libavcodec/h264.c:4037: error: Buffer Overrun L1
  Offset: [20, 51] Size: 2.

libavcodec/h264.c:4036:13: <Offset trace>
4034.         ref2frm[18+0]=
4035.         ref2frm[18+1]= -1;
4036.         for(i=16; i<48; i++)
                  ^
4037.             ref2frm[i+4]= 4*h->ref_list[j][i].frame_num
4038.                           +(h->ref_list[j][i].reference&3);

libavcodec/h264.c:4036:13: Assignment
4034.         ref2frm[18+0]=
4035.         ref2frm[18+1]= -1;
4036.         for(i=16; i<48; i++)
                  ^
4037.             ref2frm[i+4]= 4*h->ref_list[j][i].frame_num
4038.                           +(h->ref_list[j][i].reference&3);

libavcodec/h264.c:3628:1: <Length trace>
3626.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
3627.  */
3628. static int decode_slice_header(H264Context *h, H264Context *h0){
      ^
3629.     MpegEncContext * const s = &h->s;
3630.     MpegEncContext * const s0 = &h0->s;

libavcodec/h264.c:3628:1: Parameter `h->ref2frm[*][*]`
3626.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
3627.  */
3628. static int decode_slice_header(H264Context *h, H264Context *h0){
      ^
3629.     MpegEncContext * const s = &h->s;
3630.     MpegEncContext * const s0 = &h0->s;

libavcodec/h264.c:4028:9: Assignment
4026. 
4027.     for(j=0; j<2; j++){
4028.         int *ref2frm= h->ref2frm[h->slice_num&(MAX_SLICES-1)][j];
              ^
4029.         ref2frm[0]=
4030.         ref2frm[1]= -1;

libavcodec/h264.c:4037:13: Array access: Offset: [20, 51] Size: 2
4035.         ref2frm[18+1]= -1;
4036.         for(i=16; i<48; i++)
4037.             ref2frm[i+4]= 4*h->ref_list[j][i].frame_num
                  ^
4038.                           +(h->ref_list[j][i].reference&3);
4039.     }
