libavformat/http.c:292: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `av_strlcatf`.

libavformat/http.c:273:5: Array declaration
271.     int post, err;
272.     char line[1024];
273.     char headers[1024] = "";
         ^
274.     char *authstr = NULL;
275.     int64_t off = s->off;

libavformat/http.c:292:16: Call
290.                           sizeof(headers) - len);
291.     if (!has_header(s->headers, "\r\nRange: "))
292.         len += av_strlcatf(headers + len, sizeof(headers) - len,
                    ^
293.                            "Range: bytes=%"PRId64"-\r\n", s->off);
294.     if (!has_header(s->headers, "\r\nConnection: "))

libavutil/avstring.c:82:1: <LHS trace>
80. }
81. 
82. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
    ^
83. {
84.     int len = strlen(dst);

libavutil/avstring.c:82:1: Parameter `size`
  80. }
  81. 
  82. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
      ^
  83. {
  84.     int len = strlen(dst);

libavutil/avstring.c:88:12: <RHS trace>
86. 
87.     va_start(vl, fmt);
88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
               ^
89.     va_end(vl);
90. 

libavutil/avstring.c:88:12: Risky value from: vsnprintf
  86. 
  87.     va_start(vl, fmt);
  88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                 ^
  89.     va_end(vl);
  90. 

libavutil/avstring.c:88:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `av_strlcatf` 
  86. 
  87.     va_start(vl, fmt);
  88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
          ^
  89.     va_end(vl);
  90. 

size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
{
    int len = strlen(dst);
    va_list vl;
    va_start(vl, fmt);
    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
    va_end(vl);
    return len;
}
['static int http_connect(URLContext *h, const char *path, const char *hoststr,\n                        const char *auth, int *new_location)\n{\n    HTTPContext *s = h->priv_data;\n    int post, err;\n    char line[1024];\n    char headers[1024] = "";\n    char *authstr = NULL;\n    int64_t off = s->off;\n    int len = 0;\n    post = h->flags & URL_WRONLY;\n    authstr = ff_http_auth_create_response(&s->auth_state, auth, path,\n                                        post ? "POST" : "GET");\n    if (!has_header(s->headers, "\\r\\nUser-Agent: "))\n       len += av_strlcatf(headers + len, sizeof(headers) - len,\n                          "User-Agent: %s\\r\\n", LIBAVFORMAT_IDENT);\n    if (!has_header(s->headers, "\\r\\nAccept: "))\n        len += av_strlcpy(headers + len, "Accept: */*\\r\\n",\n                          sizeof(headers) - len);\n    if (!has_header(s->headers, "\\r\\nRange: "))\n        len += av_strlcatf(headers + len, sizeof(headers) - len,\n                           "Range: bytes=%"PRId64"-\\r\\n", s->off);\n    if (!has_header(s->headers, "\\r\\nConnection: "))\n        len += av_strlcpy(headers + len, "Connection: close\\r\\n",\n                          sizeof(headers)-len);\n    if (!has_header(s->headers, "\\r\\nHost: "))\n        len += av_strlcatf(headers + len, sizeof(headers) - len,\n                           "Host: %s\\r\\n", hoststr);\n    av_strlcpy(headers+len, s->headers, sizeof(headers)-len);\n    snprintf(s->buffer, sizeof(s->buffer),\n             "%s %s HTTP/1.1\\r\\n"\n             "%s"\n             "%s"\n             "%s"\n             "\\r\\n",\n             post ? "POST" : "GET",\n             path,\n             post ? "Transfer-Encoding: chunked\\r\\n" : "",\n             headers,\n             authstr ? authstr : "");\n    av_freep(&authstr);\n    if (http_write(h, s->buffer, strlen(s->buffer)) < 0)\n        return AVERROR(EIO);\n    s->buf_ptr = s->buffer;\n    s->buf_end = s->buffer;\n    s->line_count = 0;\n    s->off = 0;\n    s->filesize = -1;\n    if (post) {\n        s->chunksize = 0;\n        s->http_code = 200;\n        return 0;\n    }\n    for(;;) {\n        if (http_get_line(s, line, sizeof(line)) < 0)\n            return AVERROR(EIO);\n        dprintf(NULL, "header=\'%s\'\\n", line);\n        err = process_line(h, line, s->line_count, new_location);\n        if (err < 0)\n            return err;\n        if (err == 0)\n            break;\n        s->line_count++;\n    }\n    return (off == s->off) ? 0 : -1;\n}', 'size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)\n{\n    int len = strlen(dst);\n    va_list vl;\n    va_start(vl, fmt);\n    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);\n    va_end(vl);\n    return len;\n}']