libavcodec/h264.c:3772: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `decode_slice_header`.

libavcodec/h264.c:3636:1: Parameter `h->s.list_count`
3634. }
3635. 
3636. static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size)
      ^
3637. {
3638.     MpegEncContext *const s     = &h->s;

libavcodec/h264.c:3772:28: Call
3770.                 hx->s.data_partitioning = 0;
3771. 
3772.                 if ((err = decode_slice_header(hx, h)))
                                 ^
3773.                     break;
3774. 

libavcodec/h264.c:2347:1: Parameter `h->s.list_count`
  2345.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
  2346.  */
  2347. static int decode_slice_header(H264Context *h, H264Context *h0)
        ^
  2348. {
  2349.     MpegEncContext *const s  = &h->s;

libavcodec/h264.c:2372:13: Call
  2370.     if (first_mb_in_slice == 0) { // FIXME better field boundary detection
  2371.         if (h0->current_slice && FIELD_PICTURE) {
  2372.             field_end(h, 1);
                    ^
  2373.         }
  2374. 

libavcodec/h264.c:2225:1: Parameter `h->s.list_count`
    2223. }
    2224. 
    2225. static int field_end(H264Context *h, int in_setup)
          ^
    2226. {
    2227.     MpegEncContext *const s     = &h->s;

libavcodec/h264.c:2274:9: Call
    2272.      */
    2273.     if (!FIELD_PICTURE)
    2274.         ff_er_frame_end(s);
                  ^
    2275. 
    2276.     ff_MPV_frame_end(s);

libavcodec/error_resilience.c:882:1: Parameter `s->list_count`
      880. }
      881. 
      882. void ff_er_frame_end(MpegEncContext *s)
           ^
      883. {
      884.     int i, mb_x, mb_y, error, error_type, dc_error, mv_error, ac_error;

libavcodec/error_resilience.c:1060:23: Call
      1058.            dc_error, ac_error, mv_error);
      1059. 
      1060.     is_intra_likely = is_intra_more_likely(s);
                                  ^
      1061. 
      1062.     /* set unknown mb-type to most likely */

libavcodec/error_resilience.c:718:1: Parameter `s->list_count`
        716. }
        717. 
        718. static int is_intra_more_likely(MpegEncContext *s)
             ^
        719. {
        720.     int is_intra_likely, i, j, undamaged_count, skip_amount, mb_x, mb_y;

libavcodec/error_resilience.c:1125:13: Call
      1123.             s->mb_x = mb_x;
      1124.             s->mb_y = mb_y;
      1125.             decode_mb(s, 0 /* FIXME h264 partitioned slices need this set */);
                        ^
      1126.         }
      1127.     }

libavcodec/error_resilience.c:43:1: Parameter `s->list_count`
        41. #undef mb_intra
        42. 
        43. static void decode_mb(MpegEncContext *s, int ref)
            ^
        44. {
        45.     s->dest[0] = s->current_picture.f.data[0] + (s->mb_y *  16                       * s->linesize)   + s->mb_x *  16;

libavcodec/error_resilience.c:66:9: Call
        64.                        pack16to32(s->mv[0][0][0], s->mv[0][0][1]), 4);
        65.         assert(!FRAME_MBAFF);
        66.         ff_h264_hl_decode_mb(h);
                    ^
        67.     } else {
        68.         assert(ref == 0);

libavcodec/h264.c:1925:1: Parameter `h->list_count`
          1923. #include "h264_mb_template.c"
          1924. 
          1925. void ff_h264_hl_decode_mb(H264Context *h)
                ^
          1926. {
          1927.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:1934:13: Call
          1932.     if (CHROMA444) {
          1933.         if (is_complex || h->pixel_shift)
          1934.             hl_decode_mb_444_complex(h);
                            ^
          1935.         else
          1936.             hl_decode_mb_444_simple_8(h);

libavcodec/h264_mb_template.c:278:1: Parameter `h->list_count`
            276. #include "h264_mc_template.c"
            277. 
            278. static av_noinline void FUNC(hl_decode_mb_444)(H264Context *h)
                 ^
            279. {
            280.     MpegEncContext *const s = &h->s;

libavcodec/h264_mb_template.c:362:13: Call
            360.                                linesize, 0, 1, SIMPLE, PIXEL_SHIFT);
            361.         } else {
            362.             FUNC(hl_motion_444)(h, dest[0], dest[1], dest[2],
                             ^
            363.                       s->me.qpel_put, s->dsp.put_h264_chroma_pixels_tab,
            364.                       s->me.qpel_avg, s->dsp.avg_h264_chroma_pixels_tab,

libavcodec/h264_mc_template.c:61:1: Parameter `h->list_count`
              59. }
              60. 
              61. static void MCFUNC(hl_motion)(H264Context *h, uint8_t *dest_y,
                  ^
              62.                               uint8_t *dest_cb, uint8_t *dest_cr,
              63.                               qpel_mc_func(*qpix_put)[16],

libavcodec/h264_mc_template.c:77:9: Call
              75. 
              76.     if (HAVE_THREADS && (s->avctx->active_thread_type & FF_THREAD_FRAME))
              77.         await_references(h);
                          ^
              78.     prefetch_motion(h, 0, PIXEL_SHIFT, CHROMA_IDC);
              79. 

libavcodec/h264.c:338:1: <LHS trace>
336.  * @param h the H264 context
337.  */
338. static void await_references(H264Context *h)
     ^
339. {
340.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:338:1: Parameter `h->list_count`
                336.  * @param h the H264 context
                337.  */
                338. static void await_references(H264Context *h)
                     ^
                339. {
                340.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:409:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `decode_slice_header` 
                407.     }
                408. 
                409.     for (list = h->list_count - 1; list >= 0; list--)
                              ^
                410.         for (ref = 0; ref < 48 && nrefs[list]; ref++) {
                411.             int row = refs[list][ref];
