libavcodec/h264.c:3857: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `decode_slice_header`.

libavcodec/h264.c:3733:1: Parameter `h->s.list_count`
3731. 
3732. 
3733. static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
      ^
3734.     MpegEncContext * const s = &h->s;
3735.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:3857:23: Call
3855.             hx->s.data_partitioning = 0;
3856. 
3857.             if((err = decode_slice_header(hx, h)))
                            ^
3858.                break;
3859. 

libavcodec/h264.c:2635:1: Parameter `h->s.list_count`
  2633.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
  2634.  */
  2635. static int decode_slice_header(H264Context *h, H264Context *h0){
        ^
  2636.     MpegEncContext * const s = &h->s;
  2637.     MpegEncContext * const s0 = &h0->s;

libavcodec/h264.c:2660:13: Call
  2658.     if(first_mb_in_slice == 0){ //FIXME better field boundary detection
  2659.         if(h0->current_slice && FIELD_PICTURE){
  2660.             field_end(h, 1);
                    ^
  2661.         }
  2662. 

libavcodec/h264.c:2518:1: Parameter `h->s.list_count`
    2516. }
    2517. 
    2518. static int field_end(H264Context *h, int in_setup){
          ^
    2519.     MpegEncContext * const s = &h->s;
    2520.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:2563:9: Call
    2561.      */
    2562.     if (!FIELD_PICTURE)
    2563.         ff_er_frame_end(s);
                  ^
    2564. 
    2565.     MPV_frame_end(s);

libavcodec/error_resilience.c:872:1: Parameter `s->list_count`
      870. }
      871. 
      872. void ff_er_frame_end(MpegEncContext *s)
           ^
      873. {
      874.     int i, mb_x, mb_y, error, error_type, dc_error, mv_error, ac_error;

libavcodec/error_resilience.c:1050:23: Call
      1048.            dc_error, ac_error, mv_error);
      1049. 
      1050.     is_intra_likely = is_intra_more_likely(s);
                                  ^
      1051. 
      1052.     /* set unknown mb-type to most likely */

libavcodec/error_resilience.c:708:1: Parameter `s->list_count`
        706. }
        707. 
        708. static int is_intra_more_likely(MpegEncContext *s)
             ^
        709. {
        710.     int is_intra_likely, i, j, undamaged_count, skip_amount, mb_x, mb_y;

libavcodec/error_resilience.c:1110:13: Call
      1108.             s->mb_x = mb_x;
      1109.             s->mb_y = mb_y;
      1110.             decode_mb(s, 0 /* FIXME h264 partitioned slices need this set */);
                        ^
      1111.         }
      1112.     }

libavcodec/error_resilience.c:43:1: Parameter `s->list_count`
        41. #undef mb_intra
        42. 
        43. static void decode_mb(MpegEncContext *s, int ref)
            ^
        44. {
        45.     s->dest[0] = s->current_picture.f.data[0] + (s->mb_y *  16                       * s->linesize)   + s->mb_x *  16;

libavcodec/error_resilience.c:66:9: Call
        64.                        pack16to32(s->mv[0][0][0], s->mv[0][0][1]), 4);
        65.         assert(!FRAME_MBAFF);
        66.         ff_h264_hl_decode_mb(h);
                    ^
        67.     } else {
        68.         assert(ref == 0);

libavcodec/h264.c:2226:1: Parameter `h->list_count`
          2224. }
          2225. 
          2226. void ff_h264_hl_decode_mb(H264Context *h){
                ^
          2227.     MpegEncContext * const s = &h->s;
          2228.     const int mb_xy= h->mb_xy;

libavcodec/h264.c:2234:13: Call
          2232.     if (CHROMA444) {
          2233.         if(is_complex || h->pixel_shift)
          2234.             hl_decode_mb_444_complex(h);
                            ^
          2235.         else
          2236.             hl_decode_mb_444_simple(h);

libavcodec/h264.c:2218:1: Parameter `h->list_count`
            2216. }
            2217. 
            2218. static void av_noinline hl_decode_mb_444_complex(H264Context *h){
                  ^
            2219.     hl_decode_mb_444_internal(h, 0, h->pixel_shift);
            2220. }

libavcodec/h264.c:2219:5: Call
            2217. 
            2218. static void av_noinline hl_decode_mb_444_complex(H264Context *h){
            2219.     hl_decode_mb_444_internal(h, 0, h->pixel_shift);
                      ^
            2220. }
            2221. 

libavcodec/h264.c:2105:1: Parameter `h->list_count`
              2103. }
              2104. 
              2105. static av_always_inline void hl_decode_mb_444_internal(H264Context *h, int simple, int pixel_shift){
                    ^
              2106.     MpegEncContext * const s = &h->s;
              2107.     const int mb_x= s->mb_x;

libavcodec/h264.c:2184:13: Call
              2182.                 xchg_mb_border(h, dest[0], dest[1], dest[2], linesize, linesize, 0, 1, simple, pixel_shift);
              2183.         }else{
              2184.             hl_motion(h, dest[0], dest[1], dest[2],
                                ^
              2185.                       s->me.qpel_put, s->dsp.put_h264_chroma_pixels_tab,
              2186.                       s->me.qpel_avg, s->dsp.avg_h264_chroma_pixels_tab,

libavcodec/h264.c:718:1: Parameter `h->list_count`
                716. }
                717. 
                718. static av_always_inline void hl_motion(H264Context *h, uint8_t *dest_y, uint8_t *dest_cb, uint8_t *dest_cr,
                     ^
                719.                       qpel_mc_func (*qpix_put)[16], h264_chroma_mc_func (*chroma_put),
                720.                       qpel_mc_func (*qpix_avg)[16], h264_chroma_mc_func (*chroma_avg),

libavcodec/h264.c:731:9: Call
                729. 
                730.     if(HAVE_THREADS && (s->avctx->active_thread_type & FF_THREAD_FRAME))
                731.         await_references(h);
                             ^
                732.     prefetch_motion(h, 0, pixel_shift, chroma_idc);
                733. 

libavcodec/h264.c:293:1: <LHS trace>
291.  * @param h the H264 context
292.  */
293. static void await_references(H264Context *h){
     ^
294.     MpegEncContext * const s = &h->s;
295.     const int mb_xy= h->mb_xy;

libavcodec/h264.c:293:1: Parameter `h->list_count`
                  291.  * @param h the H264 context
                  292.  */
                  293. static void await_references(H264Context *h){
                       ^
                  294.     MpegEncContext * const s = &h->s;
                  295.     const int mb_xy= h->mb_xy;

libavcodec/h264.c:351:9: Binary operation: ([0, +oo] - 1):unsigned32 by call to `decode_slice_header` 
                  349.     }
                  350. 
                  351.     for(list=h->list_count-1; list>=0; list--){
                               ^
                  352.         for(ref=0; ref<48 && nrefs[list]; ref++){
                  353.             int row = refs[list][ref];
