libavcodec/h264_slice.c:2107: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `ff_h264_hl_decode_mb`.

libavcodec/h264_slice.c:2069:1: Parameter `arg->list_count`
2067. }
2068. 
2069. static int decode_slice(struct AVCodecContext *avctx, void *arg)
      ^
2070. {
2071.     H264SliceContext *sl = arg;

libavcodec/h264_slice.c:2102:23: Call
2100.         for (;;) {
2101.             // START_TIMER
2102.             int ret = ff_h264_decode_mb_cabac(h, sl);
                            ^
2103.             int eos;
2104.             // STOP_TIMER("decode_mb_cabac")

libavcodec/h264_cabac.c:1909:1: Parameter `sl->list_count`
  1907.  * @return 0 if OK, ER_AC_ERROR / ER_DC_ERROR / ER_MV_ERROR if an error is noticed
  1908.  */
  1909. int ff_h264_decode_mb_cabac(const H264Context *h, H264SliceContext *sl)
        ^
  1910. {
  1911.     int mb_xy;

libavcodec/h264_slice.c:2107:17: Call
2105. 
2106.             if (ret >= 0)
2107.                 ff_h264_hl_decode_mb(h, sl);
                      ^
2108. 
2109.             // FIXME optimal? or let mb_decode decode 16x32 ?

libavcodec/h264_mb.c:812:1: Parameter `sl->list_count`
  810. #include "h264_mb_template.c"
  811. 
  812. void ff_h264_hl_decode_mb(const H264Context *h, H264SliceContext *sl)
       ^
  813. {
  814.     const int mb_xy   = sl->mb_xy;

libavcodec/h264_mb.c:821:13: Call
  819.     if (CHROMA444(h)) {
  820.         if (is_complex || h->pixel_shift)
  821.             hl_decode_mb_444_complex(h, sl);
                   ^
  822.         else
  823.             hl_decode_mb_444_simple_8(h, sl);

libavcodec/h264_mb_template.c:275:1: Parameter `sl->list_count`
    273. #include "h264_mc_template.c"
    274. 
    275. static av_noinline void FUNC(hl_decode_mb_444)(const H264Context *h, H264SliceContext *sl)
         ^
    276. {
    277.     const int mb_x    = sl->mb_x;

libavcodec/h264_mb_template.c:358:13: Call
    356.                                linesize, 0, 1, SIMPLE, PIXEL_SHIFT);
    357.         } else {
    358.             FUNC(hl_motion_444)(h, sl, dest[0], dest[1], dest[2],
                     ^
    359.                       h->qpel_put, h->h264chroma.put_h264_chroma_pixels_tab,
    360.                       h->qpel_avg, h->h264chroma.avg_h264_chroma_pixels_tab,

libavcodec/h264_mc_template.c:64:1: Parameter `sl->list_count`
      62. }
      63. 
      64. static void MCFUNC(hl_motion)(const H264Context *h, H264SliceContext *sl,
          ^
      65.                               uint8_t *dest_y,
      66.                               uint8_t *dest_cb, uint8_t *dest_cr,

libavcodec/h264_mc_template.c:80:9: Call
      78. 
      79.     if (HAVE_THREADS && (h->avctx->active_thread_type & FF_THREAD_FRAME))
      80.         await_references(h, sl);
                  ^
      81.     prefetch_motion(h, sl, 0, PIXEL_SHIFT, CHROMA_IDC);
      82. 

libavcodec/h264_mb.c:96:1: <LHS trace>
94.  * @param h the H264 context
95.  */
96. static void await_references(const H264Context *h, H264SliceContext *sl)
    ^
97. {
98.     const int mb_xy   = sl->mb_xy;

libavcodec/h264_mb.c:96:1: Parameter `sl->list_count`
        94.  * @param h the H264 context
        95.  */
        96. static void await_references(const H264Context *h, H264SliceContext *sl)
            ^
        97. {
        98.     const int mb_xy   = sl->mb_xy;

libavcodec/h264_mb.c:166:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ff_h264_hl_decode_mb` 
        164.     }
        165. 
        166.     for (list = sl->list_count - 1; list >= 0; list--)
                      ^
        167.         for (ref = 0; ref < 48 && nrefs[list]; ref++) {
        168.             int row = refs[list][ref];
