libavcodec/h264.c:3704: error: Buffer Overrun L1
  Offset: [20, 51] Size: 2.

libavcodec/h264.c:3703:14: <Offset trace>
3701.         ref2frm[18 + 0]     =
3702.             ref2frm[18 + 1] = -1;
3703.         for (i = 16; i < 48; i++)
                   ^
3704.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
3705.                              (h->ref_list[j][i].reference & 3);

libavcodec/h264.c:3703:14: Assignment
3701.         ref2frm[18 + 0]     =
3702.             ref2frm[18 + 1] = -1;
3703.         for (i = 16; i < 48; i++)
                   ^
3704.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
3705.                              (h->ref_list[j][i].reference & 3);

libavcodec/h264.c:3086:1: <Length trace>
3084.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
3085.  */
3086. static int decode_slice_header(H264Context *h, H264Context *h0)
      ^
3087. {
3088.     unsigned int first_mb_in_slice;

libavcodec/h264.c:3086:1: Parameter `h->ref2frm[*][*]`
3084.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
3085.  */
3086. static int decode_slice_header(H264Context *h, H264Context *h0)
      ^
3087. {
3088.     unsigned int first_mb_in_slice;

libavcodec/h264.c:3677:9: Assignment
3675.     for (j = 0; j < 2; j++) {
3676.         int id_list[16];
3677.         int *ref2frm = h->ref2frm[h->slice_num & (MAX_SLICES - 1)][j];
              ^
3678.         for (i = 0; i < 16; i++) {
3679.             id_list[i] = 60;

libavcodec/h264.c:3704:13: Array access: Offset: [20, 51] Size: 2
3702.             ref2frm[18 + 1] = -1;
3703.         for (i = 16; i < 48; i++)
3704.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
                  ^
3705.                              (h->ref_list[j][i].reference & 3);
3706.     }
