libavcodec/h264.c:1046: error: Buffer Overrun L2
  Offset: [8, 2147483648] Size: 64 by call to `decode_nal_units`.

libavcodec/h264.c:1046:17: Call
1044.     }
1045. 
1046.     buf_index = decode_nal_units(h, buf, buf_size);
                      ^
1047.     if (buf_index < 0)
1048.         return AVERROR_INVALIDDATA;

libavcodec/h264.c:818:11: Call
  816.     }
  817. 
  818.     ret = ff_h2645_packet_split(&h->pkt, buf, buf_size, avctx, h->is_avc,
                 ^
  819.                                 h->nal_length_size, avctx->codec_id);
  820.     if (ret < 0) {

libavcodec/h2645_parse.c:260:15: Call
    258.         nal->size_bits = get_bit_length(nal, skip_trailing_zeros);
    259. 
    260.         ret = init_get_bits(&nal->gb, nal->data, nal->size_bits);
                       ^
    261.         if (ret < 0)
    262.             return ret;

libavcodec/get_bits.h:384:1: Parameter `bit_size`
      382.  * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
      383.  */
      384. static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
           ^
      385.                                 int bit_size)
      386. {

libavcodec/get_bits.h:401:5: Assignment
      399.     s->size_in_bits       = bit_size;
      400. #if !UNCHECKED_BITSTREAM_READER
      401.     s->size_in_bits_plus8 = bit_size + 8;
               ^
      402. #endif
      403.     s->buffer_end         = buffer + buffer_size;

libavcodec/h264.c:1046:17: Call
1044.     }
1045. 
1046.     buf_index = decode_nal_units(h, buf, buf_size);
                      ^
1047.     if (buf_index < 0)
1048.         return AVERROR_INVALIDDATA;

libavcodec/h264.c:804:1: Parameter `*h->cur_pic.ref_index[*]`
  802. }
  803. 
  804. static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size)
       ^
  805. {
  806.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264.c:938:19: Call
  936. 
  937.         if (context_count == h->nb_slice_ctx) {
  938.             ret = ff_h264_execute_decode_slices(h, context_count);
                         ^
  939.             if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE))
  940.                 goto end;

libavcodec/h264_slice.c:2113:1: Parameter `*h->cur_pic.ref_index[*]`
    2111.  * @param context_count number of contexts to execute
    2112.  */
    2113. int ff_h264_execute_decode_slices(H264Context *h, unsigned context_count)
          ^
    2114. {
    2115.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264_slice.c:2172:21: Call
    2170.                 for (j = sl->resync_mb_y; j < y_end; j += 1 + FIELD_OR_MBAFF_PICTURE(h)) {
    2171.                     sl->mb_y = j;
    2172.                     loop_filter(h, sl, j > sl->resync_mb_y ? 0 : sl->resync_mb_x,
                              ^
    2173.                                 j == y_end - 1 ? x_end : h->mb_width);
    2174.                 }

libavcodec/h264_slice.c:1788:1: Parameter `*h->cur_pic.ref_index[*]`
      1786. }
      1787. 
      1788. static void loop_filter(const H264Context *h, H264SliceContext *sl, int start_x, int end_x)
            ^
      1789. {
      1790.     uint8_t *dest_y, *dest_cb, *dest_cr;

libavcodec/h264_slice.c:1837:21: Call
      1835.                 backup_mb_border(h, sl, dest_y, dest_cb, dest_cr, linesize,
      1836.                                  uvlinesize, 0);
      1837.                 if (fill_filter_caches(h, sl, mb_type))
                                ^
      1838.                     continue;
      1839.                 sl->chroma_qp[0] = get_chroma_qp(h, 0, h->cur_pic.qscale_table[mb_xy]);

libavcodec/h264_slice.c:1646:1: Parameter `*h->cur_pic.ref_index[*]`
        1644.  * @return non zero if the loop filter can be skipped
        1645.  */
        1646. static int fill_filter_caches(const H264Context *h, H264SliceContext *sl, int mb_type)
              ^
        1647. {
        1648.     const int mb_xy = sl->mb_xy;

libavcodec/h264_slice.c:1717:5: Call
        1715.         return 0;
        1716. 
        1717.     fill_filter_caches_inter(h, sl, mb_type, top_xy, left_xy,
                  ^
        1718.                              top_type, left_type, mb_xy, 0);
        1719.     if (sl->list_count == 2)

libavcodec/h264_slice.c:1562:1: <Offset trace>
1560. }
1561. 
1562. static av_always_inline void fill_filter_caches_inter(const H264Context *h,
      ^
1563.                                                       H264SliceContext *sl,
1564.                                                       int mb_type, int top_xy,

libavcodec/h264_slice.c:1562:1: Parameter `*h->cur_pic.ref_index[*]`
          1560. }
          1561. 
          1562. static av_always_inline void fill_filter_caches_inter(const H264Context *h,
                ^
          1563.                                                       H264SliceContext *sl,
          1564.                                                       int mb_type, int top_xy,

libavcodec/h264_slice.c:1562:1: <Length trace>
1560. }
1561. 
1562. static av_always_inline void fill_filter_caches_inter(const H264Context *h,
      ^
1563.                                                       H264SliceContext *sl,
1564.                                                       int mb_type, int top_xy,

libavcodec/h264_slice.c:1562:1: Parameter `h->ref2frm[*][*][*]`
          1560. }
          1561. 
          1562. static av_always_inline void fill_filter_caches_inter(const H264Context *h,
                ^
          1563.                                                       H264SliceContext *sl,
          1564.                                                       int mb_type, int top_xy,

libavcodec/h264_slice.c:1580:36: Array access: Offset: [8, 2147483648] Size: 64 by call to `decode_nal_units` 
          1578.             AV_COPY128(mv_dst - 1 * 8, h->cur_pic.motion_val[list][b_xy + 0]);
          1579.             ref_cache[0 - 1 * 8] =
          1580.             ref_cache[1 - 1 * 8] = ref2frm[list][h->cur_pic.ref_index[list][b8_xy + 0]];
                                                   ^
          1581.             ref_cache[2 - 1 * 8] =
          1582.             ref_cache[3 - 1 * 8] = ref2frm[list][h->cur_pic.ref_index[list][b8_xy + 1]];
