9: Call
                784. 
                785.     if (HAVE_THREADS && (s->avctx->active_thread_type & FF_THREAD_FRAME))
                786.         await_references(h);
                             ^
                787.     prefetch_motion(h, 0, pixel_shift, chroma_idc);
                788. 

libavcodec/h264.c:336:1: <LHS trace>
334.  * @param h the H264 context
335.  */
336. static void await_references(H264Context *h)
     ^
337. {
338.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:336:1: Parameter `h->list_count`
                  334.  * @param h the H264 context
                  335.  */
                  336. static void await_references(H264Context *h)
                       ^
                  337. {
                  338.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:407:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `decode_slice_header` 
                  405.     }
                  406. 
                  407.     for (list = h->list_count - 1; list >= 0; list--)
                                ^
                  408.         for (ref = 0; ref < 48 && nrefs[list]; ref++) {
                  409.             int row = refs[list][ref];
