libavcodec/h264.c:81: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `ff_h264_hl_decode_mb`.

libavcodec/h264.c:68:5: Unknown value from: __infer_skip
66.     sl->mb_xy = mb_x + mb_y * h->mb_stride;
67.     memset(sl->non_zero_count_cache, 0, sizeof(sl->non_zero_count_cache));
68.     assert(ref >= 0);
        ^
69.     /* FIXME: It is possible albeit uncommon that slice references
70.      * differ between slices. We take the easy approach and ignore

libavcodec/h264.c:81:5: Call
79.                    pack16to32((*mv)[0][0][0], (*mv)[0][0][1]), 4);
80.     assert(!FRAME_MBAFF(h));
81.     ff_h264_hl_decode_mb(h, &h->slice_ctx[0]);
        ^
82. }
83. 

libavcodec/h264_mb.c:792:1: Parameter `sl->list_count`
  790. #include "h264_mb_template.c"
  791. 
  792. void ff_h264_hl_decode_mb(const H264Context *h, H264SliceContext *sl)
       ^
  793. {
  794.     const int mb_xy   = sl->mb_xy;

libavcodec/h264_mb.c:807:9: Call
  805.         hl_decode_mb_complex(h, sl);
  806.     } else if (h->pixel_shift) {
  807.         hl_decode_mb_simple_16(h, sl);
               ^
  808.     } else
  809.         hl_decode_mb_simple_8(h, sl);

libavcodec/h264_mb_template.c:41:1: Parameter `sl->list_count`
    39. #include "h264_mc_template.c"
    40. 
    41. static av_noinline void FUNC(hl_decode_mb)(const H264Context *h, H264SliceContext *sl)
        ^
    42. {
    43.     const int mb_x    = sl->mb_x;

libavcodec/h264_mb_template.c:175:17: Call
    173.         } else {
    174.             if (chroma422) {
    175.                 FUNC(hl_motion_422)(h, sl, dest_y, dest_cb, dest_cr,
                         ^
    176.                               h->qpel_put, h->h264chroma.put_h264_chroma_pixels_tab,
    177.                               h->qpel_avg, h->h264chroma.avg_h264_chroma_pixels_tab,

libavcodec/h264_mc_template.c:64:1: Parameter `sl->list_count`
      62. }
      63. 
      64. static void MCFUNC(hl_motion)(const H264Context *h, H264SliceContext *sl,
          ^
      65.                               uint8_t *dest_y,
      66.                               uint8_t *dest_cb, uint8_t *dest_cr,

libavcodec/h264_mc_template.c:80:9: Call
      78. 
      79.     if (HAVE_THREADS && (h->avctx->active_thread_type & FF_THREAD_FRAME))
      80.         await_references(h, sl);
                  ^
      81.     prefetch_motion(h, sl, 0, PIXEL_SHIFT, CHROMA_IDC);
      82. 

libavcodec/h264_mb.c:95:1: <LHS trace>
93.  * @param h the H264 context
94.  */
95. static void await_references(const H264Context *h, H264SliceContext *sl)
    ^
96. {
97.     const int mb_xy   = sl->mb_xy;

libavcodec/h264_mb.c:95:1: Parameter `sl->list_count`
        93.  * @param h the H264 context
        94.  */
        95. static void await_references(const H264Context *h, H264SliceContext *sl)
            ^
        96. {
        97.     const int mb_xy   = sl->mb_xy;

libavcodec/h264_mb.c:165:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ff_h264_hl_decode_mb` 
        163.     }
        164. 
        165.     for (list = sl->list_count - 1; list >= 0; list--)
                      ^
        166.         for (ref = 0; ref < 48 && nrefs[list]; ref++) {
        167.             int row = refs[list][ref];
