libavformat/mpegtsenc.c:363: error: Buffer Overrun L2
  Offset added: [6, 372] (⇐ [5, 189] + [1, 183]) Size: 188 by call to `mpegts_write_section1`.

libavformat/mpegtsenc.c:225:1: Array declaration
223. }
224. 
225. static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
     ^
226. {
227.     MpegTSWrite *ts = s->priv_data;

libavformat/mpegtsenc.c:363:5: Call
361.         desc_length_ptr[1] = val;
362.     }
363.     mpegts_write_section1(&service->pmt, PMT_TID, service->sid, 0, 0, 0,
         ^
364.                           data, q - data);
365. }

libavformat/mpegtsenc.c:156:1: Parameter `len`
  154. }
  155. 
  156. static int mpegts_write_section1(MpegTSSection *s, int tid, int id,
       ^
  157.                                  int version, int sec_num, int last_sec_num,
  158.                                  uint8_t *buf, int len)

libavformat/mpegtsenc.c:165:5: Assignment
  163.     unsigned int flags = tid == SDT_TID ? 0xf000 : 0xb000;
  164. 
  165.     tot_len = 3 + 5 + len + 4;
           ^
  166.     /* check if not too big */
  167.     if (tot_len > 1024)

libavformat/mpegtsenc.c:179:5: Call
  177.     memcpy(q, buf, len);
  178. 
  179.     mpegts_write_section(s, section, tot_len);
           ^
  180.     return 0;
  181. }

libavformat/mpegtsenc.c:99:1: <Offset trace>
 97. 
 98. /* NOTE: 4 bytes must be left at the end for the crc32 */
 99. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
     ^
100. {
101.     unsigned int crc;

libavformat/mpegtsenc.c:99:1: Array declaration
     97. 
     98. /* NOTE: 4 bytes must be left at the end for the crc32 */
     99. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
         ^
    100. {
    101.     unsigned int crc;

libavformat/mpegtsenc.c:136:9: Assignment
    134.         q += len1;
    135.         /* add known padding data */
    136.         left = TS_PACKET_SIZE - (q - packet);
                 ^
    137.         if (left > 0)
    138.             memset(q, 0xff, left);

libavformat/mpegtsenc.c:99:1: <Length trace>
 97. 
 98. /* NOTE: 4 bytes must be left at the end for the crc32 */
 99. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
     ^
100. {
101.     unsigned int crc;

libavformat/mpegtsenc.c:99:1: Parameter `len`
     97. 
     98. /* NOTE: 4 bytes must be left at the end for the crc32 */
     99. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
         ^
    100. {
    101.     unsigned int crc;

libavformat/mpegtsenc.c:134:9: Assignment
    132.             len1 = len;
    133.         memcpy(q, buf_ptr, len1);
    134.         q += len1;
                 ^
    135.         /* add known padding data */
    136.         left = TS_PACKET_SIZE - (q - packet);

libavformat/mpegtsenc.c:138:13: Array access: Offset added: [6, 372] (⇐ [5, 189] + [1, 183]) Size: 188 by call to `mpegts_write_section1` 
    136.         left = TS_PACKET_SIZE - (q - packet);
    137.         if (left > 0)
    138.             memset(q, 0xff, left);
                     ^
    139. 
    140.         s->write_packet(s, packet);

static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
{
    unsigned int crc;
    unsigned char packet[TS_PACKET_SIZE];
    const unsigned char *buf_ptr;
    unsigned char *q;
    int first, b, len1, left;
    crc = av_bswap32(av_crc(av_crc_get_table(AV_CRC_32_IEEE),
                            -1, buf, len - 4));
    buf[len - 4] = (crc >> 24) & 0xff;
    buf[len - 3] = (crc >> 16) & 0xff;
    buf[len - 2] = (crc >>  8) & 0xff;
    buf[len - 1] =  crc        & 0xff;
    buf_ptr = buf;
    while (len > 0) {
        first = buf == buf_ptr;
        q     = packet;
        *q++  = 0x47;
        b     = s->pid >> 8;
        if (first)
            b |= 0x40;
        *q++  = b;
        *q++  = s->pid;
        s->cc = s->cc + 1 & 0xf;
        *q++  = 0x10 | s->cc;
        if (first)
            *q++ = 0;
        len1 = TS_PACKET_SIZE - (q - packet);
        if (len1 > len)
            len1 = len;
        memcpy(q, buf_ptr, len1);
        q += len1;
        left = TS_PACKET_SIZE - (q - packet);
        if (left > 0)
            memset(q, 0xff, left);
        s->write_packet(s, packet);
        buf_ptr += len1;
        len     -= len1;
    }
}
['static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)\n{\n    MpegTSWrite *ts = s->priv_data;\n    uint8_t data[SECTION_LENGTH], *q, *desc_length_ptr, *program_info_length_ptr;\n    int val, stream_type, i;\n    q = data;\n    put16(&q, 0xe000 | service->pcr_pid);\n    program_info_length_ptr = q;\n    q += 2;\n    val = 0xf000 | (q - program_info_length_ptr - 2);\n    program_info_length_ptr[0] = val >> 8;\n    program_info_length_ptr[1] = val;\n    for (i = 0; i < s->nb_streams; i++) {\n        AVStream *st = s->streams[i];\n        MpegTSWriteStream *ts_st = st->priv_data;\n        AVDictionaryEntry *lang = av_dict_get(st->metadata, "language", NULL, 0);\n        switch (st->codec->codec_id) {\n        case AV_CODEC_ID_MPEG1VIDEO:\n        case AV_CODEC_ID_MPEG2VIDEO:\n            stream_type = STREAM_TYPE_VIDEO_MPEG2;\n            break;\n        case AV_CODEC_ID_MPEG4:\n            stream_type = STREAM_TYPE_VIDEO_MPEG4;\n            break;\n        case AV_CODEC_ID_H264:\n            stream_type = STREAM_TYPE_VIDEO_H264;\n            break;\n        case AV_CODEC_ID_HEVC:\n            stream_type = STREAM_TYPE_VIDEO_HEVC;\n            break;\n        case AV_CODEC_ID_CAVS:\n            stream_type = STREAM_TYPE_VIDEO_CAVS;\n            break;\n        case AV_CODEC_ID_DIRAC:\n            stream_type = STREAM_TYPE_VIDEO_DIRAC;\n            break;\n        case AV_CODEC_ID_MP2:\n        case AV_CODEC_ID_MP3:\n            stream_type = STREAM_TYPE_AUDIO_MPEG1;\n            break;\n        case AV_CODEC_ID_AAC:\n            stream_type = (ts->flags & MPEGTS_FLAG_AAC_LATM)\n                          ? STREAM_TYPE_AUDIO_AAC_LATM\n                          : STREAM_TYPE_AUDIO_AAC;\n            break;\n        case AV_CODEC_ID_AAC_LATM:\n            stream_type = STREAM_TYPE_AUDIO_AAC_LATM;\n            break;\n        case AV_CODEC_ID_AC3:\n            stream_type = STREAM_TYPE_AUDIO_AC3;\n            break;\n        default:\n            stream_type = STREAM_TYPE_PRIVATE_DATA;\n            break;\n        }\n        *q++ = stream_type;\n        put16(&q, 0xe000 | ts_st->pid);\n        desc_length_ptr = q;\n        q += 2;\n        switch (st->codec->codec_type) {\n        case AVMEDIA_TYPE_AUDIO:\n            if (lang) {\n                char *p;\n                char *next = lang->value;\n                uint8_t *len_ptr;\n                *q++     = 0x0a;\n                len_ptr  = q++;\n                *len_ptr = 0;\n                for (p = lang->value; next && *len_ptr < 255 / 4 * 4; p = next + 1) {\n                    next = strchr(p, \',\');\n                    if (strlen(p) != 3 && (!next || next != p + 3))\n                        continue;\n                    *q++ = *p++;\n                    *q++ = *p++;\n                    *q++ = *p++;\n                    if (st->disposition & AV_DISPOSITION_CLEAN_EFFECTS)\n                        *q++ = 0x01;\n                    else if (st->disposition & AV_DISPOSITION_HEARING_IMPAIRED)\n                        *q++ = 0x02;\n                    else if (st->disposition & AV_DISPOSITION_VISUAL_IMPAIRED)\n                        *q++ = 0x03;\n                    else\n                        *q++ = 0;\n                    *len_ptr += 4;\n                }\n                if (*len_ptr == 0)\n                    q -= 2;\n            }\n            break;\n        case AVMEDIA_TYPE_SUBTITLE:\n        {\n            const char *language;\n            language = lang && strlen(lang->value) == 3 ? lang->value : "eng";\n            *q++ = 0x59;\n            *q++ = 8;\n            *q++ = language[0];\n            *q++ = language[1];\n            *q++ = language[2];\n            *q++ = 0x10;\n            if (st->codec->extradata_size == 4) {\n                memcpy(q, st->codec->extradata, 4);\n                q += 4;\n            } else {\n                put16(&q, 1);\n                put16(&q, 1);\n            }\n        }\n        break;\n        case AVMEDIA_TYPE_VIDEO:\n            if (stream_type == STREAM_TYPE_VIDEO_DIRAC) {\n                *q++ = 0x05;\n                *q++ = 4;\n                *q++ = \'d\';\n                *q++ = \'r\';\n                *q++ = \'a\';\n                *q++ = \'c\';\n            }\n            break;\n        }\n        val = 0xf000 | (q - desc_length_ptr - 2);\n        desc_length_ptr[0] = val >> 8;\n        desc_length_ptr[1] = val;\n    }\n    mpegts_write_section1(&service->pmt, PMT_TID, service->sid, 0, 0, 0,\n                          data, q - data);\n}', 'static int mpegts_write_section1(MpegTSSection *s, int tid, int id,\n                                 int version, int sec_num, int last_sec_num,\n                                 uint8_t *buf, int len)\n{\n    uint8_t section[1024], *q;\n    unsigned int tot_len;\n    unsigned int flags = tid == SDT_TID ? 0xf000 : 0xb000;\n    tot_len = 3 + 5 + len + 4;\n    if (tot_len > 1024)\n        return -1;\n    q    = section;\n    *q++ = tid;\n    put16(&q, flags | (len + 5 + 4));\n    put16(&q, id);\n    *q++ = 0xc1 | (version << 1);\n    *q++ = sec_num;\n    *q++ = last_sec_num;\n    memcpy(q, buf, len);\n    mpegts_write_section(s, section, tot_len);\n    return 0;\n}', 'static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)\n{\n    unsigned int crc;\n    unsigned char packet[TS_PACKET_SIZE];\n    const unsigned char *buf_ptr;\n    unsigned char *q;\n    int first, b, len1, left;\n    crc = av_bswap32(av_crc(av_crc_get_table(AV_CRC_32_IEEE),\n                            -1, buf, len - 4));\n    buf[len - 4] = (crc >> 24) & 0xff;\n    buf[len - 3] = (crc >> 16) & 0xff;\n    buf[len - 2] = (crc >>  8) & 0xff;\n    buf[len - 1] =  crc        & 0xff;\n    buf_ptr = buf;\n    while (len > 0) {\n        first = buf == buf_ptr;\n        q     = packet;\n        *q++  = 0x47;\n        b     = s->pid >> 8;\n        if (first)\n            b |= 0x40;\n        *q++  = b;\n        *q++  = s->pid;\n        s->cc = s->cc + 1 & 0xf;\n        *q++  = 0x10 | s->cc;\n        if (first)\n            *q++ = 0;\n        len1 = TS_PACKET_SIZE - (q - packet);\n        if (len1 > len)\n            len1 = len;\n        memcpy(q, buf_ptr, len1);\n        q += len1;\n        left = TS_PACKET_SIZE - (q - packet);\n        if (left > 0)\n            memset(q, 0xff, left);\n        s->write_packet(s, packet);\n        buf_ptr += len1;\n        len     -= len1;\n    }\n}']