libavcodec/h264_slice.c:1728: error: Buffer Overrun L1
  Offset: [20, 51] Size: 2.

libavcodec/h264_slice.c:1727:14: <Offset trace>
1725.         ref2frm[18 + 0] =
1726.         ref2frm[18 + 1] = -1;
1727.         for (i = 16; i < 48; i++)
                   ^
1728.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
1729.                              (sl->ref_list[j][i].reference & 3);

libavcodec/h264_slice.c:1727:14: Assignment
1725.         ref2frm[18 + 0] =
1726.         ref2frm[18 + 1] = -1;
1727.         for (i = 16; i < 48; i++)
                   ^
1728.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
1729.                              (sl->ref_list[j][i].reference & 3);

libavcodec/h264_slice.c:1577:1: <Length trace>
1575.  * @return 0 if okay, <0 if an error occurred
1576.  */
1577. int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl,
      ^
1578.                                 const H2645NAL *nal)
1579. {

libavcodec/h264_slice.c:1577:1: Parameter `h->ref2frm[*][*]`
1575.  * @return 0 if okay, <0 if an error occurred
1576.  */
1577. int ff_h264_decode_slice_header(H264Context *h, H264SliceContext *sl,
      ^
1578.                                 const H2645NAL *nal)
1579. {

libavcodec/h264_slice.c:1701:9: Assignment
1699.     for (j = 0; j < 2; j++) {
1700.         int id_list[16];
1701.         int *ref2frm = h->ref2frm[sl->slice_num & (MAX_SLICES - 1)][j];
              ^
1702.         for (i = 0; i < 16; i++) {
1703.             id_list[i] = 60;

libavcodec/h264_slice.c:1728:13: Array access: Offset: [20, 51] Size: 2
1726.         ref2frm[18 + 1] = -1;
1727.         for (i = 16; i < 48; i++)
1728.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
                  ^
1729.                              (sl->ref_list[j][i].reference & 3);
1730.     }
