libavcodec/h264.c:3667: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `decode_slice_header`.

libavcodec/h264.c:3550:1: Parameter `h->s.list_count`
3548. 
3549. 
3550. static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
      ^
3551.     MpegEncContext * const s = &h->s;
3552.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:3667:23: Call
3665.             hx->s.data_partitioning = 0;
3666. 
3667.             if((err = decode_slice_header(hx, h)))
                            ^
3668.                break;
3669. 

libavcodec/h264.c:2435:1: Parameter `h->s.list_count`
  2433.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
  2434.  */
  2435. static int decode_slice_header(H264Context *h, H264Context *h0){
        ^
  2436.     MpegEncContext * const s = &h->s;
  2437.     MpegEncContext * const s0 = &h0->s;

libavcodec/h264.c:2460:13: Call
  2458.     if(first_mb_in_slice == 0){ //FIXME better field boundary detection
  2459.         if(h0->current_slice && FIELD_PICTURE){
  2460.             field_end(h, 1);
                    ^
  2461.         }
  2462. 

libavcodec/h264.c:2321:1: Parameter `h->s.list_count`
    2319. }
    2320. 
    2321. static void field_end(H264Context *h, int in_setup){
          ^
    2322.     MpegEncContext * const s = &h->s;
    2323.     AVCodecContext * const avctx= s->avctx;

libavcodec/h264.c:2365:9: Call
    2363.      */
    2364.     if (!FIELD_PICTURE)
    2365.         ff_er_frame_end(s);
                  ^
    2366. 
    2367.     MPV_frame_end(s);

libavcodec/error_resilience.c:781:1: Parameter `s->list_count`
      779. }
      780. 
      781. void ff_er_frame_end(MpegEncContext *s){
           ^
      782.     int i, mb_x, mb_y, error, error_type, dc_error, mv_error, ac_error;
      783.     int distance;

libavcodec/error_resilience.c:1000:13: Call
       998.             s->mb_x= mb_x;
       999.             s->mb_y= mb_y;
      1000.             decode_mb(s, 0/*FIXME h264 partitioned slices need this set*/);
                        ^
      1001.         }
      1002.     }

libavcodec/error_resilience.c:43:1: Parameter `s->list_count`
        41. #undef mb_intra
        42. 
        43. static void decode_mb(MpegEncContext *s, int ref){
            ^
        44.     s->dest[0] = s->current_picture.data[0] + (s->mb_y * 16* s->linesize  ) + s->mb_x * 16;
        45.     s->dest[1] = s->current_picture.data[1] + (s->mb_y * (16>>s->chroma_y_shift) * s->uvlinesize) + s->mb_x * (16>>s->chroma_x_shift);

libavcodec/error_resilience.c:59:9: Call
        57.         fill_rectangle(h->mv_cache[0][ scan8[0] ], 4, 4, 8, pack16to32(s->mv[0][0][0],s->mv[0][0][1]), 4);
        58.         assert(!FRAME_MBAFF);
        59.         ff_h264_hl_decode_mb(h);
                    ^
        60.     }else{
        61.         assert(ref==0);

libavcodec/h264.c:2037:1: Parameter `h->list_count`
          2035. }
          2036. 
          2037. void ff_h264_hl_decode_mb(H264Context *h){
                ^
          2038.     MpegEncContext * const s = &h->s;
          2039.     const int mb_xy= h->mb_xy;

libavcodec/h264.c:2045:13: Call
          2043.     if (CHROMA444) {
          2044.         if(is_complex || h->pixel_shift)
          2045.             hl_decode_mb_444_complex(h);
                            ^
          2046.         else
          2047.             hl_decode_mb_444_simple(h);

libavcodec/h264.c:2029:1: Parameter `h->list_count`
            2027. }
            2028. 
            2029. static void av_noinline hl_decode_mb_444_complex(H264Context *h){
                  ^
            2030.     hl_decode_mb_444_internal(h, 0, h->pixel_shift);
            2031. }

libavcodec/h264.c:2030:5: Call
            2028. 
            2029. static void av_noinline hl_decode_mb_444_complex(H264Context *h){
            2030.     hl_decode_mb_444_internal(h, 0, h->pixel_shift);
                      ^
            2031. }
            2032. 

libavcodec/h264.c:1916:1: Parameter `h->list_count`
              1914. }
              1915. 
              1916. static av_always_inline void hl_decode_mb_444_internal(H264Context *h, int simple, int pixel_shift){
                    ^
              1917.     MpegEncContext * const s = &h->s;
              1918.     const int mb_x= s->mb_x;

libavcodec/h264.c:1995:13: Call
              1993.                 xchg_mb_border(h, dest[0], dest[1], dest[2], linesize, linesize, 0, 1, simple, pixel_shift);
              1994.         }else{
              1995.             hl_motion(h, dest[0], dest[1], dest[2],
                                ^
              1996.                       s->me.qpel_put, s->dsp.put_h264_chroma_pixels_tab,
              1997.                       s->me.qpel_avg, s->dsp.avg_h264_chroma_pixels_tab,

libavcodec/h264.c:680:1: Parameter `h->list_count`
                678. }
                679. 
                680. static av_always_inline void hl_motion(H264Context *h, uint8_t *dest_y, uint8_t *dest_cb, uint8_t *dest_cr,
                     ^
                681.                       qpel_mc_func (*qpix_put)[16], h264_chroma_mc_func (*chroma_put),
                682.                       qpel_mc_func (*qpix_avg)[16], h264_chroma_mc_func (*chroma_avg),

libavcodec/h264.c:692:9: Call
                690. 
                691.     if(HAVE_PTHREADS && (s->avctx->active_thread_type & FF_THREAD_FRAME))
                692.         await_references(h);
                             ^
                693.     prefetch_motion(h, 0, pixel_shift, chroma444);
                694. 

libavcodec/h264.c:290:1: <LHS trace>
288.  * @param h the H264 context
289.  */
290. static void await_references(H264Context *h){
     ^
291.     MpegEncContext * const s = &h->s;
292.     const int mb_xy= h->mb_xy;

libavcodec/h264.c:290:1: Parameter `h->list_count`
                  288.  * @param h the H264 context
                  289.  */
                  290. static void await_references(H264Context *h){
                       ^
                  291.     MpegEncContext * const s = &h->s;
                  292.     const int mb_xy= h->mb_xy;

libavcodec/h264.c:348:9: Binary operation: ([0, +oo] - 1):unsigned32 by call to `decode_slice_header` 
                  346.     }
                  347. 
                  348.     for(list=h->list_count-1; list>=0; list--){
                               ^
                  349.         for(ref=0; ref<48 && nrefs[list]; ref++){
                  350.             int row = refs[list][ref];
