libavcodec/h264_direct.c:157: error: Buffer Overrun L2
  Offset: [0, 2] (⇐ [0, 1] + [0, 1]) Size: 2 by call to `fill_colmap`.

libavcodec/h264_direct.c:110:1: Parameter `sl->map_col_to_list0_field[*]`
108. }
109. 
110. void ff_h264_direct_ref_list_init(const H264Context *const h, H264SliceContext *sl)
     ^
111. {
112.     H264Ref *const ref1 = &sl->ref_list[1][0];

libavcodec/h264_direct.c:157:17: Call
155.         if (FRAME_MBAFF(h))
156.             for (field = 0; field < 2; field++)
157.                 fill_colmap(h, sl, sl->map_col_to_list0_field[field], list, field,
                     ^
158.                             field, 1);
159.     }

libavcodec/h264_direct.c:72:1: <Offset trace>
70. }
71. 
72. static void fill_colmap(const H264Context *h, H264SliceContext *sl,
    ^
73.                         int map[2][16 + 32], int list,
74.                         int field, int colfield, int mbafi)

libavcodec/h264_direct.c:72:1: Parameter `list`
  70. }
  71. 
  72. static void fill_colmap(const H264Context *h, H264SliceContext *sl,
      ^
  73.                         int map[2][16 + 32], int list,
  74.                         int field, int colfield, int mbafi)

libavcodec/h264_direct.c:72:1: <Length trace>
70. }
71. 
72. static void fill_colmap(const H264Context *h, H264SliceContext *sl,
    ^
73.                         int map[2][16 + 32], int list,
74.                         int field, int colfield, int mbafi)

libavcodec/h264_direct.c:72:1: Parameter `*map`
  70. }
  71. 
  72. static void fill_colmap(const H264Context *h, H264SliceContext *sl,
      ^
  73.                         int map[2][16 + 32], int list,
  74.                         int field, int colfield, int mbafi)

libavcodec/h264_direct.c:100:25: Array access: Offset: [0, 2] (⇐ [0, 1] + [0, 1]) Size: 2 by call to `fill_colmap` 
   98.                     int cur_ref = mbafi ? (j - 16) ^ field : j;
   99.                     if (ref1->mbaff)
  100.                         map[list][2 * old_ref + (rfield ^ field) + 16] = cur_ref;
                               ^
  101.                     if (rfield == field || !interl)
  102.                         map[list][old_ref] = cur_ref;
