libavformat/rtsp.c:123: error: Buffer Overrun L3
  Offset: [-1, 0] Size: [0, 2147483631] by call to `av_dict_set`.

libavformat/rtsp.c:115:1: Array declaration
113. 
114. 
115. static AVDictionary *map_to_opts(RTSPState *rt)
     ^
116. {
117.     AVDictionary *opts = NULL;

libavformat/rtsp.c:121:5: Call
119. 
120.     snprintf(buf, sizeof(buf), "%d", rt->buffer_size);
121.     av_dict_set(&opts, "buffer_size", buf, 0);
         ^
122.     snprintf(buf, sizeof(buf), "%d", rt->pkt_size);
123.     av_dict_set(&opts, "pkt_size", buf, 0);

libavutil/dict.c:68:1: Parameter `*value`
  66. }
  67. 
  68. int av_dict_set(AVDictionary **pm, const char *key, const char *value,
      ^
  69.                 int flags)
  70. {

libavutil/dict.c:109:13: Assignment
  107.             m->elems[m->count].key = av_strdup(key);
  108.         if (flags & AV_DICT_DONT_STRDUP_VAL) {
  109.             m->elems[m->count].value = value;
                   ^
  110.         } else if (oldval && flags & AV_DICT_APPEND) {
  111.             int len = strlen(oldval) + strlen(value) + 1;

libavformat/rtsp.c:123:5: Call
121.     av_dict_set(&opts, "buffer_size", buf, 0);
122.     snprintf(buf, sizeof(buf), "%d", rt->pkt_size);
123.     av_dict_set(&opts, "pkt_size", buf, 0);
         ^
124. 
125.     return opts;

libavutil/dict.c:68:1: <Offset trace>
66. }
67. 
68. int av_dict_set(AVDictionary **pm, const char *key, const char *value,
    ^
69.                 int flags)
70. {

libavutil/dict.c:68:1: Parameter `(*pm)->count`
  66. }
  67. 
  68. int av_dict_set(AVDictionary **pm, const char *key, const char *value,
      ^
  69.                 int flags)
  70. {

libavutil/dict.c:72:30: Call
  70. {
  71.     AVDictionary *m = *pm;
  72.     AVDictionaryEntry *tag = av_dict_get(m, key, NULL, flags);
                                   ^
  73.     char *oldval = NULL;
  74.     int allocated = !!m;

libavutil/dict.c:38:1: Parameter `m->count`
    36. }
    37. 
    38. AVDictionaryEntry *av_dict_get(const AVDictionary *m, const char *key,
        ^
    39.                                const AVDictionaryEntry *prev, int flags)
    40. {

libavutil/dict.c:68:1: <Length trace>
66. }
67. 
68. int av_dict_set(AVDictionary **pm, const char *key, const char *value,
    ^
69.                 int flags)
70. {

libavutil/dict.c:68:1: Parameter `*(*pm)->elems`
  66. }
  67. 
  68. int av_dict_set(AVDictionary **pm, const char *key, const char *value,
      ^
  69.                 int flags)
  70. {

libavutil/dict.c:105:13: Array access: Offset: [-1, 0] Size: [0, 2147483631] by call to `av_dict_set` 
  103.     if (value) {
  104.         if (flags & AV_DICT_DONT_STRDUP_KEY)
  105.             m->elems[m->count].key = key;
                   ^
  106.         else
  107.             m->elems[m->count].key = av_strdup(key);

int av_dict_set(AVDictionary **pm, const char *key, const char *value,
                int flags)
{
    AVDictionary *m = *pm;
    AVDictionaryEntry *tag = av_dict_get(m, key, NULL, flags);
    char *oldval = NULL;
    int allocated = !!m;
    if (!m)
        m = *pm = av_mallocz(sizeof(*m));
    if (!m)
        return AVERROR(ENOMEM);
    if (tag) {
        if (flags & AV_DICT_DONT_OVERWRITE) {
            if (flags & AV_DICT_DONT_STRDUP_KEY) av_free(key);
            if (flags & AV_DICT_DONT_STRDUP_VAL) av_free(value);
            return 0;
        }
        if (flags & AV_DICT_APPEND)
            oldval = tag->value;
        else
            av_free(tag->value);
        av_free(tag->key);
        *tag = m->elems[--m->count];
    } else {
        int ret = av_reallocp_array(&m->elems,
                                    m->count + 1, sizeof(*m->elems));
        if (ret < 0) {
            if (allocated)
                av_freep(pm);
            return ret;
        }
    }
    if (value) {
        if (flags & AV_DICT_DONT_STRDUP_KEY)
            m->elems[m->count].key = key;
        else
            m->elems[m->count].key = av_strdup(key);
        if (flags & AV_DICT_DONT_STRDUP_VAL) {
            m->elems[m->count].value = value;
        } else if (oldval && flags & AV_DICT_APPEND) {
            int len = strlen(oldval) + strlen(value) + 1;
            if (!(oldval = av_realloc(oldval, len)))
                return AVERROR(ENOMEM);
            av_strlcat(oldval, value, len);
            m->elems[m->count].value = oldval;
        } else
            m->elems[m->count].value = av_strdup(value);
        m->count++;
    }
    if (!m->count) {
        av_free(m->elems);
        av_freep(pm);
    }
    return 0;
}
['static AVDictionary *map_to_opts(RTSPState *rt)\n{\n    AVDictionary *opts = NULL;\n    char buf[256];\n    snprintf(buf, sizeof(buf), "%d", rt->buffer_size);\n    av_dict_set(&opts, "buffer_size", buf, 0);\n    snprintf(buf, sizeof(buf), "%d", rt->pkt_size);\n    av_dict_set(&opts, "pkt_size", buf, 0);\n    return opts;\n}', 'int av_dict_set(AVDictionary **pm, const char *key, const char *value,\n                int flags)\n{\n    AVDictionary *m = *pm;\n    AVDictionaryEntry *tag = av_dict_get(m, key, NULL, flags);\n    char *oldval = NULL;\n    int allocated = !!m;\n    if (!m)\n        m = *pm = av_mallocz(sizeof(*m));\n    if (!m)\n        return AVERROR(ENOMEM);\n    if (tag) {\n        if (flags & AV_DICT_DONT_OVERWRITE) {\n            if (flags & AV_DICT_DONT_STRDUP_KEY) av_free(key);\n            if (flags & AV_DICT_DONT_STRDUP_VAL) av_free(value);\n            return 0;\n        }\n        if (flags & AV_DICT_APPEND)\n            oldval = tag->value;\n        else\n            av_free(tag->value);\n        av_free(tag->key);\n        *tag = m->elems[--m->count];\n    } else {\n        int ret = av_reallocp_array(&m->elems,\n                                    m->count + 1, sizeof(*m->elems));\n        if (ret < 0) {\n            if (allocated)\n                av_freep(pm);\n            return ret;\n        }\n    }\n    if (value) {\n        if (flags & AV_DICT_DONT_STRDUP_KEY)\n            m->elems[m->count].key = key;\n        else\n            m->elems[m->count].key = av_strdup(key);\n        if (flags & AV_DICT_DONT_STRDUP_VAL) {\n            m->elems[m->count].value = value;\n        } else if (oldval && flags & AV_DICT_APPEND) {\n            int len = strlen(oldval) + strlen(value) + 1;\n            if (!(oldval = av_realloc(oldval, len)))\n                return AVERROR(ENOMEM);\n            av_strlcat(oldval, value, len);\n            m->elems[m->count].value = oldval;\n        } else\n            m->elems[m->count].value = av_strdup(value);\n        m->count++;\n    }\n    if (!m->count) {\n        av_free(m->elems);\n        av_freep(pm);\n    }\n    return 0;\n}', 'AVDictionaryEntry *av_dict_get(const AVDictionary *m, const char *key,\n                               const AVDictionaryEntry *prev, int flags)\n{\n    unsigned int i, j;\n    if (!m)\n        return NULL;\n    if (prev)\n        i = prev - m->elems + 1;\n    else\n        i = 0;\n    for (; i < m->count; i++) {\n        const char *s = m->elems[i].key;\n        if (flags & AV_DICT_MATCH_CASE)\n            for (j = 0; s[j] == key[j] && key[j]; j++)\n                ;\n        else\n            for (j = 0; av_toupper(s[j]) == av_toupper(key[j]) && key[j]; j++)\n                ;\n        if (key[j])\n            continue;\n        if (s[j] && !(flags & AV_DICT_IGNORE_SUFFIX))\n            continue;\n        return &m->elems[i];\n    }\n    return NULL;\n}']