libavcodec/h264_slice.c:1782: error: Buffer Overrun L1
  Offset: [20, 51] Size: 2.

libavcodec/h264_slice.c:1781:14: <Offset trace>
1779.         ref2frm[18 + 0] =
1780.         ref2frm[18 + 1] = -1;
1781.         for (i = 16; i < 48; i++)
                   ^
1782.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
1783.                              (h->ref_list[j][i].reference & 3);

libavcodec/h264_slice.c:1781:14: Assignment
1779.         ref2frm[18 + 0] =
1780.         ref2frm[18 + 1] = -1;
1781.         for (i = 16; i < 48; i++)
                   ^
1782.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
1783.                              (h->ref_list[j][i].reference & 3);

libavcodec/h264_slice.c:1176:1: <Length trace>
1174.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
1175.  */
1176. int ff_h264_decode_slice_header(H264Context *h, H264Context *h0)
      ^
1177. {
1178.     unsigned int first_mb_in_slice;

libavcodec/h264_slice.c:1176:1: Parameter `h->ref2frm[*][*]`
1174.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
1175.  */
1176. int ff_h264_decode_slice_header(H264Context *h, H264Context *h0)
      ^
1177. {
1178.     unsigned int first_mb_in_slice;

libavcodec/h264_slice.c:1755:9: Assignment
1753.     for (j = 0; j < 2; j++) {
1754.         int id_list[16];
1755.         int *ref2frm = h->ref2frm[h->slice_num & (MAX_SLICES - 1)][j];
              ^
1756.         for (i = 0; i < 16; i++) {
1757.             id_list[i] = 60;

libavcodec/h264_slice.c:1782:13: Array access: Offset: [20, 51] Size: 2
1780.         ref2frm[18 + 1] = -1;
1781.         for (i = 16; i < 48; i++)
1782.             ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] +
                  ^
1783.                              (h->ref_list[j][i].reference & 3);
1784.     }
