libavcodec/h264.c:938: error: Integer Overflow L2
  ([0, max(2, `h->slice_ctx->list_count`)] - 1):unsigned32 by call to `ff_h264_execute_decode_slices`.

libavcodec/h264.c:804:1: Parameter `h->slice_ctx->list_count`
802. }
803. 
804. static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size)
     ^
805. {
806.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264.c:938:19: Call
936. 
937.         if (context_count == h->nb_slice_ctx) {
938.             ret = ff_h264_execute_decode_slices(h, context_count);
                       ^
939.             if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE))
940.                 goto end;

libavcodec/h264_slice.c:2113:1: Parameter `h->slice_ctx->list_count`
  2111.  * @param context_count number of contexts to execute
  2112.  */
  2113. int ff_h264_execute_decode_slices(H264Context *h, unsigned context_count)
        ^
  2114. {
  2115.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264_slice.c:2127:15: Call
  2125.         h->postpone_filter = 0;
  2126. 
  2127.         ret = decode_slice(avctx, &h->slice_ctx[0]);
                      ^
  2128.         h->mb_y = h->slice_ctx[0].mb_y;
  2129.         return ret;

libavcodec/h264_slice.c:1917:1: Parameter `arg->list_count`
    1915. }
    1916. 
    1917. static int decode_slice(struct AVCodecContext *avctx, void *arg)
          ^
    1918. {
    1919.     H264SliceContext *sl = arg;

libavcodec/h264_slice.c:1962:19: Call
    1960.             }
    1961. 
    1962.             ret = ff_h264_decode_mb_cabac(h, sl);
                            ^
    1963.             // STOP_TIMER("decode_mb_cabac")
    1964. 

libavcodec/h264_cabac.c:1909:1: Parameter `sl->list_count`
      1907.  * @return 0 if OK, ER_AC_ERROR / ER_DC_ERROR / ER_MV_ERROR if an error is noticed
      1908.  */
      1909. int ff_h264_decode_mb_cabac(const H264Context *h, H264SliceContext *sl)
            ^
      1910. {
      1911.     const SPS *sps = h->ps.sps;

libavcodec/h264_slice.c:1966:17: Call
    1964. 
    1965.             if (ret >= 0)
    1966.                 ff_h264_hl_decode_mb(h, sl);
                          ^
    1967. 
    1968.             // FIXME optimal? or let mb_decode decode 16x32 ?

libavcodec/h264_mb.c:792:1: Parameter `sl->list_count`
      790. #include "h264_mb_template.c"
      791. 
      792. void ff_h264_hl_decode_mb(const H264Context *h, H264SliceContext *sl)
           ^
      793. {
      794.     const int mb_xy   = sl->mb_xy;

libavcodec/h264_mb.c:801:13: Call
      799.     if (CHROMA444(h)) {
      800.         if (is_complex || h->pixel_shift)
      801.             hl_decode_mb_444_complex(h, sl);
                       ^
      802.         else
      803.             hl_decode_mb_444_simple_8(h, sl);

libavcodec/h264_mb_template.c:259:1: Parameter `sl->list_count`
        257. #include "h264_mc_template.c"
        258. 
        259. static av_noinline void FUNC(hl_decode_mb_444)(const H264Context *h, H264SliceContext *sl)
             ^
        260. {
        261.     const int mb_x    = sl->mb_x;

libavcodec/h264_mb_template.c:342:13: Call
        340.                                linesize, 0, 1, SIMPLE, PIXEL_SHIFT);
        341.         } else {
        342.             FUNC(hl_motion_444)(h, sl, dest[0], dest[1], dest[2],
                         ^
        343.                       h->h264qpel.put_h264_qpel_pixels_tab,
        344.                       h->h264chroma.put_h264_chroma_pixels_tab,

libavcodec/h264_mc_template.c:64:1: Parameter `sl->list_count`
          62. }
          63. 
          64. static void MCFUNC(hl_motion)(const H264Context *h, H264SliceContext *sl,
              ^
          65.                               uint8_t *dest_y,
          66.                               uint8_t *dest_cb, uint8_t *dest_cr,

libavcodec/h264_mc_template.c:80:9: Call
          78. 
          79.     if (HAVE_THREADS && (h->avctx->active_thread_type & FF_THREAD_FRAME))
          80.         await_references(h, sl);
                      ^
          81.     prefetch_motion(h, sl, 0, PIXEL_SHIFT, CHROMA_IDC);
          82. 

libavcodec/h264_mb.c:95:1: <LHS trace>
93.  * @param h the H264 context
94.  */
95. static void await_references(const H264Context *h, H264SliceContext *sl)
    ^
96. {
97.     const int mb_xy   = sl->mb_xy;

libavcodec/h264_mb.c:95:1: Parameter `sl->list_count`
            93.  * @param h the H264 context
            94.  */
            95. static void await_references(const H264Context *h, H264SliceContext *sl)
                ^
            96. {
            97.     const int mb_xy   = sl->mb_xy;

libavcodec/h264_mb.c:165:10: Binary operation: ([0, max(2, h->slice_ctx->list_count)] - 1):unsigned32 by call to `ff_h264_execute_decode_slices` 
            163.     }
            164. 
            165.     for (list = sl->list_count - 1; list >= 0; list--)
                          ^
            166.         for (ref = 0; ref < 48 && nrefs[list]; ref++) {
            167.             int row = refs[list][ref];
