libavcodec/h264_cavlc.c:1027: error: Buffer Overrun L1
  Offset: -1 Size: 2 by call to `decode_luma_residual`.

libavcodec/h264_cavlc.c:1027:20: Call
1025.         h->chroma_qp[1]= get_chroma_qp(h, 1, s->qscale);
1026. 
1027.         if( (ret = decode_luma_residual(h, gb, scan, scan8x8, pixel_shift, mb_type, cbp, 0)) < 0 ){
                         ^
1028.             return -1;
1029.         }

libavcodec/h264_cavlc.c:540:1: <Offset trace>
538. }
539. 
540. static av_always_inline int decode_luma_residual(H264Context *h, GetBitContext *gb, const uint8_t *scan, const uint8_t *scan8x8, int pixel_shift, int mb_type, int cbp, int p){
     ^
541.     int i4x4, i8x8;
542.     MpegEncContext * const s = &h->s;

libavcodec/h264_cavlc.c:540:1: Parameter `p`
  538. }
  539. 
  540. static av_always_inline int decode_luma_residual(H264Context *h, GetBitContext *gb, const uint8_t *scan, const uint8_t *scan8x8, int pixel_shift, int mb_type, int cbp, int p){
       ^
  541.     int i4x4, i8x8;
  542.     MpegEncContext * const s = &h->s;

libavcodec/h264_cavlc.c:540:1: <Length trace>
538. }
539. 
540. static av_always_inline int decode_luma_residual(H264Context *h, GetBitContext *gb, const uint8_t *scan, const uint8_t *scan8x8, int pixel_shift, int mb_type, int cbp, int p){
     ^
541.     int i4x4, i8x8;
542.     MpegEncContext * const s = &h->s;

libavcodec/h264_cavlc.c:540:1: Parameter `h->chroma_qp[*]`
  538. }
  539. 
  540. static av_always_inline int decode_luma_residual(H264Context *h, GetBitContext *gb, const uint8_t *scan, const uint8_t *scan8x8, int pixel_shift, int mb_type, int cbp, int p){
       ^
  541.     int i4x4, i8x8;
  542.     MpegEncContext * const s = &h->s;

libavcodec/h264_cavlc.c:543:39: Array access: Offset: -1 Size: 2 by call to `decode_luma_residual` 
  541.     int i4x4, i8x8;
  542.     MpegEncContext * const s = &h->s;
  543.     int qscale = p == 0 ? s->qscale : h->chroma_qp[p-1];
                                             ^
  544.     if(IS_INTRA16x16(mb_type)){
  545.         AV_ZERO128(h->mb_luma_dc[p]+0);
