libavcodec/h264.h:845: error: Buffer Overrun L1
  Offset: [2, `h->list_count` + 19] (⇐ [2, 20] + [0, `h->list_count` - 1]) Size: 2.

libavcodec/h264.h:729:1: <Offset trace>
727. static inline void pred_pskip_motion(H264Context * const h, int * const mx, int * const my);
728. 
729. static av_always_inline int fill_caches(H264Context *h, int mb_type, int for_deblock){
     ^
730.     MpegEncContext * const s = &h->s;
731.     const int mb_xy= h->mb_xy;

libavcodec/h264.h:729:1: Parameter `h->list_count`
727. static inline void pred_pskip_motion(H264Context * const h, int * const mx, int * const my);
728. 
729. static av_always_inline int fill_caches(H264Context *h, int mb_type, int for_deblock){
     ^
730.     MpegEncContext * const s = &h->s;
731.     const int mb_xy= h->mb_xy;

libavcodec/h264.h:729:1: <Length trace>
727. static inline void pred_pskip_motion(H264Context * const h, int * const mx, int * const my);
728. 
729. static av_always_inline int fill_caches(H264Context *h, int mb_type, int for_deblock){
     ^
730.     MpegEncContext * const s = &h->s;
731.     const int mb_xy= h->mb_xy;

libavcodec/h264.h:729:1: Parameter `h->ref2frm[*][*]`
727. static inline void pred_pskip_motion(H264Context * const h, int * const mx, int * const my);
728. 
729. static av_always_inline int fill_caches(H264Context *h, int mb_type, int for_deblock){
     ^
730.     MpegEncContext * const s = &h->s;
731.     const int mb_xy= h->mb_xy;

libavcodec/h264.h:843:21: Assignment
841.                 ref = &s->current_picture.ref_index[list][h->mb2b8_xy[mb_xy]];
842.                 {
843.                     int (*ref2frm)[64] = h->ref2frm[ h->slice_num&(MAX_SLICES-1) ][0] + (MB_MBAFF ? 20 : 2);
                         ^
844.                     *(uint32_t*)&h->ref_cache[list][scan8[ 0]] =
845.                     *(uint32_t*)&h->ref_cache[list][scan8[ 2]] = (pack16to32(ref2frm[list][ref[0]],ref2frm[list][ref[1]])&0x00FF00FF)*0x0101;

libavcodec/h264.h:845:78: Array access: Offset: [2, h->list_count + 19] (⇐ [2, 20] + [0, h->list_count - 1]) Size: 2
843.                     int (*ref2frm)[64] = h->ref2frm[ h->slice_num&(MAX_SLICES-1) ][0] + (MB_MBAFF ? 20 : 2);
844.                     *(uint32_t*)&h->ref_cache[list][scan8[ 0]] =
845.                     *(uint32_t*)&h->ref_cache[list][scan8[ 2]] = (pack16to32(ref2frm[list][ref[0]],ref2frm[list][ref[1]])&0x00FF00FF)*0x0101;
                                                                                  ^
846.                     ref += h->b8_stride;
847.                     *(uint32_t*)&h->ref_cache[list][scan8[ 8]] =
