libavformat/mov.c:306: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `mov_metadata_loci`.

libavformat/mov.c:306:16: Call
304.     case MKTAG( 'l','d','e','s'): key = "synopsis";  break;
305.     case MKTAG( 'l','o','c','i'):
306.         return mov_metadata_loci(c, pb, atom.size);
                    ^
307.     case MKTAG( 'p','c','s','t'): key = "podcast";
308.         parse = mov_metadata_int8_no_padding; break;

libavformat/mov.c:221:1: Parameter `buf.strlen`
  219. 
  220. // 3GPP TS 26.244
  221. static int mov_metadata_loci(MOVContext *c, AVIOContext *pb, unsigned len)
       ^
  222. {
  223.     char language[4] = { 0 };

libavformat/mov.c:259:9: Call
  257.     snprintf(buf, sizeof(buf), "%+08.4f%+09.4f",  latitude, longitude);
  258.     if (altitude)
  259.         av_strlcatf(buf, sizeof(buf), "%+f", altitude);
               ^
  260.     av_strlcatf(buf, sizeof(buf), "/%s", place);
  261. 

libavutil/avstring.c:99:1: <LHS trace>
 97. }
 98. 
 99. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
     ^
100. {
101.     int len = strlen(dst);

libavutil/avstring.c:99:1: Parameter `size`
     97. }
     98. 
     99. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
         ^
    100. {
    101.     int len = strlen(dst);

libavutil/avstring.c:105:12: <RHS trace>
103. 
104.     va_start(vl, fmt);
105.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                ^
106.     va_end(vl);
107. 

libavutil/avstring.c:105:12: Risky value from: vsnprintf
    103. 
    104.     va_start(vl, fmt);
    105.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                    ^
    106.     va_end(vl);
    107. 

libavutil/avstring.c:105:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `mov_metadata_loci` 
    103. 
    104.     va_start(vl, fmt);
    105.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
             ^
    106.     va_end(vl);
    107. 

size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
{
    int len = strlen(dst);
    va_list vl;
    va_start(vl, fmt);
    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
    va_end(vl);
    return len;
}
['static int mov_read_udta_string(MOVContext *c, AVIOContext *pb, MOVAtom atom)\n{\n    char tmp_key[5];\n    char *str, key2[32], language[4] = {0};\n    const char *key = NULL;\n    uint16_t langcode = 0;\n    uint32_t data_type = 0, str_size, str_size_alloc;\n    int (*parse)(MOVContext*, AVIOContext*, unsigned, const char*) = NULL;\n    int raw = 0;\n    switch (atom.type) {\n    case MKTAG( \'@\',\'P\',\'R\',\'M\'): key = "premiere_version"; raw = 1; break;\n    case MKTAG( \'@\',\'P\',\'R\',\'Q\'): key = "quicktime_version"; raw = 1; break;\n    case MKTAG( \'X\',\'M\',\'P\',\'_\'):\n        if (c->export_xmp) { key = "xmp"; raw = 1; } break;\n    case MKTAG( \'a\',\'A\',\'R\',\'T\'): key = "album_artist";    break;\n    case MKTAG( \'a\',\'k\',\'I\',\'D\'): key = "account_type";\n        parse = mov_metadata_int8_no_padding; break;\n    case MKTAG( \'a\',\'p\',\'I\',\'D\'): key = "account_id"; break;\n    case MKTAG( \'c\',\'a\',\'t\',\'g\'): key = "category"; break;\n    case MKTAG( \'c\',\'p\',\'i\',\'l\'): key = "compilation";\n        parse = mov_metadata_int8_no_padding; break;\n    case MKTAG( \'c\',\'p\',\'r\',\'t\'): key = "copyright"; break;\n    case MKTAG( \'d\',\'e\',\'s\',\'c\'): key = "description"; break;\n    case MKTAG( \'d\',\'i\',\'s\',\'k\'): key = "disc";\n        parse = mov_metadata_track_or_disc_number; break;\n    case MKTAG( \'e\',\'g\',\'i\',\'d\'): key = "episode_uid";\n        parse = mov_metadata_int8_no_padding; break;\n    case MKTAG( \'g\',\'n\',\'r\',\'e\'): key = "genre";\n        parse = mov_metadata_gnre; break;\n    case MKTAG( \'h\',\'d\',\'v\',\'d\'): key = "hd_video";\n        parse = mov_metadata_int8_no_padding; break;\n    case MKTAG( \'k\',\'e\',\'y\',\'w\'): key = "keywords";  break;\n    case MKTAG( \'l\',\'d\',\'e\',\'s\'): key = "synopsis";  break;\n    case MKTAG( \'l\',\'o\',\'c\',\'i\'):\n        return mov_metadata_loci(c, pb, atom.size);\n    case MKTAG( \'p\',\'c\',\'s\',\'t\'): key = "podcast";\n        parse = mov_metadata_int8_no_padding; break;\n    case MKTAG( \'p\',\'g\',\'a\',\'p\'): key = "gapless_playback";\n        parse = mov_metadata_int8_no_padding; break;\n    case MKTAG( \'p\',\'u\',\'r\',\'d\'): key = "purchase_date"; break;\n    case MKTAG( \'r\',\'t\',\'n\',\'g\'): key = "rating";\n        parse = mov_metadata_int8_no_padding; break;\n    case MKTAG( \'s\',\'o\',\'a\',\'a\'): key = "sort_album_artist"; break;\n    case MKTAG( \'s\',\'o\',\'a\',\'l\'): key = "sort_album";   break;\n    case MKTAG( \'s\',\'o\',\'a\',\'r\'): key = "sort_artist";  break;\n    case MKTAG( \'s\',\'o\',\'c\',\'o\'): key = "sort_composer"; break;\n    case MKTAG( \'s\',\'o\',\'n\',\'m\'): key = "sort_name";    break;\n    case MKTAG( \'s\',\'o\',\'s\',\'n\'): key = "sort_show";    break;\n    case MKTAG( \'s\',\'t\',\'i\',\'k\'): key = "media_type";\n        parse = mov_metadata_int8_no_padding; break;\n    case MKTAG( \'t\',\'r\',\'k\',\'n\'): key = "track";\n        parse = mov_metadata_track_or_disc_number; break;\n    case MKTAG( \'t\',\'v\',\'e\',\'n\'): key = "episode_id"; break;\n    case MKTAG( \'t\',\'v\',\'e\',\'s\'): key = "episode_sort";\n        parse = mov_metadata_int8_bypass_padding; break;\n    case MKTAG( \'t\',\'v\',\'n\',\'n\'): key = "network";   break;\n    case MKTAG( \'t\',\'v\',\'s\',\'h\'): key = "show";      break;\n    case MKTAG( \'t\',\'v\',\'s\',\'n\'): key = "season_number";\n        parse = mov_metadata_int8_bypass_padding; break;\n    case MKTAG(0xa9,\'A\',\'R\',\'T\'): key = "artist";    break;\n    case MKTAG(0xa9,\'P\',\'R\',\'D\'): key = "producer";  break;\n    case MKTAG(0xa9,\'a\',\'l\',\'b\'): key = "album";     break;\n    case MKTAG(0xa9,\'a\',\'u\',\'t\'): key = "artist";    break;\n    case MKTAG(0xa9,\'c\',\'h\',\'p\'): key = "chapter";   break;\n    case MKTAG(0xa9,\'c\',\'m\',\'t\'): key = "comment";   break;\n    case MKTAG(0xa9,\'c\',\'o\',\'m\'): key = "composer";  break;\n    case MKTAG(0xa9,\'c\',\'p\',\'y\'): key = "copyright"; break;\n    case MKTAG(0xa9,\'d\',\'a\',\'y\'): key = "date";      break;\n    case MKTAG(0xa9,\'d\',\'i\',\'r\'): key = "director";  break;\n    case MKTAG(0xa9,\'d\',\'i\',\'s\'): key = "disclaimer"; break;\n    case MKTAG(0xa9,\'e\',\'d\',\'1\'): key = "edit_date"; break;\n    case MKTAG(0xa9,\'e\',\'n\',\'c\'): key = "encoder";   break;\n    case MKTAG(0xa9,\'f\',\'m\',\'t\'): key = "original_format"; break;\n    case MKTAG(0xa9,\'g\',\'e\',\'n\'): key = "genre";     break;\n    case MKTAG(0xa9,\'g\',\'r\',\'p\'): key = "grouping";  break;\n    case MKTAG(0xa9,\'h\',\'s\',\'t\'): key = "host_computer"; break;\n    case MKTAG(0xa9,\'i\',\'n\',\'f\'): key = "comment";   break;\n    case MKTAG(0xa9,\'l\',\'y\',\'r\'): key = "lyrics";    break;\n    case MKTAG(0xa9,\'m\',\'a\',\'k\'): key = "make";      break;\n    case MKTAG(0xa9,\'m\',\'o\',\'d\'): key = "model";     break;\n    case MKTAG(0xa9,\'n\',\'a\',\'m\'): key = "title";     break;\n    case MKTAG(0xa9,\'o\',\'p\',\'e\'): key = "original_artist"; break;\n    case MKTAG(0xa9,\'p\',\'r\',\'d\'): key = "producer";  break;\n    case MKTAG(0xa9,\'p\',\'r\',\'f\'): key = "performers"; break;\n    case MKTAG(0xa9,\'r\',\'e\',\'q\'): key = "playback_requirements"; break;\n    case MKTAG(0xa9,\'s\',\'r\',\'c\'): key = "original_source"; break;\n    case MKTAG(0xa9,\'s\',\'t\',\'3\'): key = "subtitle";  break;\n    case MKTAG(0xa9,\'s\',\'w\',\'r\'): key = "encoder";   break;\n    case MKTAG(0xa9,\'t\',\'o\',\'o\'): key = "encoder";   break;\n    case MKTAG(0xa9,\'t\',\'r\',\'k\'): key = "track";     break;\n    case MKTAG(0xa9,\'u\',\'r\',\'l\'): key = "URL";       break;\n    case MKTAG(0xa9,\'w\',\'r\',\'n\'): key = "warning";   break;\n    case MKTAG(0xa9,\'w\',\'r\',\'t\'): key = "composer";  break;\n    case MKTAG(0xa9,\'x\',\'y\',\'z\'): key = "location";  break;\n    }\n    if (c->itunes_metadata && atom.size > 8) {\n        int data_size = avio_rb32(pb);\n        int tag = avio_rl32(pb);\n        if (tag == MKTAG(\'d\',\'a\',\'t\',\'a\')) {\n            data_type = avio_rb32(pb);\n            avio_rb32(pb);\n            str_size = data_size - 16;\n            atom.size -= 16;\n            if (atom.type == MKTAG(\'c\', \'o\', \'v\', \'r\')) {\n                int ret = mov_read_covr(c, pb, data_type, str_size);\n                if (ret < 0) {\n                    av_log(c->fc, AV_LOG_ERROR, "Error parsing cover art.\\n");\n                    return ret;\n                }\n            }\n        } else return 0;\n    } else if (atom.size > 4 && key && !c->itunes_metadata && !raw) {\n        str_size = avio_rb16(pb);\n        langcode = avio_rb16(pb);\n        ff_mov_lang_to_iso639(langcode, language);\n        atom.size -= 4;\n    } else\n        str_size = atom.size;\n    if (c->export_all && !key) {\n        snprintf(tmp_key, 5, "%.4s", (char*)&atom.type);\n        key = tmp_key;\n    }\n    if (!key)\n        return 0;\n    if (atom.size < 0)\n        return AVERROR_INVALIDDATA;\n    str_size_alloc = (raw ? str_size : str_size * 2) + 1;\n    str = av_malloc(str_size_alloc);\n    if (!str)\n        return AVERROR(ENOMEM);\n    if (parse)\n        parse(c, pb, str_size, key);\n    else {\n        if (!raw && (data_type == 3 || (data_type == 0 && (langcode < 0x400 || langcode == 0x7fff)))) {\n            mov_read_mac_string(c, pb, str_size, str, str_size_alloc);\n        } else {\n            int ret = ffio_read_size(pb, str, str_size);\n            if (ret < 0) {\n                av_free(str);\n                return ret;\n            }\n            str[str_size] = 0;\n        }\n        c->fc->event_flags |= AVFMT_EVENT_FLAG_METADATA_UPDATED;\n        av_dict_set(&c->fc->metadata, key, str, 0);\n        if (*language && strcmp(language, "und")) {\n            snprintf(key2, sizeof(key2), "%s-%s", key, language);\n            av_dict_set(&c->fc->metadata, key2, str, 0);\n        }\n    }\n    av_log(c->fc, AV_LOG_TRACE, "lang \\"%3s\\" ", language);\n    av_log(c->fc, AV_LOG_TRACE, "tag \\"%s\\" value \\"%s\\" atom \\"%.4s\\" %d %"PRId64"\\n",\n            key, str, (char*)&atom.type, str_size_alloc, atom.size);\n    av_freep(&str);\n    return 0;\n}', 'static int mov_metadata_loci(MOVContext *c, AVIOContext *pb, unsigned len)\n{\n    char language[4] = { 0 };\n    char buf[200], place[100];\n    uint16_t langcode = 0;\n    double longitude, latitude, altitude;\n    const char *key = "location";\n    if (len < 4 + 2 + 1 + 1 + 4 + 4 + 4) {\n        av_log(c->fc, AV_LOG_ERROR, "loci too short\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    avio_skip(pb, 4);\n    langcode = avio_rb16(pb);\n    ff_mov_lang_to_iso639(langcode, language);\n    len -= 6;\n    len -= avio_get_str(pb, len, place, sizeof(place));\n    if (len < 1) {\n        av_log(c->fc, AV_LOG_ERROR, "place name too long\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    avio_skip(pb, 1);\n    len -= 1;\n    if (len < 12) {\n        av_log(c->fc, AV_LOG_ERROR,\n               "loci too short (%u bytes left, need at least %d)\\n", len, 12);\n        return AVERROR_INVALIDDATA;\n    }\n    longitude = ((int32_t) avio_rb32(pb)) / (float) (1 << 16);\n    latitude  = ((int32_t) avio_rb32(pb)) / (float) (1 << 16);\n    altitude  = ((int32_t) avio_rb32(pb)) / (float) (1 << 16);\n    snprintf(buf, sizeof(buf), "%+08.4f%+09.4f",  latitude, longitude);\n    if (altitude)\n        av_strlcatf(buf, sizeof(buf), "%+f", altitude);\n    av_strlcatf(buf, sizeof(buf), "/%s", place);\n    if (*language && strcmp(language, "und")) {\n        char key2[16];\n        snprintf(key2, sizeof(key2), "%s-%s", key, language);\n        av_dict_set(&c->fc->metadata, key2, buf, 0);\n    }\n    c->fc->event_flags |= AVFMT_EVENT_FLAG_METADATA_UPDATED;\n    return av_dict_set(&c->fc->metadata, key, buf, 0);\n}', 'size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)\n{\n    int len = strlen(dst);\n    va_list vl;\n    va_start(vl, fmt);\n    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);\n    va_end(vl);\n    return len;\n}']