libavcodec/h264.c:3789: error: Buffer Overrun L3
  Offset added: [-81408, +oo] Size: 40704 by call to `ff_h264_fill_default_ref_list`.

libavcodec/h264.c:3359:1: Parameter `h->ref_count[*]`
3357.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
3358.  */
3359. static int decode_slice_header(H264Context *h, H264Context *h0)
      ^
3360. {
3361.     unsigned int first_mb_in_slice;

libavcodec/h264.c:3789:9: Call
3787. 
3788.     if (!default_ref_list_done)
3789.         ff_h264_fill_default_ref_list(h);
              ^
3790. 
3791.     if (h->slice_type_nos != AV_PICTURE_TYPE_I) {

libavcodec/h264_refs.c:116:1: <Offset trace>
114. }
115. 
116. int ff_h264_fill_default_ref_list(H264Context *h)
     ^
117. {
118.     int i, len;

libavcodec/h264_refs.c:116:1: Parameter `h->ref_count[*]`
  114. }
  115. 
  116. int ff_h264_fill_default_ref_list(H264Context *h)
       ^
  117. {
  118.     int i, len;

libavcodec/h264_refs.c:116:1: <Length trace>
114. }
115. 
116. int ff_h264_fill_default_ref_list(H264Context *h)
     ^
117. {
118.     int i, len;

libavcodec/h264_refs.c:116:1: Parameter `h->default_ref_list[*][*]`
  114. }
  115. 
  116. int ff_h264_fill_default_ref_list(H264Context *h)
       ^
  117. {
  118.     int i, len;

libavcodec/h264_refs.c:142:17: Array access: Offset added: [-81408, +oo] Size: 40704 by call to `ff_h264_fill_default_ref_list` 
  140. 
  141.             if (len < h->ref_count[list])
  142.                 memset(&h->default_ref_list[list][len], 0, sizeof(H264Picture) * (h->ref_count[list] - len));
                       ^
  143.             lens[list] = len;
  144.         }
