libavcodec/h264dec.c:742: error: Buffer Overrun L2
  Offset: [0, 2147483647] Size: 2 by call to `decode_nal_units`.

libavcodec/h264dec.c:742:17: Call
740.     }
741. 
742.     buf_index = decode_nal_units(h, buf, buf_size);
                     ^
743.     if (buf_index < 0)
744.         return AVERROR_INVALIDDATA;

libavcodec/h264dec.c:528:11: Call
  526.     }
  527. 
  528.     ret = ff_h2645_packet_split(&h->pkt, buf, buf_size, avctx, h->is_avc,
                 ^
  529.                                 h->nal_length_size, avctx->codec_id);
  530.     if (ret < 0) {

libavcodec/h2645_parse.c:301:15: Call
    299.         nal->size_bits = get_bit_length(nal, skip_trailing_zeros);
    300. 
    301.         ret = init_get_bits(&nal->gb, nal->data, nal->size_bits);
                       ^
    302.         if (ret < 0)
    303.             return ret;

libavcodec/get_bits.h:362:1: Parameter `bit_size`
      360.  * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
      361.  */
      362. static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
           ^
      363.                                 int bit_size)
      364. {

libavcodec/get_bits.h:379:5: Assignment
      377.     s->size_in_bits       = bit_size;
      378. #if !UNCHECKED_BITSTREAM_READER
      379.     s->size_in_bits_plus8 = bit_size + 8;
               ^
      380. #endif
      381.     s->buffer_end         = buffer + buffer_size;

libavcodec/h264dec.c:742:17: Call
740.     }
741. 
742.     buf_index = decode_nal_units(h, buf, buf_size);
                     ^
743.     if (buf_index < 0)
744.         return AVERROR_INVALIDDATA;

libavcodec/h264dec.c:515:1: Parameter `h->slice_ctx->list_count`
  513. }
  514. 
  515. static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size)
       ^
  516. {
  517.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264dec.c:573:24: Call
  571.             idr(h); // FIXME ensure we don't lose some frames if there is reordering
  572.         case H264_NAL_SLICE:
  573.             if ((err = ff_h264_queue_decode_slice(h, nal)))
                              ^
  574.                 break;
  575. 

libavcodec/h264_slice.c:1852:1: Parameter `h->slice_ctx->list_count`
    1850. }
    1851. 
    1852. int ff_h264_queue_decode_slice(H264Context *h, const H2645NAL *nal)
          ^
    1853. {
    1854.     H264SliceContext *sl = h->slice_ctx + h->nb_slice_ctx_queued;

libavcodec/h264_slice.c:1859:11: Call
    1857.     sl->gb = nal->gb;
    1858. 
    1859.     ret = h264_slice_header_parse(sl, nal, &h->ps, h->avctx);
                    ^
    1860.     if (ret < 0)
    1861.         return ret;

libavcodec/h264_slice.c:1509:1: Parameter `sl->list_count`
      1507. }
      1508. 
      1509. static int h264_slice_header_parse(H264SliceContext *sl, const H2645NAL *nal,
            ^
      1510.                                    const H264ParamSets *ps, AVCodecContext *avctx)
      1511. {

libavcodec/h264_slice.c:1905:11: Call
    1903.     }
    1904. 
    1905.     ret = h264_slice_init(h, sl, nal);
                    ^
    1906.     if (ret < 0)
    1907.         return ret;

libavcodec/h264_slice.c:1704:1: Parameter `sl->list_count`
      1702. /* do all the per-slice initialization needed before we can start decoding the
      1703.  * actual MBs */
      1704. static int h264_slice_init(H264Context *h, H264SliceContext *sl,
            ^
      1705.                            const H2645NAL *nal)
      1706. {

libavcodec/h264_slice.c:1747:11: Call
      1745.     assert(sl->mb_y < h->mb_height);
      1746. 
      1747.     ret = ff_h264_build_ref_list(h, sl);
                      ^
      1748.     if (ret < 0)
      1749.         return ret;

libavcodec/h264_refs.c:256:1: Parameter `sl->list_count`
        254. }
        255. 
        256. int ff_h264_build_ref_list(const H264Context *h, H264SliceContext *sl)
             ^
        257. {
        258.     int list, index, pic_structure;

libavcodec/h264_refs.c:365:9: Call
        363. 
        364.     if (FRAME_MBAFF(h))
        365.         h264_fill_mbaff_ref_list(sl);
                     ^
        366. 
        367.     return 0;

libavcodec/h264_refs.c:231:1: <Offset trace>
229. }
230. 
231. static void h264_fill_mbaff_ref_list(H264SliceContext *sl)
     ^
232. {
233.     int list, i, j;

libavcodec/h264_refs.c:231:1: Parameter `sl->list_count`
          229. }
          230. 
          231. static void h264_fill_mbaff_ref_list(H264SliceContext *sl)
               ^
          232. {
          233.     int list, i, j;

libavcodec/h264_refs.c:231:1: <Length trace>
229. }
230. 
231. static void h264_fill_mbaff_ref_list(H264SliceContext *sl)
     ^
232. {
233.     int list, i, j;

libavcodec/h264_refs.c:231:1: Parameter `sl->ref_count[*]`
          229. }
          230. 
          231. static void h264_fill_mbaff_ref_list(H264SliceContext *sl)
               ^
          232. {
          233.     int list, i, j;

libavcodec/h264_refs.c:235:25: Array access: Offset: [0, 2147483647] Size: 2 by call to `decode_nal_units` 
          233.     int list, i, j;
          234.     for (list = 0; list < sl->list_count; list++) {
          235.         for (i = 0; i < sl->ref_count[list]; i++) {
                                       ^
          236.             H264Ref *frame = &sl->ref_list[list][i];
          237.             H264Ref *field = &sl->ref_list[list][16 + 2 * i];
