libavcodec/h264dec.c:883: error: Integer Overflow L2
  ([0, 4294967311] + 1):signed32 by call to `decode_nal_units`.

libavcodec/h264dec.c:883:17: Call
881.     }
882. 
883.     buf_index = decode_nal_units(h, buf, buf_size);
                     ^
884.     if (buf_index < 0)
885.         return AVERROR_INVALIDDATA;

libavcodec/h264dec.c:670:11: Call
  668.     }
  669. 
  670.     ret = ff_h2645_packet_split(&h->pkt, buf, buf_size, avctx, h->is_avc,
                 ^
  671.                                 h->nal_length_size, avctx->codec_id);
  672.     if (ret < 0) {

libavcodec/h2645_parse.c:260:15: Call
    258.         nal->size_bits = get_bit_length(nal, skip_trailing_zeros);
    259. 
    260.         ret = init_get_bits(&nal->gb, nal->data, nal->size_bits);
                       ^
    261.         if (ret < 0)
    262.             return ret;

libavcodec/get_bits.h:362:1: Parameter `bit_size`
      360.  * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
      361.  */
      362. static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
           ^
      363.                                 int bit_size)
      364. {

libavcodec/get_bits.h:379:5: Assignment
      377.     s->size_in_bits       = bit_size;
      378. #if !UNCHECKED_BITSTREAM_READER
      379.     s->size_in_bits_plus8 = bit_size + 8;
               ^
      380. #endif
      381.     s->buffer_end         = buffer + buffer_size;

libavcodec/h264dec.c:883:17: Call
881.     }
882. 
883.     buf_index = decode_nal_units(h, buf, buf_size);
                     ^
884.     if (buf_index < 0)
885.         return AVERROR_INVALIDDATA;

libavcodec/h264dec.c:656:1: Parameter `h->slice_ctx->ref_count[*]`
  654. }
  655. 
  656. static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size)
       ^
  657. {
  658.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264dec.c:701:24: Call
  699.             sl->gb = nal->gb;
  700. 
  701.             if ((err = ff_h264_decode_slice_header(h, sl, nal)))
                              ^
  702.                 break;
  703. 

libavcodec/h264_slice.c:1577:1: Parameter `sl->ref_count[*]`
    1575.  * @return 0 if okay, <0 if an error occurred
    1576.  */
    1577. int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl,
          ^
    1578.                                 const H2645NAL *nal)
    1579. {

libavcodec/h264_slice.c:1659:13: Call
    1657.         implicit_weight_table(h, sl, -1);
    1658.         if (FRAME_MBAFF(h)) {
    1659.             implicit_weight_table(h, sl, 0);
                      ^
    1660.             implicit_weight_table(h, sl, 1);
    1661.         }

libavcodec/h264_slice.c:615:1: <LHS trace>
613.  *                -1 initializes the rest
614.  */
615. static void implicit_weight_table(const H264Context *h, H264SliceContext *sl, int field)
     ^
616. {
617.     int ref0, ref1, i, cur_poc, ref_start, ref_count0, ref_count1;

libavcodec/h264_slice.c:615:1: Parameter `sl->ref_count[*]`
      613.  *                -1 initializes the rest
      614.  */
      615. static void implicit_weight_table(const H264Context *h, H264SliceContext *sl, int field)
           ^
      616. {
      617.     int ref0, ref1, i, cur_poc, ref_start, ref_count0, ref_count1;

libavcodec/h264_slice.c:638:9: Assignment
      636.         ref_start  = 0;
      637.         ref_count0 = sl->ref_count[0];
      638.         ref_count1 = sl->ref_count[1];
                   ^
      639.     } else {
      640.         cur_poc    = h->cur_pic_ptr->field_poc[field];

libavcodec/h264_slice.c:653:51: Binary operation: ([0, 4294967311] + 1):signed32 by call to `decode_nal_units` 
      651.     for (ref0 = ref_start; ref0 < ref_count0; ref0++) {
      652.         int poc0 = sl->ref_list[0][ref0].poc;
      653.         for (ref1 = ref_start; ref1 < ref_count1; ref1++) {
                                                             ^
      654.             int w = 32;
      655.             if (!sl->ref_list[0][ref0].parent->long_ref && !sl->ref_list[1][ref1].parent->long_ref) {
