libavcodec/h264dec.c:742: error: Buffer Overrun L2
  Offset: [0, 2147483647] Size: 2 by call to `decode_nal_units`.

libavcodec/h264dec.c:742:17: Call
740.     }
741. 
742.     buf_index = decode_nal_units(h, buf, buf_size);
                     ^
743.     if (buf_index < 0)
744.         return AVERROR_INVALIDDATA;

libavcodec/h264dec.c:528:11: Call
  526.     }
  527. 
  528.     ret = ff_h2645_packet_split(&h->pkt, buf, buf_size, avctx, h->is_avc,
                 ^
  529.                                 h->nal_length_size, avctx->codec_id);
  530.     if (ret < 0) {

libavcodec/h2645_parse.c:301:15: Call
    299.         nal->size_bits = get_bit_length(nal, skip_trailing_zeros);
    300. 
    301.         ret = init_get_bits(&nal->gb, nal->data, nal->size_bits);
                       ^
    302.         if (ret < 0)
    303.             return ret;

libavcodec/get_bits.h:362:1: Parameter `bit_size`
      360.  * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
      361.  */
      362. static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
           ^
      363.                                 int bit_size)
      364. {

libavcodec/get_bits.h:379:5: Assignment
      377.     s->size_in_bits       = bit_size;
      378. #if !UNCHECKED_BITSTREAM_READER
      379.     s->size_in_bits_plus8 = bit_size + 8;
               ^
      380. #endif
      381.     s->buffer_end         = buffer + buffer_size;

libavcodec/h264dec.c:742:17: Call
740.     }
741. 
742.     buf_index = decode_nal_units(h, buf, buf_size);
                     ^
743.     if (buf_index < 0)
744.         return AVERROR_INVALIDDATA;

libavcodec/h264dec.c:515:1: Parameter `h->slice_ctx->list_count`
  513. }
  514. 
  515. static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size)
       ^
  516. {
  517.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264dec.c:573:24: Call
  571.             idr(h); // FIXME ensure we don't lose some frames if there is reordering
  572.         case H264_NAL_SLICE:
  573.             if ((err = ff_h264_queue_decode_slice(h, nal)))
                              ^
  574.                 break;
  575. 

libavcodec/h264_slice.c:1855:1: Parameter `h->slice_ctx->list_count`
    1853. }
    1854. 
    1855. int ff_h264_queue_decode_slice(H264Context *h, const H2645NAL *nal)
          ^
    1856. {
    1857.     H264SliceContext *sl = h->slice_ctx + h->nb_slice_ctx_queued;

libavcodec/h264_slice.c:1862:11: Call
    1860.     sl->gb = nal->gb;
    1861. 
    1862.     ret = h264_slice_header_parse(sl, nal, &h->ps, h->avctx);
                    ^
    1863.     if (ret < 0)
    1864.         return ret;

libavcodec/h264_slice.c:1512:1: Parameter `sl->list_count`
      1510. }
      1511. 
      1512. static int h264_slice_header_parse(H264SliceContext *sl, const H2645NAL *nal,
            ^
      1513.                                    const H264ParamSets *ps, AVCodecContext *avctx)
      1514. {

libavcodec/h264_slice.c:1908:11: Call
    1906.     }
    1907. 
    1908.     ret = h264_slice_init(h, sl, nal);
                    ^
    1909.     if (ret < 0)
    1910.         return ret;

libavcodec/h264_slice.c:1707:1: Parameter `sl->list_count`
      1705. /* do all the per-slice initialization needed before we can start decoding the
      1706.  * actual MBs */
      1707. static int h264_slice_init(H264Context *h, H264SliceContext *sl,
            ^
      1708.                            const H2645NAL *nal)
      1709. {

libavcodec/h264_slice.c:1750:11: Call
      1748.     assert(sl->mb_y < h->mb_height);
      1749. 
      1750.     ret = ff_h264_build_ref_list(h, sl);
                      ^
      1751.     if (ret < 0)
      1752.         return ret;

libavcodec/h264_refs.c:256:1: Parameter `sl->list_count`
        254. }
        255. 
        256. int ff_h264_build_ref_list(const H264Context *h, H264SliceContext *sl)
             ^
        257. {
        258.     int list, index, pic_structure;

libavcodec/h264_slice.c:1765:5: Call
      1763.     if (sl->slice_type_nos == AV_PICTURE_TYPE_B && !sl->direct_spatial_mv_pred)
      1764.         ff_h264_direct_dist_scale_factor(h, sl);
      1765.     ff_h264_direct_ref_list_init(h, sl);
                ^
      1766. 
      1767.     if (h->avctx->skip_loop_filter >= AVDISCARD_ALL ||

libavcodec/h264_direct.c:111:1: <Offset trace>
109. }
110. 
111. void ff_h264_direct_ref_list_init(const H264Context *const h, H264SliceContext *sl)
     ^
112. {
113.     H264Ref *const ref1 = &sl->ref_list[1][0];

libavcodec/h264_direct.c:111:1: Parameter `sl->list_count`
        109. }
        110. 
        111. void ff_h264_direct_ref_list_init(const H264Context *const h, H264SliceContext *sl)
             ^
        112. {
        113.     H264Ref *const ref1 = &sl->ref_list[1][0];

libavcodec/h264_direct.c:111:1: <Length trace>
109. }
110. 
111. void ff_h264_direct_ref_list_init(const H264Context *const h, H264SliceContext *sl)
     ^
112. {
113.     H264Ref *const ref1 = &sl->ref_list[1][0];

libavcodec/h264_direct.c:111:1: Parameter `h->cur_pic_ptr->ref_count[*][*]`
        109. }
        110. 
        111. void ff_h264_direct_ref_list_init(const H264Context *const h, H264SliceContext *sl)
             ^
        112. {
        113.     H264Ref *const ref1 = &sl->ref_list[1][0];

libavcodec/h264_direct.c:120:9: Array access: Offset: [0, 2147483647] Size: 2 by call to `decode_nal_units` 
        118. 
        119.     for (list = 0; list < sl->list_count; list++) {
        120.         cur->ref_count[sidx][list] = sl->ref_count[list];
                     ^
        121.         for (j = 0; j < sl->ref_count[list]; j++)
        122.             cur->ref_poc[sidx][list][j] = 4 * sl->ref_list[list][j].parent->frame_num +
