libavcodec/hevc_ps.c:864: error: Integer Overflow L2
  ([1, 64] - [-oo, 64]):unsigned32 by call to `ff_hevc_decode_short_term_rps`.

libavcodec/hevc_ps.c:863:10: Assignment
861.         goto err;
862.     }
863.     for (i = 0; i < sps->nb_st_rps; i++) {
              ^
864.         if ((ret = ff_hevc_decode_short_term_rps(gb, avctx, &sps->st_rps[i],
865.                                                  sps, 0)) < 0)

libavcodec/hevc_ps.c:864:20: Call
862.     }
863.     for (i = 0; i < sps->nb_st_rps; i++) {
864.         if ((ret = ff_hevc_decode_short_term_rps(gb, avctx, &sps->st_rps[i],
                        ^
865.                                                  sps, 0)) < 0)
866.             goto err;

libavcodec/hevc_ps.c:109:1: <LHS trace>
107. }
108. 
109. int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx,
     ^
110.                                   ShortTermRPS *rps, const HEVCSPS *sps, int is_slice_header)
111. {

libavcodec/hevc_ps.c:109:1: Parameter `sps->nb_st_rps`
  107. }
  108. 
  109. int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx,
       ^
  110.                                   ShortTermRPS *rps, const HEVCSPS *sps, int is_slice_header)
  111. {

libavcodec/hevc_ps.c:109:1: <RHS trace>
107. }
108. 
109. int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx,
     ^
110.                                   ShortTermRPS *rps, const HEVCSPS *sps, int is_slice_header)
111. {

libavcodec/hevc_ps.c:109:1: Parameter `sps->nb_st_rps`
  107. }
  108. 
  109. int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx,
       ^
  110.                                   ShortTermRPS *rps, const HEVCSPS *sps, int is_slice_header)
  111. {

libavcodec/hevc_ps.c:136:13: Binary operation: ([1, 64] - [-oo, 64]):unsigned32 by call to `ff_hevc_decode_short_term_rps` 
  134.                 return AVERROR_INVALIDDATA;
  135.             }
  136.             rps_ridx = &sps->st_rps[sps->nb_st_rps - delta_idx];
                   ^
  137.         } else
  138.             rps_ridx = &sps->st_rps[rps - sps->st_rps - 1];
