libavcodec/h264_slice.c:1492: error: Integer Overflow L2
  ([0, +oo] - [0, 64]):unsigned32 by call to `ff_h264_fill_default_ref_list`.

libavcodec/h264_slice.c:1067:1: Parameter `sl->ref_count[*]`
1065.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
1066.  */
1067. int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl)
      ^
1068. {
1069.     unsigned int first_mb_in_slice;

libavcodec/h264_slice.c:1492:9: Call
1490. 
1491.     if (!default_ref_list_done)
1492.         ff_h264_fill_default_ref_list(h, sl);
              ^
1493. 
1494.     if (sl->slice_type_nos != AV_PICTURE_TYPE_I) {

libavcodec/h264_refs.c:122:1: <LHS trace>
120. }
121. 
122. int ff_h264_fill_default_ref_list(H264Context *h, H264SliceContext *sl)
     ^
123. {
124.     int i, len;

libavcodec/h264_refs.c:122:1: Parameter `sl->ref_count[*]`
  120. }
  121. 
  122. int ff_h264_fill_default_ref_list(H264Context *h, H264SliceContext *sl)
       ^
  123. {
  124.     int i, len;

libavcodec/h264_refs.c:122:1: <RHS trace>
120. }
121. 
122. int ff_h264_fill_default_ref_list(H264Context *h, H264SliceContext *sl)
     ^
123. {
124.     int i, len;

libavcodec/h264_refs.c:122:1: Parameter `sl->ref_count[*]`
  120. }
  121. 
  122. int ff_h264_fill_default_ref_list(H264Context *h, H264SliceContext *sl)
       ^
  123. {
  124.     int i, len;

libavcodec/h264_refs.c:148:17: Binary operation: ([0, +oo] - [0, 64]):unsigned32 by call to `ff_h264_fill_default_ref_list` 
  146. 
  147.             if (len < sl->ref_count[list])
  148.                 memset(&h->default_ref_list[list][len], 0, sizeof(H264Ref) * (sl->ref_count[list] - len));
                       ^
  149.             lens[list] = len;
  150.         }
