libavcodec/h264_slice.c:1668: error: Buffer Overrun L1
  Offset: [20, 51] Size: 2.

libavcodec/h264_slice.c:1667:14: <Offset trace>
1665.         ref2frm[18 + 0] =
1666.         ref2frm[18 + 1] = -1;
1667.         for (i = 16; i < 48; i++)
                   ^
1668.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
1669.                              (sl->ref_list[j][i].reference & 3);

libavcodec/h264_slice.c:1667:14: Assignment
1665.         ref2frm[18 + 0] =
1666.         ref2frm[18 + 1] = -1;
1667.         for (i = 16; i < 48; i++)
                   ^
1668.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
1669.                              (sl->ref_list[j][i].reference & 3);

libavcodec/h264_slice.c:1067:1: <Length trace>
1065.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
1066.  */
1067. int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl)
      ^
1068. {
1069.     unsigned int first_mb_in_slice;

libavcodec/h264_slice.c:1067:1: Parameter `sl->ref2frm[*][*]`
1065.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
1066.  */
1067. int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl)
      ^
1068. {
1069.     unsigned int first_mb_in_slice;

libavcodec/h264_slice.c:1641:9: Assignment
1639.     for (j = 0; j < 2; j++) {
1640.         int id_list[16];
1641.         int *ref2frm = sl->ref2frm[sl->slice_num & (MAX_SLICES - 1)][j];
              ^
1642.         for (i = 0; i < 16; i++) {
1643.             id_list[i] = 60;

libavcodec/h264_slice.c:1668:13: Array access: Offset: [20, 51] Size: 2
1666.         ref2frm[18 + 1] = -1;
1667.         for (i = 16; i < 48; i++)
1668.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
                  ^
1669.                              (sl->ref_list[j][i].reference & 3);
1670.     }
