libavformat/matroskaenc.c:926: error: Integer Overflow R2
  ([0, +oo] + [-oo, +oo]):signed32.

libavformat/matroskaenc.c:924:13: <LHS trace>
922.         size -= start - data;
923.         sscanf(data, "Dialogue: %d,", &layer);
924.         i = snprintf(buffer, sizeof(buffer), "%"PRId64",%d,",
                 ^
925.                      s->streams[pkt->stream_index]->nb_frames++, layer);
926.         size = FFMIN(i+size, sizeof(buffer));

libavformat/matroskaenc.c:924:13: Risky value from: snprintf
922.         size -= start - data;
923.         sscanf(data, "Dialogue: %d,", &layer);
924.         i = snprintf(buffer, sizeof(buffer), "%"PRId64",%d,",
                 ^
925.                      s->streams[pkt->stream_index]->nb_frames++, layer);
926.         size = FFMIN(i+size, sizeof(buffer));

libavformat/matroskaenc.c:924:9: Assignment
922.         size -= start - data;
923.         sscanf(data, "Dialogue: %d,", &layer);
924.         i = snprintf(buffer, sizeof(buffer), "%"PRId64",%d,",
             ^
925.                      s->streams[pkt->stream_index]->nb_frames++, layer);
926.         size = FFMIN(i+size, sizeof(buffer));

libavformat/matroskaenc.c:904:1: <RHS trace>
902. }
903. 
904. static int mkv_write_ass_blocks(AVFormatContext *s, AVIOContext *pb, AVPacket *pkt)
     ^
905. {
906.     MatroskaMuxContext *mkv = s->priv_data;

libavformat/matroskaenc.c:904:1: Parameter `*pkt->data`
902. }
903. 
904. static int mkv_write_ass_blocks(AVFormatContext *s, AVIOContext *pb, AVPacket *pkt)
     ^
905. {
906.     MatroskaMuxContext *mkv = s->priv_data;

libavformat/matroskaenc.c:908:5: Assignment
906.     MatroskaMuxContext *mkv = s->priv_data;
907.     int i, layer = 0, max_duration = 0, size, line_size, data_size = pkt->size;
908.     uint8_t *start, *end, *data = pkt->data;
         ^
909.     ebml_master blockgroup;
910.     char buffer[2048];

libavformat/matroskaenc.c:922:9: Assignment
920.             if (!(start = memchr(start, ',', size-(start-data))))
921.                 return max_duration;
922.         size -= start - data;
             ^
923.         sscanf(data, "Dialogue: %d,", &layer);
924.         i = snprintf(buffer, sizeof(buffer), "%"PRId64",%d,",

libavformat/matroskaenc.c:926:16: Binary operation: ([0, +oo] + [-oo, +oo]):signed32
924.         i = snprintf(buffer, sizeof(buffer), "%"PRId64",%d,",
925.                      s->streams[pkt->stream_index]->nb_frames++, layer);
926.         size = FFMIN(i+size, sizeof(buffer));
                    ^
927.         memcpy(buffer+i, start, size-i);
928. 

static int mkv_write_ass_blocks(AVFormatContext *s, AVIOContext *pb, AVPacket *pkt)
{
    MatroskaMuxContext *mkv = s->priv_data;
    int i, layer = 0, max_duration = 0, size, line_size, data_size = pkt->size;
    uint8_t *start, *end, *data = pkt->data;
    ebml_master blockgroup;
    char buffer[2048];
    while (data_size) {
        int duration = ass_get_duration(data);
        max_duration = FFMAX(duration, max_duration);
        end = memchr(data, '\n', data_size);
        size = line_size = end ? end-data+1 : data_size;
        size -= end ? (end[-1]=='\r')+1 : 0;
        start = data;
        for (i=0; i<3; i++, start++)
            if (!(start = memchr(start, ',', size-(start-data))))
                return max_duration;
        size -= start - data;
        sscanf(data, "Dialogue: %d,", &layer);
        i = snprintf(buffer, sizeof(buffer), "%"PRId64",%d,",
                     s->streams[pkt->stream_index]->nb_frames++, layer);
        size = FFMIN(i+size, sizeof(buffer));
        memcpy(buffer+i, start, size-i);
        av_log(s, AV_LOG_DEBUG, "Writing block at offset %" PRIu64 ", size %d, "
               "pts %" PRId64 ", duration %d\n",
               url_ftell(pb), size, pkt->pts, duration);
        blockgroup = start_ebml_master(pb, MATROSKA_ID_BLOCKGROUP, mkv_blockgroup_size(size));
        put_ebml_id(pb, MATROSKA_ID_BLOCK);
        put_ebml_num(pb, size+4, 0);
        put_byte(pb, 0x80 | (pkt->stream_index + 1));
        put_be16(pb, pkt->pts - mkv->cluster_pts);
        put_byte(pb, 0);
        put_buffer(pb, buffer, size);
        put_ebml_uint(pb, MATROSKA_ID_BLOCKDURATION, duration);
        end_ebml_master(pb, blockgroup);
        data += line_size;
        data_size -= line_size;
    }
    return max_duration;
}
['static int mkv_write_ass_blocks(AVFormatContext *s, AVIOContext *pb, AVPacket *pkt)\n{\n    MatroskaMuxContext *mkv = s->priv_data;\n    int i, layer = 0, max_duration = 0, size, line_size, data_size = pkt->size;\n    uint8_t *start, *end, *data = pkt->data;\n    ebml_master blockgroup;\n    char buffer[2048];\n    while (data_size) {\n        int duration = ass_get_duration(data);\n        max_duration = FFMAX(duration, max_duration);\n        end = memchr(data, \'\\n\', data_size);\n        size = line_size = end ? end-data+1 : data_size;\n        size -= end ? (end[-1]==\'\\r\')+1 : 0;\n        start = data;\n        for (i=0; i<3; i++, start++)\n            if (!(start = memchr(start, \',\', size-(start-data))))\n                return max_duration;\n        size -= start - data;\n        sscanf(data, "Dialogue: %d,", &layer);\n        i = snprintf(buffer, sizeof(buffer), "%"PRId64",%d,",\n                     s->streams[pkt->stream_index]->nb_frames++, layer);\n        size = FFMIN(i+size, sizeof(buffer));\n        memcpy(buffer+i, start, size-i);\n        av_log(s, AV_LOG_DEBUG, "Writing block at offset %" PRIu64 ", size %d, "\n               "pts %" PRId64 ", duration %d\\n",\n               url_ftell(pb), size, pkt->pts, duration);\n        blockgroup = start_ebml_master(pb, MATROSKA_ID_BLOCKGROUP, mkv_blockgroup_size(size));\n        put_ebml_id(pb, MATROSKA_ID_BLOCK);\n        put_ebml_num(pb, size+4, 0);\n        put_byte(pb, 0x80 | (pkt->stream_index + 1));\n        put_be16(pb, pkt->pts - mkv->cluster_pts);\n        put_byte(pb, 0);\n        put_buffer(pb, buffer, size);\n        put_ebml_uint(pb, MATROSKA_ID_BLOCKDURATION, duration);\n        end_ebml_master(pb, blockgroup);\n        data += line_size;\n        data_size -= line_size;\n    }\n    return max_duration;\n}']