libavcodec/h264.c:1058: error: Integer Overflow L2
  ([0, 4294967311] + 1):signed32 by call to `decode_nal_units`.

libavcodec/h264.c:1058:17: Call
1056.     }
1057. 
1058.     buf_index = decode_nal_units(h, buf, buf_size);
                      ^
1059.     if (buf_index < 0)
1060.         return AVERROR_INVALIDDATA;

libavcodec/h264.c:817:11: Call
  815.     }
  816. 
  817.     ret = ff_h2645_packet_split(&h->pkt, buf, buf_size, avctx, h->is_avc,
                 ^
  818.                                 h->nal_length_size, avctx->codec_id);
  819.     if (ret < 0) {

libavcodec/h2645_parse.c:260:15: Call
    258.         nal->size_bits = get_bit_length(nal, skip_trailing_zeros);
    259. 
    260.         ret = init_get_bits(&nal->gb, nal->data, nal->size_bits);
                       ^
    261.         if (ret < 0)
    262.             return ret;

libavcodec/get_bits.h:362:1: Parameter `bit_size`
      360.  * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
      361.  */
      362. static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
           ^
      363.                                 int bit_size)
      364. {

libavcodec/get_bits.h:379:5: Assignment
      377.     s->size_in_bits       = bit_size;
      378. #if !UNCHECKED_BITSTREAM_READER
      379.     s->size_in_bits_plus8 = bit_size + 8;
               ^
      380. #endif
      381.     s->buffer_end         = buffer + buffer_size;

libavcodec/h264.c:1058:17: Call
1056.     }
1057. 
1058.     buf_index = decode_nal_units(h, buf, buf_size);
                      ^
1059.     if (buf_index < 0)
1060.         return AVERROR_INVALIDDATA;

libavcodec/h264.c:803:1: Parameter `h->slice_ctx->ref_count[*]`
  801. }
  802. 
  803. static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size)
       ^
  804. {
  805.     AVCodecContext *const avctx = h->avctx;

libavcodec/h264.c:854:24: Call
  852.             sl->gb = nal->gb;
  853. 
  854.             if ((err = ff_h264_decode_slice_header(h, sl)))
                              ^
  855.                 break;
  856. 

libavcodec/h264_slice.c:1422:1: Parameter `sl->ref_count[*]`
    1420.  * @return 0 if okay, <0 if an error occurred
    1421.  */
    1422. int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl)
          ^
    1423. {
    1424.     int i, j, ret = 0;

libavcodec/h264_slice.c:1426:11: Call
    1424.     int i, j, ret = 0;
    1425. 
    1426.     ret = h264_slice_header_parse(h, sl);
                    ^
    1427.     if (ret < 0)
    1428.         return ret;

libavcodec/h264_slice.c:1166:1: Parameter `sl->ref_count[*]`
      1164. }
      1165. 
      1166. static int h264_slice_header_parse(H264Context *h, H264SliceContext *sl)
            ^
      1167. {
      1168.     const SPS *sps;

libavcodec/h264_slice.c:1473:5: Call
    1471.     if (sl->slice_type_nos == AV_PICTURE_TYPE_B && !sl->direct_spatial_mv_pred)
    1472.         ff_h264_direct_dist_scale_factor(h, sl);
    1473.     ff_h264_direct_ref_list_init(h, sl);
              ^
    1474. 
    1475.     if (h->avctx->skip_loop_filter >= AVDISCARD_ALL ||

libavcodec/h264_direct.c:110:1: Parameter `sl->ref_count[*]`
      108. }
      109. 
      110. void ff_h264_direct_ref_list_init(const H264Context *const h, H264SliceContext *sl)
           ^
      111. {
      112.     H264Ref *const ref1 = &sl->ref_list[1][0];

libavcodec/h264_direct.c:154:9: Call
      152. 
      153.     for (list = 0; list < 2; list++) {
      154.         fill_colmap(h, sl, sl->map_col_to_list0, list, sidx, ref1sidx, 0);
                   ^
      155.         if (FRAME_MBAFF(h))
      156.             for (field = 0; field < 2; field++)

libavcodec/h264_direct.c:72:1: <LHS trace>
70. }
71. 
72. static void fill_colmap(const H264Context *h, H264SliceContext *sl,
    ^
73.                         int map[2][16 + 32], int list,
74.                         int field, int colfield, int mbafi)

libavcodec/h264_direct.c:72:1: Parameter `sl->ref_count[*]`
        70. }
        71. 
        72. static void fill_colmap(const H264Context *h, H264SliceContext *sl,
            ^
        73.                         int map[2][16 + 32], int list,
        74.                         int field, int colfield, int mbafi)

libavcodec/h264_direct.c:79:18: Assignment
        77.     int j, old_ref, rfield;
        78.     int start  = mbafi ? 16                       : 0;
        79.     int end    = mbafi ? 16 + 2 * sl->ref_count[0] : sl->ref_count[0];
                             ^
        80.     int interl = mbafi || h->picture_structure != PICT_FRAME;
        81. 

libavcodec/h264_direct.c:79:5: Assignment
        77.     int j, old_ref, rfield;
        78.     int start  = mbafi ? 16                       : 0;
        79.     int end    = mbafi ? 16 + 2 * sl->ref_count[0] : sl->ref_count[0];
                ^
        80.     int interl = mbafi || h->picture_structure != PICT_FRAME;
        81. 

libavcodec/h264_direct.c:95:38: Binary operation: ([0, 4294967311] + 1):signed32 by call to `decode_nal_units` 
        93.                 poc = (poc & ~3) + rfield + 1;
        94. 
        95.             for (j = start; j < end; j++) {
                                                 ^
        96.                 if (4 * sl->ref_list[0][j].parent->frame_num +
        97.                     (sl->ref_list[0][j].reference & 3) == poc) {
