libavcodec/h264.c:3359: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `ff_h264_hl_decode_mb`.

libavcodec/h264.c:3355:23: Call
3353.         for(;;){
3354. //START_TIMER
3355.             int ret = ff_h264_decode_mb_cabac(h);
                            ^
3356.             int eos;
3357. //STOP_TIMER("decode_mb_cabac")

libavcodec/h264_cabac.c:2028:17: Call
  2026.             if( IS_DIRECT(h->sub_mb_type[0] | h->sub_mb_type[1] |
  2027.                           h->sub_mb_type[2] | h->sub_mb_type[3]) ) {
  2028.                 ff_h264_pred_direct_motion(h, &mb_type);
                        ^
  2029.                 h->ref_cache[0][scan8[4]] =
  2030.                 h->ref_cache[1][scan8[4]] =

libavcodec/h264_direct.c:617:9: Call
    615. void ff_h264_pred_direct_motion(H264Context * const h, int *mb_type){
    616.     if(h->direct_spatial_mv_pred){
    617.         pred_spatial_direct_motion(h, mb_type);
                 ^
    618.     }else{
    619.         pred_temp_direct_motion(h, mb_type);

libavcodec/h264.c:3359:24: Call
3357. //STOP_TIMER("decode_mb_cabac")
3358. 
3359.             if(ret>=0) ff_h264_hl_decode_mb(h);
                             ^
3360. 
3361.             if( ret >= 0 && FRAME_MBAFF ) { //FIXME optimal? or let mb_decode decode 16x32 ?

libavcodec/h264.c:2037:1: Parameter `h->list_count`
  2035. }
  2036. 
  2037. void ff_h264_hl_decode_mb(H264Context *h){
        ^
  2038.     MpegEncContext * const s = &h->s;
  2039.     const int mb_xy= h->mb_xy;

libavcodec/h264.c:2045:13: Call
  2043.     if (CHROMA444) {
  2044.         if(is_complex || h->pixel_shift)
  2045.             hl_decode_mb_444_complex(h);
                    ^
  2046.         else
  2047.             hl_decode_mb_444_simple(h);

libavcodec/h264.c:2029:1: Parameter `h->list_count`
    2027. }
    2028. 
    2029. static void av_noinline hl_decode_mb_444_complex(H264Context *h){
          ^
    2030.     hl_decode_mb_444_internal(h, 0, h->pixel_shift);
    2031. }

libavcodec/h264.c:2030:5: Call
    2028. 
    2029. static void av_noinline hl_decode_mb_444_complex(H264Context *h){
    2030.     hl_decode_mb_444_internal(h, 0, h->pixel_shift);
              ^
    2031. }
    2032. 

libavcodec/h264.c:1916:1: Parameter `h->list_count`
      1914. }
      1915. 
      1916. static av_always_inline void hl_decode_mb_444_internal(H264Context *h, int simple, int pixel_shift){
            ^
      1917.     MpegEncContext * const s = &h->s;
      1918.     const int mb_x= s->mb_x;

libavcodec/h264.c:1995:13: Call
      1993.                 xchg_mb_border(h, dest[0], dest[1], dest[2], linesize, linesize, 0, 1, simple, pixel_shift);
      1994.         }else{
      1995.             hl_motion(h, dest[0], dest[1], dest[2],
                        ^
      1996.                       s->me.qpel_put, s->dsp.put_h264_chroma_pixels_tab,
      1997.                       s->me.qpel_avg, s->dsp.avg_h264_chroma_pixels_tab,

libavcodec/h264.c:680:1: Parameter `h->list_count`
        678. }
        679. 
        680. static av_always_inline void hl_motion(H264Context *h, uint8_t *dest_y, uint8_t *dest_cb, uint8_t *dest_cr,
             ^
        681.                       qpel_mc_func (*qpix_put)[16], h264_chroma_mc_func (*chroma_put),
        682.                       qpel_mc_func (*qpix_avg)[16], h264_chroma_mc_func (*chroma_avg),

libavcodec/h264.c:692:9: Call
        690. 
        691.     if(HAVE_PTHREADS && (s->avctx->active_thread_type & FF_THREAD_FRAME))
        692.         await_references(h);
                     ^
        693.     prefetch_motion(h, 0, pixel_shift, chroma444);
        694. 

libavcodec/h264.c:290:1: <LHS trace>
288.  * @param h the H264 context
289.  */
290. static void await_references(H264Context *h){
     ^
291.     MpegEncContext * const s = &h->s;
292.     const int mb_xy= h->mb_xy;

libavcodec/h264.c:290:1: Parameter `h->list_count`
          288.  * @param h the H264 context
          289.  */
          290. static void await_references(H264Context *h){
               ^
          291.     MpegEncContext * const s = &h->s;
          292.     const int mb_xy= h->mb_xy;

libavcodec/h264.c:348:9: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ff_h264_hl_decode_mb` 
          346.     }
          347. 
          348.     for(list=h->list_count-1; list>=0; list--){
                       ^
          349.         for(ref=0; ref<48 && nrefs[list]; ref++){
          350.             int row = refs[list][ref];
