libavformat/rtsp.c:987: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `av_strlcatf`.

libavformat/rtsp.c:895:1: Parameter `buf.strlen`
893. }
894. 
895. int ff_rtsp_read_reply(AVFormatContext *s, RTSPMessageHeader *reply,
     ^
896.                        unsigned char **content_ptr,
897.                        int return_on_interleaved_data, const char *method)

libavformat/rtsp.c:987:17: Call
985.                 av_strlcatf(buf, sizeof(buf), "CSeq: %d\r\n", reply->seq);
986.             if (reply->session_id[0])
987.                 av_strlcatf(buf, sizeof(buf), "Session: %s\r\n",
                     ^
988.                                               reply->session_id);
989.         } else {

libavutil/avstring.c:82:1: <LHS trace>
80. }
81. 
82. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
    ^
83. {
84.     int len = strlen(dst);

libavutil/avstring.c:82:1: Parameter `size`
  80. }
  81. 
  82. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
      ^
  83. {
  84.     int len = strlen(dst);

libavutil/avstring.c:88:12: <RHS trace>
86. 
87.     va_start(vl, fmt);
88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
               ^
89.     va_end(vl);
90. 

libavutil/avstring.c:88:12: Risky value from: vsnprintf
  86. 
  87.     va_start(vl, fmt);
  88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                 ^
  89.     va_end(vl);
  90. 

libavutil/avstring.c:88:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `av_strlcatf` 
  86. 
  87.     va_start(vl, fmt);
  88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
          ^
  89.     va_end(vl);
  90. 

size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
{
    int len = strlen(dst);
    va_list vl;
    va_start(vl, fmt);
    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
    va_end(vl);
    return len;
}
['int ff_rtsp_read_reply(AVFormatContext *s, RTSPMessageHeader *reply,\n                       unsigned char **content_ptr,\n                       int return_on_interleaved_data, const char *method)\n{\n    RTSPState *rt = s->priv_data;\n    char buf[4096], buf1[1024], *q;\n    unsigned char ch;\n    const char *p;\n    int ret, content_length, line_count = 0, request = 0;\n    unsigned char *content = NULL;\nstart:\n    line_count = 0;\n    request = 0;\n    content = NULL;\n    memset(reply, 0, sizeof(*reply));\n    rt->last_reply[0] = \'\\0\';\n    for (;;) {\n        q = buf;\n        for (;;) {\n            ret = ffurl_read_complete(rt->rtsp_hd, &ch, 1);\n            av_dlog(s, "ret=%d c=%02x [%c]\\n", ret, ch, ch);\n            if (ret != 1)\n                return AVERROR_EOF;\n            if (ch == \'\\n\')\n                break;\n            if (ch == \'$\') {\n                if (return_on_interleaved_data) {\n                    return 1;\n                } else\n                    ff_rtsp_skip_packet(s);\n            } else if (ch != \'\\r\') {\n                if ((q - buf) < sizeof(buf) - 1)\n                    *q++ = ch;\n            }\n        }\n        *q = \'\\0\';\n        av_dlog(s, "line=\'%s\'\\n", buf);\n        if (buf[0] == \'\\0\')\n            break;\n        p = buf;\n        if (line_count == 0) {\n            get_word(buf1, sizeof(buf1), &p);\n            if (!strncmp(buf1, "RTSP/", 5)) {\n                get_word(buf1, sizeof(buf1), &p);\n                reply->status_code = atoi(buf1);\n                av_strlcpy(reply->reason, p, sizeof(reply->reason));\n            } else {\n                av_strlcpy(reply->reason, buf1, sizeof(reply->reason));\n                get_word(buf1, sizeof(buf1), &p);\n                request = 1;\n            }\n        } else {\n            ff_rtsp_parse_line(reply, p, rt, method);\n            av_strlcat(rt->last_reply, p,    sizeof(rt->last_reply));\n            av_strlcat(rt->last_reply, "\\n", sizeof(rt->last_reply));\n        }\n        line_count++;\n    }\n    if (rt->session_id[0] == \'\\0\' && reply->session_id[0] != \'\\0\' && !request)\n        av_strlcpy(rt->session_id, reply->session_id, sizeof(rt->session_id));\n    content_length = reply->content_length;\n    if (content_length > 0) {\n        content = av_malloc(content_length + 1);\n        ffurl_read_complete(rt->rtsp_hd, content, content_length);\n        content[content_length] = \'\\0\';\n    }\n    if (content_ptr)\n        *content_ptr = content;\n    else\n        av_free(content);\n    if (request) {\n        char buf[1024];\n        char base64buf[AV_BASE64_SIZE(sizeof(buf))];\n        const char* ptr = buf;\n        if (!strcmp(reply->reason, "OPTIONS")) {\n            snprintf(buf, sizeof(buf), "RTSP/1.0 200 OK\\r\\n");\n            if (reply->seq)\n                av_strlcatf(buf, sizeof(buf), "CSeq: %d\\r\\n", reply->seq);\n            if (reply->session_id[0])\n                av_strlcatf(buf, sizeof(buf), "Session: %s\\r\\n",\n                                              reply->session_id);\n        } else {\n            snprintf(buf, sizeof(buf), "RTSP/1.0 501 Not Implemented\\r\\n");\n        }\n        av_strlcat(buf, "\\r\\n", sizeof(buf));\n        if (rt->control_transport == RTSP_MODE_TUNNEL) {\n            av_base64_encode(base64buf, sizeof(base64buf), buf, strlen(buf));\n            ptr = base64buf;\n        }\n        ffurl_write(rt->rtsp_hd_out, ptr, strlen(ptr));\n        rt->last_cmd_time = av_gettime();\n        if (content_ptr)\n            av_freep(content_ptr);\n        if (method)\n            goto start;\n        return 0;\n    }\n    if (rt->seq != reply->seq) {\n        av_log(s, AV_LOG_WARNING, "CSeq %d expected, %d received.\\n",\n            rt->seq, reply->seq);\n    }\n    if (reply->notice == 2101        ||\n        reply->notice == 2104      ||\n        reply->notice == 2306  ) {\n        rt->state = RTSP_STATE_IDLE;\n    } else if (reply->notice >= 4400 && reply->notice < 5500) {\n        return AVERROR(EIO);\n    } else if (reply->notice == 2401   ||\n             (reply->notice >= 5500 && reply->notice < 5600)   )\n        return AVERROR(EPERM);\n    return 0;\n}', 'size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)\n{\n    int len = strlen(dst);\n    va_list vl;\n    va_start(vl, fmt);\n    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);\n    va_end(vl);\n    return len;\n}']