libavcodec/h264_slice.c:1484: error: Integer Overflow L2
  ([0, +oo] - [0, 96]):unsigned32 by call to `ff_h264_decode_ref_pic_list_reordering`.

libavcodec/h264_slice.c:1025:1: Parameter `sl->ref_count[*]`
1023.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
1024.  */
1025. int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl)
      ^
1026. {
1027.     unsigned int first_mb_in_slice;

libavcodec/h264_slice.c:1484:14: Call
1482. 
1483.     if (sl->slice_type_nos != AV_PICTURE_TYPE_I) {
1484.        ret = ff_h264_decode_ref_pic_list_reordering(h, sl);
                   ^
1485.        if (ret < 0) {
1486.            sl->ref_count[1] = sl->ref_count[0] = 0;

libavcodec/h264_refs.c:214:1: Parameter `sl->ref_count[*]`
  212. }
  213. 
  214. int ff_h264_decode_ref_pic_list_reordering(H264Context *h, H264SliceContext *sl)
       ^
  215. {
  216.     int list, index, pic_structure;

libavcodec/h264_refs.c:221:5: Call
  219.     print_long_term(h);
  220. 
  221.     h264_initialise_ref_list(h, sl);
           ^
  222. 
  223.     for (list = 0; list < sl->list_count; list++) {

libavcodec/h264_refs.c:122:1: <LHS trace>
120. }
121. 
122. static void h264_initialise_ref_list(H264Context *h, H264SliceContext *sl)
     ^
123. {
124.     int i, len;

libavcodec/h264_refs.c:122:1: Parameter `sl->ref_count[*]`
    120. }
    121. 
    122. static void h264_initialise_ref_list(H264Context *h, H264SliceContext *sl)
         ^
    123. {
    124.     int i, len;

libavcodec/h264_refs.c:122:1: <RHS trace>
120. }
121. 
122. static void h264_initialise_ref_list(H264Context *h, H264SliceContext *sl)
     ^
123. {
124.     int i, len;

libavcodec/h264_refs.c:122:1: Parameter `sl->ref_count[*]`
    120. }
    121. 
    122. static void h264_initialise_ref_list(H264Context *h, H264SliceContext *sl)
         ^
    123. {
    124.     int i, len;

libavcodec/h264_refs.c:148:17: Binary operation: ([0, +oo] - [0, 96]):unsigned32 by call to `ff_h264_decode_ref_pic_list_reordering` 
    146. 
    147.             if (len < sl->ref_count[list])
    148.                 memset(&sl->ref_list[list][len], 0, sizeof(H264Ref) * (sl->ref_count[list] - len));
                         ^
    149.             lens[list] = len;
    150.         }
