libavcodec/h264.c:3464: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `ff_h264_hl_decode_mb`.

libavcodec/h264.c:3459:23: Call
3457.         for (;;) {
3458.             // START_TIMER
3459.             int ret = ff_h264_decode_mb_cabac(h);
                            ^
3460.             int eos;
3461.             // STOP_TIMER("decode_mb_cabac")

libavcodec/h264_cabac.c:2063:17: Call
  2061.             if( IS_DIRECT(h->sub_mb_type[0] | h->sub_mb_type[1] |
  2062.                           h->sub_mb_type[2] | h->sub_mb_type[3]) ) {
  2063.                 ff_h264_pred_direct_motion(h, &mb_type);
                        ^
  2064.                 h->ref_cache[0][scan8[4]] =
  2065.                 h->ref_cache[1][scan8[4]] =

libavcodec/h264_direct.c:626:9: Call
    624. void ff_h264_pred_direct_motion(H264Context * const h, int *mb_type){
    625.     if(h->direct_spatial_mv_pred){
    626.         pred_spatial_direct_motion(h, mb_type);
                 ^
    627.     }else{
    628.         pred_temp_direct_motion(h, mb_type);

libavcodec/h264.c:3464:17: Call
3462. 
3463.             if (ret >= 0)
3464.                 ff_h264_hl_decode_mb(h);
                      ^
3465. 
3466.             // FIXME optimal? or let mb_decode decode 16x32 ?

libavcodec/h264.c:1925:1: Parameter `h->list_count`
  1923. #include "h264_mb_template.c"
  1924. 
  1925. void ff_h264_hl_decode_mb(H264Context *h)
        ^
  1926. {
  1927.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:1934:13: Call
  1932.     if (CHROMA444) {
  1933.         if (is_complex || h->pixel_shift)
  1934.             hl_decode_mb_444_complex(h);
                    ^
  1935.         else
  1936.             hl_decode_mb_444_simple_8(h);

libavcodec/h264_mb_template.c:278:1: Parameter `h->list_count`
    276. #include "h264_mc_template.c"
    277. 
    278. static av_noinline void FUNC(hl_decode_mb_444)(H264Context *h)
         ^
    279. {
    280.     MpegEncContext *const s = &h->s;

libavcodec/h264_mb_template.c:362:13: Call
    360.                                linesize, 0, 1, SIMPLE, PIXEL_SHIFT);
    361.         } else {
    362.             FUNC(hl_motion_444)(h, dest[0], dest[1], dest[2],
                     ^
    363.                       s->me.qpel_put, s->dsp.put_h264_chroma_pixels_tab,
    364.                       s->me.qpel_avg, s->dsp.avg_h264_chroma_pixels_tab,

libavcodec/h264_mc_template.c:61:1: Parameter `h->list_count`
      59. }
      60. 
      61. static void MCFUNC(hl_motion)(H264Context *h, uint8_t *dest_y,
          ^
      62.                               uint8_t *dest_cb, uint8_t *dest_cr,
      63.                               qpel_mc_func(*qpix_put)[16],

libavcodec/h264_mc_template.c:77:9: Call
      75. 
      76.     if (HAVE_THREADS && (s->avctx->active_thread_type & FF_THREAD_FRAME))
      77.         await_references(h);
                  ^
      78.     prefetch_motion(h, 0, PIXEL_SHIFT, CHROMA_IDC);
      79. 

libavcodec/h264.c:338:1: <LHS trace>
336.  * @param h the H264 context
337.  */
338. static void await_references(H264Context *h)
     ^
339. {
340.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:338:1: Parameter `h->list_count`
        336.  * @param h the H264 context
        337.  */
        338. static void await_references(H264Context *h)
             ^
        339. {
        340.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:409:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ff_h264_hl_decode_mb` 
        407.     }
        408. 
        409.     for (list = h->list_count - 1; list >= 0; list--)
                      ^
        410.         for (ref = 0; ref < 48 && nrefs[list]; ref++) {
        411.             int row = refs[list][ref];
