libavcodec/h264_slice.c:1516: error: Buffer Overrun L1
  Offset: [20, 51] Size: 2.

libavcodec/h264_slice.c:1515:14: <Offset trace>
1513.         ref2frm[18 + 0] =
1514.         ref2frm[18 + 1] = -1;
1515.         for (i = 16; i < 48; i++)
                   ^
1516.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
1517.                              (sl->ref_list[j][i].reference & 3);

libavcodec/h264_slice.c:1515:14: Assignment
1513.         ref2frm[18 + 0] =
1514.         ref2frm[18 + 1] = -1;
1515.         for (i = 16; i < 48; i++)
                   ^
1516.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
1517.                              (sl->ref_list[j][i].reference & 3);

libavcodec/h264_slice.c:912:1: <Length trace>
910.  * @return 0 if okay, <0 if an error occurred
911.  */
912. int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl)
     ^
913. {
914.     const SPS *sps;

libavcodec/h264_slice.c:912:1: Parameter `h->ref2frm[*][*]`
910.  * @return 0 if okay, <0 if an error occurred
911.  */
912. int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl)
     ^
913. {
914.     const SPS *sps;

libavcodec/h264_slice.c:1489:9: Assignment
1487.     for (j = 0; j < 2; j++) {
1488.         int id_list[16];
1489.         int *ref2frm = h->ref2frm[sl->slice_num & (MAX_SLICES - 1)][j];
              ^
1490.         for (i = 0; i < 16; i++) {
1491.             id_list[i] = 60;

libavcodec/h264_slice.c:1516:13: Array access: Offset: [20, 51] Size: 2
1514.         ref2frm[18 + 1] = -1;
1515.         for (i = 16; i < 48; i++)
1516.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
                  ^
1517.                              (sl->ref_list[j][i].reference & 3);
1518.     }
