libavcodec/h264.c:3863: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `decode_slice_header`.

libavcodec/h264.c:3712:1: Parameter `h->s.list_count`
3710. }
3711. 
3712. static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size,
      ^
3713.                             int parse_extradata)
3714. {

libavcodec/h264.c:3863:28: Call
3861.                 hx->s.data_partitioning = 0;
3862. 
3863.                 if ((err = decode_slice_header(hx, h)))
                                 ^
3864.                     break;
3865. 

libavcodec/h264.c:2402:1: Parameter `h->s.list_count`
  2400.  * @return 0 if okay, <0 if an error occurred, 1 if decoding must not be multithreaded
  2401.  */
  2402. static int decode_slice_header(H264Context *h, H264Context *h0)
        ^
  2403. {
  2404.     MpegEncContext *const s  = &h->s;

libavcodec/h264.c:2427:13: Call
  2425.     if (first_mb_in_slice == 0) { // FIXME better field boundary detection
  2426.         if (h0->current_slice && FIELD_PICTURE) {
  2427.             field_end(h, 1);
                    ^
  2428.         }
  2429. 

libavcodec/h264.c:2234:1: Parameter `h->s.list_count`
    2232. }
    2233. 
    2234. static int field_end(H264Context *h, int in_setup)
          ^
    2235. {
    2236.     MpegEncContext *const s     = &h->s;

libavcodec/h264.c:2283:9: Call
    2281.      */
    2282.     if (!FIELD_PICTURE)
    2283.         ff_er_frame_end(s);
                  ^
    2284. 
    2285.     ff_MPV_frame_end(s);

libavcodec/error_resilience.c:878:1: Parameter `s->list_count`
      876. }
      877. 
      878. void ff_er_frame_end(MpegEncContext *s)
           ^
      879. {
      880.     int i, mb_x, mb_y, error, error_type, dc_error, mv_error, ac_error;

libavcodec/error_resilience.c:1056:23: Call
      1054.            dc_error, ac_error, mv_error);
      1055. 
      1056.     is_intra_likely = is_intra_more_likely(s);
                                  ^
      1057. 
      1058.     /* set unknown mb-type to most likely */

libavcodec/error_resilience.c:715:1: Parameter `s->list_count`
        713. }
        714. 
        715. static int is_intra_more_likely(MpegEncContext *s)
             ^
        716. {
        717.     int is_intra_likely, i, j, undamaged_count, skip_amount, mb_x, mb_y;

libavcodec/error_resilience.c:1121:13: Call
      1119.             s->mb_x = mb_x;
      1120.             s->mb_y = mb_y;
      1121.             decode_mb(s, 0 /* FIXME h264 partitioned slices need this set */);
                        ^
      1122.         }
      1123.     }

libavcodec/error_resilience.c:43:1: Parameter `s->list_count`
        41. #undef mb_intra
        42. 
        43. static void decode_mb(MpegEncContext *s, int ref)
            ^
        44. {
        45.     s->dest[0] = s->current_picture.f.data[0] + (s->mb_y *  16                       * s->linesize)   + s->mb_x *  16;

libavcodec/error_resilience.c:66:9: Call
        64.                        pack16to32(s->mv[0][0][0], s->mv[0][0][1]), 4);
        65.         assert(!FRAME_MBAFF);
        66.         ff_h264_hl_decode_mb(h);
                    ^
        67.     } else {
        68.         assert(ref == 0);

libavcodec/h264.c:1935:1: Parameter `h->list_count`
          1933. #include "h264_mb_template.c"
          1934. 
          1935. void ff_h264_hl_decode_mb(H264Context *h)
                ^
          1936. {
          1937.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:1944:13: Call
          1942.     if (CHROMA444) {
          1943.         if (is_complex || h->pixel_shift)
          1944.             hl_decode_mb_444_complex(h);
                            ^
          1945.         else
          1946.             hl_decode_mb_444_simple_8(h);

libavcodec/h264_mb_template.c:278:1: Parameter `h->list_count`
            276. #include "h264_mc_template.c"
            277. 
            278. static av_noinline void FUNC(hl_decode_mb_444)(H264Context *h)
                 ^
            279. {
            280.     MpegEncContext *const s = &h->s;

libavcodec/h264_mb_template.c:362:13: Call
            360.                                linesize, 0, 1, SIMPLE, PIXEL_SHIFT);
            361.         } else {
            362.             FUNC(hl_motion_444)(h, dest[0], dest[1], dest[2],
                             ^
            363.                       s->me.qpel_put, s->dsp.put_h264_chroma_pixels_tab,
            364.                       s->me.qpel_avg, s->dsp.avg_h264_chroma_pixels_tab,

libavcodec/h264_mc_template.c:61:1: Parameter `h->list_count`
              59. }
              60. 
              61. static void MCFUNC(hl_motion)(H264Context *h, uint8_t *dest_y,
                  ^
              62.                               uint8_t *dest_cb, uint8_t *dest_cr,
              63.                               qpel_mc_func(*qpix_put)[16],

libavcodec/h264_mc_template.c:77:9: Call
              75. 
              76.     if (HAVE_THREADS && (s->avctx->active_thread_type & FF_THREAD_FRAME))
              77.         await_references(h);
                          ^
              78.     prefetch_motion(h, 0, PIXEL_SHIFT, CHROMA_IDC);
              79. 

libavcodec/h264.c:345:1: <LHS trace>
343.  * @param h the H264 context
344.  */
345. static void await_references(H264Context *h)
     ^
346. {
347.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:345:1: Parameter `h->list_count`
                343.  * @param h the H264 context
                344.  */
                345. static void await_references(H264Context *h)
                     ^
                346. {
                347.     MpegEncContext *const s = &h->s;

libavcodec/h264.c:416:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `decode_slice_header` 
                414.     }
                415. 
                416.     for (list = h->list_count - 1; list >= 0; list--)
                              ^
                417.         for (ref = 0; ref < 48 && nrefs[list]; ref++) {
                418.             int row = refs[list][ref];
