libavcodec/h264_slice.c:1601: error: Buffer Overrun L3
  Offset added: [-82944, +oo] Size: 41472 by call to `ff_h264_fill_default_ref_list`.

libavcodec/h264_slice.c:1174:1: Parameter `h->ref_count[*]`
1172.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
1173.  */
1174. int ff_h264_decode_slice_header(H264Context *h, H264Context *h0)
      ^
1175. {
1176.     unsigned int first_mb_in_slice;

libavcodec/h264_slice.c:1601:9: Call
1599. 
1600.     if (!default_ref_list_done)
1601.         ff_h264_fill_default_ref_list(h);
              ^
1602. 
1603.     if (h->slice_type_nos != AV_PICTURE_TYPE_I) {

libavcodec/h264_refs.c:119:1: <Offset trace>
117. }
118. 
119. int ff_h264_fill_default_ref_list(H264Context *h)
     ^
120. {
121.     int i, len;

libavcodec/h264_refs.c:119:1: Parameter `h->ref_count[*]`
  117. }
  118. 
  119. int ff_h264_fill_default_ref_list(H264Context *h)
       ^
  120. {
  121.     int i, len;

libavcodec/h264_refs.c:119:1: <Length trace>
117. }
118. 
119. int ff_h264_fill_default_ref_list(H264Context *h)
     ^
120. {
121.     int i, len;

libavcodec/h264_refs.c:119:1: Parameter `h->default_ref_list[*][*]`
  117. }
  118. 
  119. int ff_h264_fill_default_ref_list(H264Context *h)
       ^
  120. {
  121.     int i, len;

libavcodec/h264_refs.c:145:17: Array access: Offset added: [-82944, +oo] Size: 41472 by call to `ff_h264_fill_default_ref_list` 
  143. 
  144.             if (len < h->ref_count[list])
  145.                 memset(&h->default_ref_list[list][len], 0, sizeof(H264Picture) * (h->ref_count[list] - len));
                       ^
  146.             lens[list] = len;
  147.         }
