libavformat/rtsp.c:1173: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `make_setup_request`.

libavformat/rtsp.c:1097:9: Call
1095.     /* open the tcp connexion */
1096.     snprintf(tcpname, sizeof(tcpname), "tcp://%s:%d", host, port);
1097.     if (url_open(&rtsp_hd, tcpname, URL_RDWR) < 0)
              ^
1098.         return AVERROR(EIO);
1099.     rt->rtsp_hd = rtsp_hd;

libavformat/avio.c:111:14: Unknown value from: __ctype_b_loc
  109.     while (*p != '\0' && *p != ':') {
  110.         /* protocols can only contain alphabetic chars */
  111.         if (!isalpha(*p))
                    ^
  112.             goto file_proto;
  113.         if ((q - proto_str) < sizeof(proto_str) - 1)

libavformat/rtsp.c:1173:15: Call
1171.         int protocol = ff_log2_tab[protocol_mask & ~(protocol_mask - 1)];
1172. 
1173.         err = make_setup_request(s, host, port, protocol,
                    ^
1174.                                  rt->server_type == RTSP_SERVER_RDT ?
1175.                                      real_challenge : NULL);

libavformat/rtsp.c:874:1: Parameter `cmd.strlen`
  872.  * @returns 0 on success, <0 on error, 1 if protocol is unavailable.
  873.  */
  874. static int
       ^
  875. make_setup_request (AVFormatContext *s, const char *host, int port,
  876.                     int protocol, const char *real_challenge)

libavformat/rtsp.c:951:13: Call
  949.             ff_rdt_calc_response_and_checksum(real_res, real_csum,
  950.                                               real_challenge);
  951.             av_strlcatf(cmd, sizeof(cmd),
                   ^
  952.                         "If-Match: %s\r\n"
  953.                         "RealChallenge2: %s, sd=%s\r\n",

libavutil/string.c:68:1: <LHS trace>
66. }
67. 
68. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
    ^
69. {
70.     int len = strlen(dst);

libavutil/string.c:68:1: Parameter `size`
    66. }
    67. 
    68. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
        ^
    69. {
    70.     int len = strlen(dst);

libavutil/string.c:74:12: <RHS trace>
72. 
73.     va_start(vl, fmt);
74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
               ^
75.     va_end(vl);
76. 

libavutil/string.c:74:12: Risky value from: vsnprintf
    72. 
    73.     va_start(vl, fmt);
    74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                   ^
    75.     va_end(vl);
    76. 

libavutil/string.c:74:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `make_setup_request` 
    72. 
    73.     va_start(vl, fmt);
    74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
            ^
    75.     va_end(vl);
    76. 

size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
{
    int len = strlen(dst);
    va_list vl;
    va_start(vl, fmt);
    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
    va_end(vl);
    return len;
}
['static int rtsp_read_header(AVFormatContext *s,\n                            AVFormatParameters *ap)\n{\n    RTSPState *rt = s->priv_data;\n    char host[1024], path[1024], tcpname[1024], cmd[2048], *option_list, *option;\n    URLContext *rtsp_hd;\n    int port, ret, err;\n    RTSPHeader reply1, *reply = &reply1;\n    unsigned char *content = NULL;\n    int protocol_mask = 0;\n    char real_challenge[64];\n    url_split(NULL, 0, NULL, 0,\n              host, sizeof(host), &port, path, sizeof(path), s->filename);\n    if (port < 0)\n        port = RTSP_DEFAULT_PORT;\n    option_list = strchr(path, \'?\');\n    if (option_list) {\n        *option_list++ = 0;\n        while(option_list) {\n            option = option_list;\n            option_list = strchr(option_list, \'&\');\n            if (option_list)\n                *(option_list++) = 0;\n            if (strcmp(option, "udp") == 0)\n                protocol_mask = (1<< RTSP_PROTOCOL_RTP_UDP);\n            else if (strcmp(option, "multicast") == 0)\n                protocol_mask = (1<< RTSP_PROTOCOL_RTP_UDP_MULTICAST);\n            else if (strcmp(option, "tcp") == 0)\n                protocol_mask = (1<< RTSP_PROTOCOL_RTP_TCP);\n        }\n    }\n    if (!protocol_mask)\n        protocol_mask = (1 << RTSP_PROTOCOL_RTP_LAST) - 1;\n    snprintf(tcpname, sizeof(tcpname), "tcp://%s:%d", host, port);\n    if (url_open(&rtsp_hd, tcpname, URL_RDWR) < 0)\n        return AVERROR(EIO);\n    rt->rtsp_hd = rtsp_hd;\n    rt->seq = 0;\n    for (rt->server_type = RTSP_SERVER_RTP;;) {\n        snprintf(cmd, sizeof(cmd),\n                 "OPTIONS %s RTSP/1.0\\r\\n", s->filename);\n        if (rt->server_type == RTSP_SERVER_RDT)\n            av_strlcat(cmd,\n                       "ClientChallenge: 9e26d33f2984236010ef6253fb1887f7\\r\\n"\n                       "PlayerStarttime: [28/03/2003:22:50:23 00:00]\\r\\n"\n                       "CompanyID: KnKV4M4I/B2FjJ1TToLycw==\\r\\n"\n                       "GUID: 00000000-0000-0000-0000-000000000000\\r\\n",\n                       sizeof(cmd));\n        rtsp_send_cmd(s, cmd, reply, NULL);\n        if (reply->status_code != RTSP_STATUS_OK) {\n            err = AVERROR_INVALIDDATA;\n            goto fail;\n        }\n        if (rt->server_type != RTSP_SERVER_RDT && reply->real_challenge[0]) {\n            rt->server_type = RTSP_SERVER_RDT;\n            continue;\n        } else if (rt->server_type == RTSP_SERVER_RDT) {\n            strcpy(real_challenge, reply->real_challenge);\n        }\n        break;\n    }\n    snprintf(cmd, sizeof(cmd),\n             "DESCRIBE %s RTSP/1.0\\r\\n"\n             "Accept: application/sdp\\r\\n",\n             s->filename);\n    if (rt->server_type == RTSP_SERVER_RDT) {\n        av_strlcat(cmd,\n                   "Require: com.real.retain-entity-for-setup\\r\\n",\n                   sizeof(cmd));\n    }\n    rtsp_send_cmd(s, cmd, reply, &content);\n    if (!content) {\n        err = AVERROR_INVALIDDATA;\n        goto fail;\n    }\n    if (reply->status_code != RTSP_STATUS_OK) {\n        err = AVERROR_INVALIDDATA;\n        goto fail;\n    }\n    ret = sdp_parse(s, (const char *)content);\n    av_freep(&content);\n    if (ret < 0) {\n        err = AVERROR_INVALIDDATA;\n        goto fail;\n    }\n    do {\n        int protocol = ff_log2_tab[protocol_mask & ~(protocol_mask - 1)];\n        err = make_setup_request(s, host, port, protocol,\n                                 rt->server_type == RTSP_SERVER_RDT ?\n                                     real_challenge : NULL);\n        if (err < 0)\n            goto fail;\n        protocol_mask &= ~(1 << protocol);\n        if (protocol_mask == 0 && err == 1) {\n            err = AVERROR(FF_NETERROR(EPROTONOSUPPORT));\n            goto fail;\n        }\n    } while (err);\n    rt->state = RTSP_STATE_IDLE;\n    rt->seek_timestamp = 0;\n    if (ap->initial_pause) {\n    } else {\n        if (rtsp_read_play(s) < 0) {\n            err = AVERROR_INVALIDDATA;\n            goto fail;\n        }\n    }\n    return 0;\n fail:\n    rtsp_close_streams(rt);\n    av_freep(&content);\n    url_close(rt->rtsp_hd);\n    return err;\n}', 'int url_open(URLContext **puc, const char *filename, int flags)\n{\n    URLProtocol *up;\n    const char *p;\n    char proto_str[128], *q;\n    p = filename;\n    q = proto_str;\n    while (*p != \'\\0\' && *p != \':\') {\n        if (!isalpha(*p))\n            goto file_proto;\n        if ((q - proto_str) < sizeof(proto_str) - 1)\n            *q++ = *p;\n        p++;\n    }\n    if (*p == \'\\0\' || (q - proto_str) <= 1) {\n    file_proto:\n        strcpy(proto_str, "file");\n    } else {\n        *q = \'\\0\';\n    }\n    up = first_protocol;\n    while (up != NULL) {\n        if (!strcmp(proto_str, up->name))\n            return url_open_protocol (puc, up, filename, flags);\n        up = up->next;\n    }\n    *puc = NULL;\n    return AVERROR(ENOENT);\n}', 'static int\nmake_setup_request (AVFormatContext *s, const char *host, int port,\n                    int protocol, const char *real_challenge)\n{\n    RTSPState *rt = s->priv_data;\n    int j, i, err;\n    RTSPStream *rtsp_st;\n    AVStream *st;\n    RTSPHeader reply1, *reply = &reply1;\n    char cmd[2048];\n    const char *trans_pref;\n    if (rt->server_type == RTSP_SERVER_RDT)\n        trans_pref = "x-pn-tng";\n    else\n        trans_pref = "RTP/AVP";\n    for(j = RTSP_RTP_PORT_MIN, i = 0; i < rt->nb_rtsp_streams; ++i) {\n        char transport[2048];\n        rtsp_st = rt->rtsp_streams[i];\n        if (protocol == RTSP_PROTOCOL_RTP_UDP) {\n            char buf[256];\n            if (RTSP_RTP_PORT_MIN != 0) {\n                while(j <= RTSP_RTP_PORT_MAX) {\n                    snprintf(buf, sizeof(buf), "rtp://%s?localport=%d", host, j);\n                    j += 2;\n                    if (url_open(&rtsp_st->rtp_handle, buf, URL_RDWR) == 0) {\n                        goto rtp_opened;\n                    }\n                }\n            }\n        rtp_opened:\n            port = rtp_get_local_port(rtsp_st->rtp_handle);\n            snprintf(transport, sizeof(transport) - 1,\n                     "%s/UDP;unicast;client_port=%d",\n                     trans_pref, port);\n            if (rt->server_type == RTSP_SERVER_RTP)\n                av_strlcatf(transport, sizeof(transport), "-%d", port + 1);\n        }\n        else if (protocol == RTSP_PROTOCOL_RTP_TCP) {\n            snprintf(transport, sizeof(transport) - 1,\n                     "%s/TCP", trans_pref);\n        }\n        else if (protocol == RTSP_PROTOCOL_RTP_UDP_MULTICAST) {\n            snprintf(transport, sizeof(transport) - 1,\n                     "%s/UDP;multicast", trans_pref);\n        }\n        if (rt->server_type == RTSP_SERVER_RDT)\n            av_strlcat(transport, ";mode=play", sizeof(transport));\n        snprintf(cmd, sizeof(cmd),\n                 "SETUP %s RTSP/1.0\\r\\n"\n                 "Transport: %s\\r\\n",\n                 rtsp_st->control_url, transport);\n        if (i == 0 && rt->server_type == RTSP_SERVER_RDT) {\n            char real_res[41], real_csum[9];\n            ff_rdt_calc_response_and_checksum(real_res, real_csum,\n                                              real_challenge);\n            av_strlcatf(cmd, sizeof(cmd),\n                        "If-Match: %s\\r\\n"\n                        "RealChallenge2: %s, sd=%s\\r\\n",\n                        rt->session_id, real_res, real_csum);\n        }\n        rtsp_send_cmd(s, cmd, reply, NULL);\n        if (reply->status_code == 461   && i == 0) {\n            err = 1;\n            goto fail;\n        } else if (reply->status_code != RTSP_STATUS_OK ||\n                   reply->nb_transports != 1) {\n            err = AVERROR_INVALIDDATA;\n            goto fail;\n        }\n        if (i > 0) {\n            if (reply->transports[0].protocol != rt->protocol) {\n                err = AVERROR_INVALIDDATA;\n                goto fail;\n            }\n        } else {\n            rt->protocol = reply->transports[0].protocol;\n        }\n        if (reply->transports[0].protocol != RTSP_PROTOCOL_RTP_UDP &&\n            (protocol == RTSP_PROTOCOL_RTP_UDP)) {\n            url_close(rtsp_st->rtp_handle);\n            rtsp_st->rtp_handle = NULL;\n        }\n        switch(reply->transports[0].protocol) {\n        case RTSP_PROTOCOL_RTP_TCP:\n            rtsp_st->interleaved_min = reply->transports[0].interleaved_min;\n            rtsp_st->interleaved_max = reply->transports[0].interleaved_max;\n            break;\n        case RTSP_PROTOCOL_RTP_UDP:\n            {\n                char url[1024];\n                snprintf(url, sizeof(url), "rtp://%s:%d",\n                         host, reply->transports[0].server_port_min);\n                if (rtp_set_remote_url(rtsp_st->rtp_handle, url) < 0) {\n                    err = AVERROR_INVALIDDATA;\n                    goto fail;\n                }\n            }\n            break;\n        case RTSP_PROTOCOL_RTP_UDP_MULTICAST:\n            {\n                char url[1024];\n                struct in_addr in;\n                in.s_addr = htonl(reply->transports[0].destination);\n                snprintf(url, sizeof(url), "rtp://%s:%d?ttl=%d",\n                         inet_ntoa(in),\n                         reply->transports[0].port_min,\n                         reply->transports[0].ttl);\n                if (url_open(&rtsp_st->rtp_handle, url, URL_RDWR) < 0) {\n                    err = AVERROR_INVALIDDATA;\n                    goto fail;\n                }\n            }\n            break;\n        }\n        st = NULL;\n        if (rtsp_st->stream_index >= 0)\n            st = s->streams[rtsp_st->stream_index];\n        if (!st)\n            s->ctx_flags |= AVFMTCTX_NOHEADER;\n        rtsp_st->rtp_ctx = rtp_parse_open(s, st, rtsp_st->rtp_handle, rtsp_st->sdp_payload_type, &rtsp_st->rtp_payload_data);\n        if (!rtsp_st->rtp_ctx) {\n            err = AVERROR(ENOMEM);\n            goto fail;\n        } else {\n            if(rtsp_st->dynamic_handler) {\n                rtsp_st->rtp_ctx->dynamic_protocol_context= rtsp_st->dynamic_protocol_context;\n                rtsp_st->rtp_ctx->parse_packet= rtsp_st->dynamic_handler->parse_packet;\n            }\n        }\n    }\n    if (rt->server_type == RTSP_SERVER_RDT)\n        rt->need_subscription = 1;\n    return 0;\nfail:\n    for (i=0; i<rt->nb_rtsp_streams; i++) {\n        if (rt->rtsp_streams[i]->rtp_handle) {\n            url_close(rt->rtsp_streams[i]->rtp_handle);\n            rt->rtsp_streams[i]->rtp_handle = NULL;\n        }\n    }\n    return err;\n}', 'size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)\n{\n    int len = strlen(dst);\n    va_list vl;\n    va_start(vl, fmt);\n    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);\n    va_end(vl);\n    return len;\n}']