libavcodec/h264dec.c:725: error: Integer Overflow L2
  (2 × [8, 2147483648]):unsigned32 by call to `decode_nal_units`.

libavcodec/h264dec.c:725:17: Call
723.     }
724. 
725.     buf_index = decode_nal_units(h, buf, buf_size);
                     ^
726.     if (buf_index < 0)
727.         return AVERROR_INVALIDDATA;

libavcodec/h264dec.c:528:11: Call
  526.     }
  527. 
  528.     ret = ff_h2645_packet_split(&h->pkt, buf, buf_size, avctx, h->is_avc,
                 ^
  529.                                 h->nal_length_size, avctx->codec_id);
  530.     if (ret < 0) {

libavcodec/h2645_parse.c:301:15: Call
    299.         nal->size_bits = get_bit_length(nal, skip_trailing_zeros);
    300. 
    301.         ret = init_get_bits(&nal->gb, nal->data, nal->size_bits);
                       ^
    302.         if (ret < 0)
    303.             return ret;

libavcodec/get_bits.h:362:1: Parameter `bit_size`
      360.  * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
      361.  */
      362. static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
           ^
      363.                                 int bit_size)
      364. {

libavcodec/get_bits.h:379:5: Assignment
      377.     s->size_in_bits       = bit_size;
      378. #if !UNCHECKED_BITSTREAM_READER
      379.     s->size_in_bits_plus8 = bit_size + 8;
               ^
      380. #endif
      381.     s->buffer_end         = buffer + buffer_size;

libavcodec/h264dec.c:725:17: Call
723.     }
724. 
725.     buf_index = decode_nal_units(h, buf, buf_size);
                     ^
726.     if (buf_index < 0)
727.         return AVERROR_INVALIDDATA;

libavcodec/h264dec.c:515:1: Parameter `h->slice_ctx->ref_count[*]`
  513. }
  514. 
  515. static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size)
       ^
  516. {
  517.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264dec.c:556:24: Call
  554.             idr(h); // FIXME ensure we don't lose some frames if there is reordering
  555.         case H264_NAL_SLICE:
  556.             if ((err = ff_h264_queue_decode_slice(h, nal)))
                              ^
  557.                 break;
  558. 

libavcodec/h264_slice.c:1852:1: Parameter `h->slice_ctx->ref_count[*]`
    1850. }
    1851. 
    1852. int ff_h264_queue_decode_slice(H264Context *h, const H2645NAL *nal)
          ^
    1853. {
    1854.     H264SliceContext *sl = h->slice_ctx + h->nb_slice_ctx_queued;

libavcodec/h264_slice.c:1905:11: Call
    1903.     }
    1904. 
    1905.     ret = h264_slice_init(h, sl, nal);
                    ^
    1906.     if (ret < 0)
    1907.         return ret;

libavcodec/h264_slice.c:1704:1: Parameter `sl->ref_count[*]`
      1702. /* do all the per-slice initialization needed before we can start decoding the
      1703.  * actual MBs */
      1704. static int h264_slice_init(H264Context *h, H264SliceContext *sl,
            ^
      1705.                            const H2645NAL *nal)
      1706. {

libavcodec/h264_slice.c:1747:11: Call
      1745.     assert(sl->mb_y < h->mb_height);
      1746. 
      1747.     ret = ff_h264_build_ref_list(h, sl);
                      ^
      1748.     if (ret < 0)
      1749.         return ret;

libavcodec/h264_refs.c:353:14: Assignment
        351.     }
        352.     for (list = 0; list < sl->list_count; list++) {
        353.         for (index = 0; index < sl->ref_count[list]; index++) {
                          ^
        354.             if (!sl->ref_list[list][index].parent) {
        355.                 av_log(h->avctx, AV_LOG_ERROR, "Missing reference picture\n");

libavcodec/h264_slice.c:1755:13: Call
      1753.         implicit_weight_table(h, sl, -1);
      1754.         if (FRAME_MBAFF(h)) {
      1755.             implicit_weight_table(h, sl, 0);
                        ^
      1756.             implicit_weight_table(h, sl, 1);
      1757.         }

libavcodec/h264_slice.c:612:1: <RHS trace>
610.  *                -1 initializes the rest
611.  */
612. static void implicit_weight_table(const H264Context *h, H264SliceContext *sl, int field)
     ^
613. {
614.     int ref0, ref1, i, cur_poc, ref_start, ref_count0, ref_count1;

libavcodec/h264_slice.c:612:1: Parameter `sl->ref_count[*]`
        610.  *                -1 initializes the rest
        611.  */
        612. static void implicit_weight_table(const H264Context *h, H264SliceContext *sl, int field)
             ^
        613. {
        614.     int ref0, ref1, i, cur_poc, ref_start, ref_count0, ref_count1;

libavcodec/h264_slice.c:639:9: Binary operation: (2 × [8, 2147483648]):unsigned32 by call to `decode_nal_units` 
        637.         cur_poc    = h->cur_pic_ptr->field_poc[field];
        638.         ref_start  = 16;
        639.         ref_count0 = 16 + 2 * sl->ref_count[0];
                     ^
        640.         ref_count1 = 16 + 2 * sl->ref_count[1];
        641.     }
