libavcodec/mss2.c:422: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `ff_er_frame_end`.

libavcodec/mss2.c:422:5: Call
420.     ff_vc1_decode_blocks(v);
421. 
422.     ff_er_frame_end(s);
         ^
423. 
424.     ff_MPV_frame_end(s);

libavcodec/error_resilience.c:878:1: Parameter `s->list_count`
  876. }
  877. 
  878. void ff_er_frame_end(MpegEncContext *s)
       ^
  879. {
  880.     int i, mb_x, mb_y, error, error_type, dc_error, mv_error, ac_error;

libavcodec/error_resilience.c:1056:23: Call
  1054.            dc_error, ac_error, mv_error);
  1055. 
  1056.     is_intra_likely = is_intra_more_likely(s);
                              ^
  1057. 
  1058.     /* set unknown mb-type to most likely */

libavcodec/error_resilience.c:715:1: Parameter `s->list_count`
    713. }
    714. 
    715. static int is_intra_more_likely(MpegEncContext *s)
         ^
    716. {
    717.     int is_intra_likely, i, j, undamaged_count, skip_amount, mb_x, mb_y;

libavcodec/error_resilience.c:1121:13: Call
  1119.             s->mb_x = mb_x;
  1120.             s->mb_y = mb_y;
  1121.             decode_mb(s, 0 /* FIXME h264 partitioned slices need this set */);
                    ^
  1122.         }
  1123.     }

libavcodec/error_resilience.c:43:1: Parameter `s->list_count`
    41. #undef mb_intra
    42. 
    43. static void decode_mb(MpegEncContext *s, int ref)
        ^
    44. {
    45.     s->dest[0] = s->current_picture.f.data[0] + (s->mb_y *  16                       * s->linesize)   + s->mb_x *  16;

libavcodec/error_resilience.c:66:9: Call
    64.                        pack16to32(s->mv[0][0][0], s->mv[0][0][1]), 4);
    65.         assert(!FRAME_MBAFF);
    66.         ff_h264_hl_decode_mb(h);
                ^
    67.     } else {
    68.         assert(ref == 0);

libavcodec/h264.c:1983:1: Parameter `h->list_count`
      1981. #include "h264_mb_template.c"
      1982. 
      1983. void ff_h264_hl_decode_mb(H264Context *h)
            ^
      1984. {
      1985.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:1992:13: Call
      1990.     if (CHROMA444) {
      1991.         if (is_complex || h->pixel_shift)
      1992.             hl_decode_mb_444_complex(h);
                        ^
      1993.         else
      1994.             hl_decode_mb_444_simple_8(h);

libavcodec/h264_mb_template.c:278:1: Parameter `h->list_count`
        276. #include "h264_mc_template.c"
        277. 
        278. static av_noinline void FUNC(hl_decode_mb_444)(H264Context *h)
             ^
        279. {
        280.     MpegEncContext *const s = &h->s;

libavcodec/h264_mb_template.c:362:13: Call
        360.                                linesize, 0, 1, SIMPLE, PIXEL_SHIFT);
        361.         } else {
        362.             FUNC(hl_motion_444)(h, dest[0], dest[1], dest[2],
                         ^
        363.                       s->me.qpel_put, h->h264chroma.put_h264_chroma_pixels_tab,
        364.                       s->me.qpel_avg, h->h264chroma.avg_h264_chroma_pixels_tab,

libavcodec/h264_mc_template.c:61:1: Parameter `h->list_count`
          59. }
          60. 
          61. static void MCFUNC(hl_motion)(H264Context *h, uint8_t *dest_y,
              ^
          62.                               uint8_t *dest_cb, uint8_t *dest_cr,
          63.                               qpel_mc_func(*qpix_put)[16],

libavcodec/h264_mc_template.c:77:9: Call
          75. 
          76.     if (HAVE_THREADS && (s->avctx->active_thread_type & FF_THREAD_FRAME))
          77.         await_references(h);
                      ^
          78.     prefetch_motion(h, 0, PIXEL_SHIFT, CHROMA_IDC);
          79. 

libavcodec/h264.c:356:1: <LHS trace>
354.  * @param h the H264 context
355.  */
356. static void await_references(H264Context *h)
     ^
357. {
358.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:356:1: Parameter `h->list_count`
            354.  * @param h the H264 context
            355.  */
            356. static void await_references(H264Context *h)
                 ^
            357. {
            358.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:427:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ff_er_frame_end` 
            425.     }
            426. 
            427.     for (list = h->list_count - 1; list >= 0; list--)
                          ^
            428.         for (ref = 0; ref < 48 && nrefs[list]; ref++) {
            429.             int row = refs[list][ref];
