libavcodec/h264.c:3461: error: Buffer Overrun L1
  Offset: [20, 51] Size: 2.

libavcodec/h264.c:3460:14: <Offset trace>
3458.         ref2frm[18 + 0]     =
3459.             ref2frm[18 + 1] = -1;
3460.         for (i = 16; i < 48; i++)
                   ^
3461.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
3462.                              (h->ref_list[j][i].f.reference & 3);

libavcodec/h264.c:3460:14: Assignment
3458.         ref2frm[18 + 0]     =
3459.             ref2frm[18 + 1] = -1;
3460.         for (i = 16; i < 48; i++)
                   ^
3461.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
3462.                              (h->ref_list[j][i].f.reference & 3);

libavcodec/h264.c:2865:1: <Length trace>
2863.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
2864.  */
2865. static int decode_slice_header(H264Context *h, H264Context *h0)
      ^
2866. {
2867.     MpegEncContext *const s  = &h->s;

libavcodec/h264.c:2865:1: Parameter `h->ref2frm[*][*]`
2863.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
2864.  */
2865. static int decode_slice_header(H264Context *h, H264Context *h0)
      ^
2866. {
2867.     MpegEncContext *const s  = &h->s;

libavcodec/h264.c:3434:9: Assignment
3432.     for (j = 0; j < 2; j++) {
3433.         int id_list[16];
3434.         int *ref2frm = h->ref2frm[h->slice_num & (MAX_SLICES - 1)][j];
              ^
3435.         for (i = 0; i < 16; i++) {
3436.             id_list[i] = 60;

libavcodec/h264.c:3461:13: Array access: Offset: [20, 51] Size: 2
3459.             ref2frm[18 + 1] = -1;
3460.         for (i = 16; i < 48; i++)
3461.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
                  ^
3462.                              (h->ref_list[j][i].f.reference & 3);
3463.     }
