libavformat/rtsp.c:2165: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `ff_rtp_parse_packet`.

libavformat/rtsp.c:2150:11: Call
2148.     }
2149. 
2150.     len = read_packet(s, &rtsp_st, first_queue_st, wait_end);
                ^
2151.     if (len == AVERROR(EAGAIN) && first_queue_st &&
2152.         rt->transport == RTSP_TRANSPORT_RTP) {

libavformat/rtsp.c:2066:13: Call
  2064.         len = udp_read_packet(s, rtsp_st, rt->recvbuf, RECVBUF_SIZE, wait_end);
  2065.         if (len > 0 && (*rtsp_st)->transport_priv && rt->transport == RTSP_TRANSPORT_RTP)
  2066.             ff_rtp_check_and_send_back_rr((*rtsp_st)->transport_priv, (*rtsp_st)->rtp_handle, NULL, len);
                    ^
  2067.         break;
  2068.     case RTSP_LOWER_TRANSPORT_CUSTOM:

libavformat/rtpdec.c:263:1: Parameter `s->statistics.received_prior`
    261. }
    262. 
    263. int ff_rtp_check_and_send_back_rr(RTPDemuxContext *s, URLContext *fd,
         ^
    264.                                   AVIOContext *avio, int count)
    265. {

libavformat/rtsp.c:2165:15: Call
2163.         ret = ff_rdt_parse_packet(rtsp_st->transport_priv, pkt, &rt->recvbuf, len);
2164.     } else if (rt->transport == RTSP_TRANSPORT_RTP) {
2165.         ret = ff_rtp_parse_packet(rtsp_st->transport_priv, pkt, &rt->recvbuf, len);
                    ^
2166.         if (rtsp_st->feedback) {
2167.             AVIOContext *pb = NULL;

libavformat/rtpdec.c:833:1: Parameter `s->srtp.roc`
  831.  * (use buf as NULL to read the next). -1 if no packet (error or no more packet).
  832.  */
  833. int ff_rtp_parse_packet(RTPDemuxContext *s, AVPacket *pkt,
       ^
  834.                         uint8_t **bufptr, int len)
  835. {

libavformat/rtpdec.c:837:38: Call
  835. {
  836.     int rv;
  837.     if (s->srtp_enabled && bufptr && ff_srtp_decrypt(&s->srtp, *bufptr, &len) < 0)
                                            ^
  838.         return -1;
  839.     rv = rtp_parse_one_packet(s, pkt, bufptr, len);

libavformat/srtp.c:126:1: <LHS trace>
124. }
125. 
126. int ff_srtp_decrypt(struct SRTPContext *s, uint8_t *buf, int *lenptr)
     ^
127. {
128.     uint8_t iv[16] = { 0 }, hmac[20];

libavformat/srtp.c:126:1: Parameter `s->roc`
    124. }
    125. 
    126. int ff_srtp_decrypt(struct SRTPContext *s, uint8_t *buf, int *lenptr)
         ^
    127. {
    128.     uint8_t iv[16] = { 0 }, hmac[20];

libavformat/srtp.c:158:13: Assignment
    156.         // RFC 3711 section 3.3.1, appendix A
    157.         seq_largest = s->seq_initialized ? s->seq_largest : seq;
    158.         v = roc = s->roc;
                     ^
    159.         if (seq_largest < 32768) {
    160.             if (seq - seq_largest > 32768)

libavformat/srtp.c:161:17: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ff_rtp_parse_packet` 
    159.         if (seq_largest < 32768) {
    160.             if (seq - seq_largest > 32768)
    161.                 v = roc - 1;
                         ^
    162.         } else {
    163.             if (seq_largest - 32768 > seq)

int ff_srtp_decrypt(struct SRTPContext *s, uint8_t *buf, int *lenptr)
{
    uint8_t iv[16] = { 0 }, hmac[20];
    int len = *lenptr;
    int av_uninit(seq_largest);
    uint32_t ssrc, av_uninit(roc);
    uint64_t index;
    int rtcp, hmac_size;
    if (len < 2)
        return AVERROR_INVALIDDATA;
    rtcp = RTP_PT_IS_RTCP(buf[1]);
    hmac_size = rtcp ? s->rtcp_hmac_size : s->rtp_hmac_size;
    if (len < hmac_size)
        return AVERROR_INVALIDDATA;
    av_hmac_init(s->hmac, rtcp ? s->rtcp_auth : s->rtp_auth, sizeof(s->rtp_auth));
    av_hmac_update(s->hmac, buf, len - hmac_size);
    if (!rtcp) {
        int seq = AV_RB16(buf + 2);
        uint32_t v;
        uint8_t rocbuf[4];
        seq_largest = s->seq_initialized ? s->seq_largest : seq;
        v = roc = s->roc;
        if (seq_largest < 32768) {
            if (seq - seq_largest > 32768)
                v = roc - 1;
        } else {
            if (seq_largest - 32768 > seq)
                v = roc + 1;
        }
        if (v == roc) {
            seq_largest = FFMAX(seq_largest, seq);
        } else if (v == roc + 1) {
            seq_largest = seq;
            roc = v;
        }
        index = seq + (((uint64_t)v) << 16);
        AV_WB32(rocbuf, roc);
        av_hmac_update(s->hmac, rocbuf, 4);
    }
    av_hmac_final(s->hmac, hmac, sizeof(hmac));
    if (memcmp(hmac, buf + len - hmac_size, hmac_size)) {
        av_log(NULL, AV_LOG_WARNING, "HMAC mismatch\n");
        return AVERROR_INVALIDDATA;
    }
    len -= hmac_size;
    *lenptr = len;
    if (len < 12)
        return AVERROR_INVALIDDATA;
    if (rtcp) {
        uint32_t srtcp_index = AV_RB32(buf + len - 4);
        len -= 4;
        *lenptr = len;
        ssrc = AV_RB32(buf + 4);
        index = srtcp_index & 0x7fffffff;
        buf += 8;
        len -= 8;
        if (!(srtcp_index & 0x80000000))
            return 0;
    } else {
        int ext, csrc;
        s->seq_initialized = 1;
        s->seq_largest     = seq_largest;
        s->roc             = roc;
        csrc = buf[0] & 0x0f;
        ext  = buf[0] & 0x10;
        ssrc = AV_RB32(buf + 8);
        buf += 12;
        len -= 12;
        buf += 4 * csrc;
        len -= 4 * csrc;
        if (len < 0)
            return AVERROR_INVALIDDATA;
        if (ext) {
            if (len < 4)
                return AVERROR_INVALIDDATA;
            ext = (AV_RB16(buf + 2) + 1) * 4;
            if (len < ext)
                return AVERROR_INVALIDDATA;
            len -= ext;
            buf += ext;
        }
    }
    create_iv(iv, rtcp ? s->rtcp_salt : s->rtp_salt, index, ssrc);
    av_aes_init(s->aes, rtcp ? s->rtcp_key : s->rtp_key, 128, 0);
    encrypt_counter(s->aes, iv, buf, len);
    return 0;
}
['int ff_rtsp_fetch_packet(AVFormatContext *s, AVPacket *pkt)\n{\n    RTSPState *rt = s->priv_data;\n    int ret, len;\n    RTSPStream *rtsp_st, *first_queue_st = NULL;\n    int64_t wait_end = 0;\n    if (rt->nb_byes == rt->nb_rtsp_streams)\n        return AVERROR_EOF;\n    if (rt->cur_transport_priv) {\n        if (rt->transport == RTSP_TRANSPORT_RDT) {\n            ret = ff_rdt_parse_packet(rt->cur_transport_priv, pkt, NULL, 0);\n        } else if (rt->transport == RTSP_TRANSPORT_RTP) {\n            ret = ff_rtp_parse_packet(rt->cur_transport_priv, pkt, NULL, 0);\n        } else if (CONFIG_RTPDEC && rt->ts) {\n            ret = ff_mpegts_parse_packet(rt->ts, pkt, rt->recvbuf + rt->recvbuf_pos, rt->recvbuf_len - rt->recvbuf_pos);\n            if (ret >= 0) {\n                rt->recvbuf_pos += ret;\n                ret = rt->recvbuf_pos < rt->recvbuf_len;\n            }\n        } else\n            ret = -1;\n        if (ret == 0) {\n            rt->cur_transport_priv = NULL;\n            return 0;\n        } else if (ret == 1) {\n            return 0;\n        } else\n            rt->cur_transport_priv = NULL;\n    }\nredo:\n    if (rt->transport == RTSP_TRANSPORT_RTP) {\n        int i;\n        int64_t first_queue_time = 0;\n        for (i = 0; i < rt->nb_rtsp_streams; i++) {\n            RTPDemuxContext *rtpctx = rt->rtsp_streams[i]->transport_priv;\n            int64_t queue_time;\n            if (!rtpctx)\n                continue;\n            queue_time = ff_rtp_queued_packet_time(rtpctx);\n            if (queue_time && (queue_time - first_queue_time < 0 ||\n                               !first_queue_time)) {\n                first_queue_time = queue_time;\n                first_queue_st   = rt->rtsp_streams[i];\n            }\n        }\n        if (first_queue_time) {\n            wait_end = first_queue_time + s->max_delay;\n        } else {\n            wait_end = 0;\n            first_queue_st = NULL;\n        }\n    }\n    if (!rt->recvbuf) {\n        rt->recvbuf = av_malloc(RECVBUF_SIZE);\n        if (!rt->recvbuf)\n            return AVERROR(ENOMEM);\n    }\n    len = read_packet(s, &rtsp_st, first_queue_st, wait_end);\n    if (len == AVERROR(EAGAIN) && first_queue_st &&\n        rt->transport == RTSP_TRANSPORT_RTP) {\n        av_log(s, AV_LOG_WARNING,\n                "max delay reached. need to consume packet\\n");\n        rtsp_st = first_queue_st;\n        ret = ff_rtp_parse_packet(rtsp_st->transport_priv, pkt, NULL, 0);\n        goto end;\n    }\n    if (len < 0)\n        return len;\n    if (rt->transport == RTSP_TRANSPORT_RDT) {\n        ret = ff_rdt_parse_packet(rtsp_st->transport_priv, pkt, &rt->recvbuf, len);\n    } else if (rt->transport == RTSP_TRANSPORT_RTP) {\n        ret = ff_rtp_parse_packet(rtsp_st->transport_priv, pkt, &rt->recvbuf, len);\n        if (rtsp_st->feedback) {\n            AVIOContext *pb = NULL;\n            if (rt->lower_transport == RTSP_LOWER_TRANSPORT_CUSTOM)\n                pb = s->pb;\n            ff_rtp_send_rtcp_feedback(rtsp_st->transport_priv, rtsp_st->rtp_handle, pb);\n        }\n        if (ret < 0) {\n            RTPDemuxContext *rtpctx = rtsp_st->transport_priv;\n            if (rtpctx->first_rtcp_ntp_time != AV_NOPTS_VALUE) {\n                int i;\n                AVStream *st = NULL;\n                if (rtsp_st->stream_index >= 0)\n                    st = s->streams[rtsp_st->stream_index];\n                for (i = 0; i < rt->nb_rtsp_streams; i++) {\n                    RTPDemuxContext *rtpctx2 = rt->rtsp_streams[i]->transport_priv;\n                    AVStream *st2 = NULL;\n                    if (rt->rtsp_streams[i]->stream_index >= 0)\n                        st2 = s->streams[rt->rtsp_streams[i]->stream_index];\n                    if (rtpctx2 && st && st2 &&\n                        rtpctx2->first_rtcp_ntp_time == AV_NOPTS_VALUE) {\n                        rtpctx2->first_rtcp_ntp_time = rtpctx->first_rtcp_ntp_time;\n                        rtpctx2->rtcp_ts_offset = av_rescale_q(\n                            rtpctx->rtcp_ts_offset, st->time_base,\n                            st2->time_base);\n                    }\n                }\n            }\n            if (ret == -RTCP_BYE) {\n                rt->nb_byes++;\n                av_log(s, AV_LOG_DEBUG, "Received BYE for stream %d (%d/%d)\\n",\n                       rtsp_st->stream_index, rt->nb_byes, rt->nb_rtsp_streams);\n                if (rt->nb_byes == rt->nb_rtsp_streams)\n                    return AVERROR_EOF;\n            }\n        }\n    } else if (CONFIG_RTPDEC && rt->ts) {\n        ret = ff_mpegts_parse_packet(rt->ts, pkt, rt->recvbuf, len);\n        if (ret >= 0) {\n            if (ret < len) {\n                rt->recvbuf_len = len;\n                rt->recvbuf_pos = ret;\n                rt->cur_transport_priv = rt->ts;\n                return 1;\n            } else {\n                ret = 0;\n            }\n        }\n    } else {\n        return AVERROR_INVALIDDATA;\n    }\nend:\n    if (ret < 0)\n        goto redo;\n    if (ret == 1)\n        rt->cur_transport_priv = rtsp_st->transport_priv;\n    return ret;\n}', 'static int read_packet(AVFormatContext *s,\n                       RTSPStream **rtsp_st, RTSPStream *first_queue_st,\n                       int64_t wait_end)\n{\n    RTSPState *rt = s->priv_data;\n    int len;\n    switch(rt->lower_transport) {\n    default:\n#if CONFIG_RTSP_DEMUXER\n    case RTSP_LOWER_TRANSPORT_TCP:\n        len = ff_rtsp_tcp_read_packet(s, rtsp_st, rt->recvbuf, RECVBUF_SIZE);\n        break;\n#endif\n    case RTSP_LOWER_TRANSPORT_UDP:\n    case RTSP_LOWER_TRANSPORT_UDP_MULTICAST:\n        len = udp_read_packet(s, rtsp_st, rt->recvbuf, RECVBUF_SIZE, wait_end);\n        if (len > 0 && (*rtsp_st)->transport_priv && rt->transport == RTSP_TRANSPORT_RTP)\n            ff_rtp_check_and_send_back_rr((*rtsp_st)->transport_priv, (*rtsp_st)->rtp_handle, NULL, len);\n        break;\n    case RTSP_LOWER_TRANSPORT_CUSTOM:\n        if (first_queue_st && rt->transport == RTSP_TRANSPORT_RTP &&\n            wait_end && wait_end < av_gettime_relative())\n            len = AVERROR(EAGAIN);\n        else\n            len = ffio_read_partial(s->pb, rt->recvbuf, RECVBUF_SIZE);\n        len = pick_stream(s, rtsp_st, rt->recvbuf, len);\n        if (len > 0 && (*rtsp_st)->transport_priv && rt->transport == RTSP_TRANSPORT_RTP)\n            ff_rtp_check_and_send_back_rr((*rtsp_st)->transport_priv, NULL, s->pb, len);\n        break;\n    }\n    if (len == 0)\n        return AVERROR_EOF;\n    return len;\n}', 'int ff_rtp_check_and_send_back_rr(RTPDemuxContext *s, URLContext *fd,\n                                  AVIOContext *avio, int count)\n{\n    AVIOContext *pb;\n    uint8_t *buf;\n    int len;\n    int rtcp_bytes;\n    RTPStatistics *stats = &s->statistics;\n    uint32_t lost;\n    uint32_t extended_max;\n    uint32_t expected_interval;\n    uint32_t received_interval;\n    int32_t  lost_interval;\n    uint32_t expected;\n    uint32_t fraction;\n    if ((!fd && !avio) || (count < 1))\n        return -1;\n    s->octet_count += count;\n    rtcp_bytes = ((s->octet_count - s->last_octet_count) * RTCP_TX_RATIO_NUM) /\n        RTCP_TX_RATIO_DEN;\n    rtcp_bytes /= 50;\n    if (rtcp_bytes < 28)\n        return -1;\n    s->last_octet_count = s->octet_count;\n    if (!fd)\n        pb = avio;\n    else if (avio_open_dyn_buf(&pb) < 0)\n        return -1;\n    avio_w8(pb, (RTP_VERSION << 6) + 1);\n    avio_w8(pb, RTCP_RR);\n    avio_wb16(pb, 7);\n    avio_wb32(pb, s->ssrc + 1);\n    avio_wb32(pb, s->ssrc);\n    extended_max          = stats->cycles + stats->max_seq;\n    expected              = extended_max - stats->base_seq;\n    lost                  = expected - stats->received;\n    lost                  = FFMIN(lost, 0xffffff);\n    expected_interval     = expected - stats->expected_prior;\n    stats->expected_prior = expected;\n    received_interval     = stats->received - stats->received_prior;\n    stats->received_prior = stats->received;\n    lost_interval         = expected_interval - received_interval;\n    if (expected_interval == 0 || lost_interval <= 0)\n        fraction = 0;\n    else\n        fraction = (lost_interval << 8) / expected_interval;\n    fraction = (fraction << 24) | lost;\n    avio_wb32(pb, fraction);\n    avio_wb32(pb, extended_max);\n    avio_wb32(pb, stats->jitter >> 4);\n    if (s->last_rtcp_ntp_time == AV_NOPTS_VALUE) {\n        avio_wb32(pb, 0);\n        avio_wb32(pb, 0);\n    } else {\n        uint32_t middle_32_bits   = s->last_rtcp_ntp_time >> 16;\n        uint32_t delay_since_last = av_rescale(av_gettime_relative() - s->last_rtcp_reception_time,\n                                               65536, AV_TIME_BASE);\n        avio_wb32(pb, middle_32_bits);\n        avio_wb32(pb, delay_since_last);\n    }\n    avio_w8(pb, (RTP_VERSION << 6) + 1);\n    avio_w8(pb, RTCP_SDES);\n    len = strlen(s->hostname);\n    avio_wb16(pb, (7 + len + 3) / 4);\n    avio_wb32(pb, s->ssrc + 1);\n    avio_w8(pb, 0x01);\n    avio_w8(pb, len);\n    avio_write(pb, s->hostname, len);\n    avio_w8(pb, 0);\n    for (len = (7 + len) % 4; len % 4; len++)\n        avio_w8(pb, 0);\n    avio_flush(pb);\n    if (!fd)\n        return 0;\n    len = avio_close_dyn_buf(pb, &buf);\n    if ((len > 0) && buf) {\n        int av_unused result;\n        av_log(s->ic, AV_LOG_TRACE, "sending %d bytes of RR\\n", len);\n        result = ffurl_write(fd, buf, len);\n        av_log(s->ic, AV_LOG_TRACE, "result from ffurl_write: %d\\n", result);\n        av_free(buf);\n    }\n    return 0;\n}', 'int ff_rtp_parse_packet(RTPDemuxContext *s, AVPacket *pkt,\n                        uint8_t **bufptr, int len)\n{\n    int rv;\n    if (s->srtp_enabled && bufptr && ff_srtp_decrypt(&s->srtp, *bufptr, &len) < 0)\n        return -1;\n    rv = rtp_parse_one_packet(s, pkt, bufptr, len);\n    s->prev_ret = rv;\n    while (rv < 0 && has_next_packet(s))\n        rv = rtp_parse_queued_packet(s, pkt);\n    return rv ? rv : has_next_packet(s);\n}', 'int ff_srtp_decrypt(struct SRTPContext *s, uint8_t *buf, int *lenptr)\n{\n    uint8_t iv[16] = { 0 }, hmac[20];\n    int len = *lenptr;\n    int av_uninit(seq_largest);\n    uint32_t ssrc, av_uninit(roc);\n    uint64_t index;\n    int rtcp, hmac_size;\n    if (len < 2)\n        return AVERROR_INVALIDDATA;\n    rtcp = RTP_PT_IS_RTCP(buf[1]);\n    hmac_size = rtcp ? s->rtcp_hmac_size : s->rtp_hmac_size;\n    if (len < hmac_size)\n        return AVERROR_INVALIDDATA;\n    av_hmac_init(s->hmac, rtcp ? s->rtcp_auth : s->rtp_auth, sizeof(s->rtp_auth));\n    av_hmac_update(s->hmac, buf, len - hmac_size);\n    if (!rtcp) {\n        int seq = AV_RB16(buf + 2);\n        uint32_t v;\n        uint8_t rocbuf[4];\n        seq_largest = s->seq_initialized ? s->seq_largest : seq;\n        v = roc = s->roc;\n        if (seq_largest < 32768) {\n            if (seq - seq_largest > 32768)\n                v = roc - 1;\n        } else {\n            if (seq_largest - 32768 > seq)\n                v = roc + 1;\n        }\n        if (v == roc) {\n            seq_largest = FFMAX(seq_largest, seq);\n        } else if (v == roc + 1) {\n            seq_largest = seq;\n            roc = v;\n        }\n        index = seq + (((uint64_t)v) << 16);\n        AV_WB32(rocbuf, roc);\n        av_hmac_update(s->hmac, rocbuf, 4);\n    }\n    av_hmac_final(s->hmac, hmac, sizeof(hmac));\n    if (memcmp(hmac, buf + len - hmac_size, hmac_size)) {\n        av_log(NULL, AV_LOG_WARNING, "HMAC mismatch\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    len -= hmac_size;\n    *lenptr = len;\n    if (len < 12)\n        return AVERROR_INVALIDDATA;\n    if (rtcp) {\n        uint32_t srtcp_index = AV_RB32(buf + len - 4);\n        len -= 4;\n        *lenptr = len;\n        ssrc = AV_RB32(buf + 4);\n        index = srtcp_index & 0x7fffffff;\n        buf += 8;\n        len -= 8;\n        if (!(srtcp_index & 0x80000000))\n            return 0;\n    } else {\n        int ext, csrc;\n        s->seq_initialized = 1;\n        s->seq_largest     = seq_largest;\n        s->roc             = roc;\n        csrc = buf[0] & 0x0f;\n        ext  = buf[0] & 0x10;\n        ssrc = AV_RB32(buf + 8);\n        buf += 12;\n        len -= 12;\n        buf += 4 * csrc;\n        len -= 4 * csrc;\n        if (len < 0)\n            return AVERROR_INVALIDDATA;\n        if (ext) {\n            if (len < 4)\n                return AVERROR_INVALIDDATA;\n            ext = (AV_RB16(buf + 2) + 1) * 4;\n            if (len < ext)\n                return AVERROR_INVALIDDATA;\n            len -= ext;\n            buf += ext;\n        }\n    }\n    create_iv(iv, rtcp ? s->rtcp_salt : s->rtp_salt, index, ssrc);\n    av_aes_init(s->aes, rtcp ? s->rtcp_key : s->rtp_key, 128, 0);\n    encrypt_counter(s->aes, iv, buf, len);\n    return 0;\n}']