libavcodec/h264.c:81: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `ff_h264_hl_decode_mb`.

libavcodec/h264.c:68:5: Unknown value from: __infer_skip
66.     sl->mb_xy = mb_x + mb_y * h->mb_stride;
67.     memset(sl->non_zero_count_cache, 0, sizeof(sl->non_zero_count_cache));
68.     assert(ref >= 0);
        ^
69.     /* FIXME: It is possible albeit uncommon that slice references
70.      * differ between slices. We take the easy approach and ignore

libavcodec/h264.c:81:5: Call
79.                    pack16to32((*mv)[0][0][0], (*mv)[0][0][1]), 4);
80.     assert(!FRAME_MBAFF(h));
81.     ff_h264_hl_decode_mb(h, &h->slice_ctx[0]);
        ^
82. }
83. 

libavcodec/h264_mb.c:792:1: Parameter `sl->list_count`
  790. #include "h264_mb_template.c"
  791. 
  792. void ff_h264_hl_decode_mb(const H264Context *h, H264SliceContext *sl)
       ^
  793. {
  794.     const int mb_xy   = sl->mb_xy;

libavcodec/h264_mb.c:803:13: Call
  801.             hl_decode_mb_444_complex(h, sl);
  802.         else
  803.             hl_decode_mb_444_simple_8(h, sl);
                   ^
  804.     } else if (is_complex) {
  805.         hl_decode_mb_complex(h, sl);

libavcodec/h264_mb_template.c:259:1: Parameter `sl->list_count`
    257. #include "h264_mc_template.c"
    258. 
    259. static av_noinline void FUNC(hl_decode_mb_444)(const H264Context *h, H264SliceContext *sl)
         ^
    260. {
    261.     const int mb_x    = sl->mb_x;

libavcodec/h264_mb_template.c:342:13: Call
    340.                                linesize, 0, 1, SIMPLE, PIXEL_SHIFT);
    341.         } else {
    342.             FUNC(hl_motion_444)(h, sl, dest[0], dest[1], dest[2],
                     ^
    343.                       h->h264qpel.put_h264_qpel_pixels_tab,
    344.                       h->h264chroma.put_h264_chroma_pixels_tab,

libavcodec/h264_mc_template.c:64:1: Parameter `sl->list_count`
      62. }
      63. 
      64. static void MCFUNC(hl_motion)(const H264Context *h, H264SliceContext *sl,
          ^
      65.                               uint8_t *dest_y,
      66.                               uint8_t *dest_cb, uint8_t *dest_cr,

libavcodec/h264_mc_template.c:80:9: Call
      78. 
      79.     if (HAVE_THREADS && (h->avctx->active_thread_type & FF_THREAD_FRAME))
      80.         await_references(h, sl);
                  ^
      81.     prefetch_motion(h, sl, 0, PIXEL_SHIFT, CHROMA_IDC);
      82. 

libavcodec/h264_mb.c:95:1: <LHS trace>
93.  * @param h the H264 context
94.  */
95. static void await_references(const H264Context *h, H264SliceContext *sl)
    ^
96. {
97.     const int mb_xy   = sl->mb_xy;

libavcodec/h264_mb.c:95:1: Parameter `sl->list_count`
        93.  * @param h the H264 context
        94.  */
        95. static void await_references(const H264Context *h, H264SliceContext *sl)
            ^
        96. {
        97.     const int mb_xy   = sl->mb_xy;

libavcodec/h264_mb.c:165:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ff_h264_hl_decode_mb` 
        163.     }
        164. 
        165.     for (list = sl->list_count - 1; list >= 0; list--)
                      ^
        166.         for (ref = 0; ref < 48 && nrefs[list]; ref++) {
        167.             int row = refs[list][ref];
