avconv.c:4004: error: Buffer Overrun L1
  Offset: 1 Size: 1 by call to `check_stream_specifier`.

avconv.c:4001:9: Call
3999.         *val++ = 0;
4000. 
4001.         parse_meta_type(o->metadata[i].specifier, &type, &index, &stream_spec);
              ^
4002.         if (type == 's') {
4003.             for (j = 0; j < oc->nb_streams; j++) {

avconv.c:2947:1: Parameter `**stream_spec`
  2945.  * @param stream_spec for type s, the stream specifier is written here
  2946.  */
  2947. static void parse_meta_type(char *arg, char *type, int *index, const char **stream_spec)
        ^
  2948. {
  2949.     if (*arg) {

avconv.c:4004:28: Call
4002.         if (type == 's') {
4003.             for (j = 0; j < oc->nb_streams; j++) {
4004.                 if ((ret = check_stream_specifier(oc, oc->streams[j], stream_spec)) > 0) {
                                 ^
4005.                     av_dict_set(&oc->streams[j]->metadata, o->metadata[i].u.str, *val ? val : NULL, 0);
4006.                 } else if (ret < 0)

cmdutils.c:898:1: <Length trace>
896. }
897. 
898. int check_stream_specifier(AVFormatContext *s, AVStream *st, const char *spec)
     ^
899. {
900.     if (*spec <= '9' && *spec >= '0') /* opt:index */

cmdutils.c:898:1: Parameter `*spec`
  896. }
  897. 
  898. int check_stream_specifier(AVFormatContext *s, AVStream *st, const char *spec)
       ^
  899. {
  900.     if (*spec <= '9' && *spec >= '0') /* opt:index */

cmdutils.c:906:18: Assignment
  904.         enum AVMediaType type;
  905. 
  906.         switch (*spec++) {
                        ^
  907.         case 'v': type = AVMEDIA_TYPE_VIDEO;      break;
  908.         case 'a': type = AVMEDIA_TYPE_AUDIO;      break;

cmdutils.c:915:13: Array access: Offset: 1 Size: 1 by call to `check_stream_specifier` 
  913.         if (type != st->codec->codec_type)
  914.             return 0;
  915.         if (*spec++ == ':') { /* possibly followed by :index */
                   ^
  916.             int i, index = strtol(spec, NULL, 0);
  917.             for (i = 0; i < s->nb_streams; i++)

int check_stream_specifier(AVFormatContext *s, AVStream *st, const char *spec)
{
    if (*spec <= '9' && *spec >= '0')
        return strtol(spec, NULL, 0) == st->index;
    else if (*spec == 'v' || *spec == 'a' || *spec == 's' || *spec == 'd' ||
             *spec == 't') {
        enum AVMediaType type;
        switch (*spec++) {
        case 'v': type = AVMEDIA_TYPE_VIDEO;      break;
        case 'a': type = AVMEDIA_TYPE_AUDIO;      break;
        case 's': type = AVMEDIA_TYPE_SUBTITLE;   break;
        case 'd': type = AVMEDIA_TYPE_DATA;       break;
        case 't': type = AVMEDIA_TYPE_ATTACHMENT; break;
        }
        if (type != st->codec->codec_type)
            return 0;
        if (*spec++ == ':') {
            int i, index = strtol(spec, NULL, 0);
            for (i = 0; i < s->nb_streams; i++)
                if (s->streams[i]->codec->codec_type == type && index-- == 0)
                   return i == st->index;
            return 0;
        }
        return 1;
    } else if (*spec == 'p' && *(spec + 1) == ':') {
        int prog_id, i, j;
        char *endptr;
        spec += 2;
        prog_id = strtol(spec, &endptr, 0);
        for (i = 0; i < s->nb_programs; i++) {
            if (s->programs[i]->id != prog_id)
                continue;
            if (*endptr++ == ':') {
                int stream_idx = strtol(endptr, NULL, 0);
                return stream_idx >= 0 &&
                    stream_idx < s->programs[i]->nb_stream_indexes &&
                    st->index == s->programs[i]->stream_index[stream_idx];
            }
            for (j = 0; j < s->programs[i]->nb_stream_indexes; j++)
                if (st->index == s->programs[i]->stream_index[j])
                    return 1;
        }
        return 0;
    } else if (!*spec)
        return 1;
    av_log(s, AV_LOG_ERROR, "Invalid stream specifier: %s.\n", spec);
    return AVERROR(EINVAL);
}
['static void opt_output_file(void *optctx, const char *filename)\n{\n    OptionsContext *o = optctx;\n    AVFormatContext *oc;\n    int i, err;\n    AVOutputFormat *file_oformat;\n    OutputStream *ost;\n    InputStream  *ist;\n    if (!strcmp(filename, "-"))\n        filename = "pipe:";\n    oc = avformat_alloc_context();\n    if (!oc) {\n        print_error(filename, AVERROR(ENOMEM));\n        exit_program(1);\n    }\n    if (o->format) {\n        file_oformat = av_guess_format(o->format, NULL, NULL);\n        if (!file_oformat) {\n            av_log(NULL, AV_LOG_FATAL, "Requested output format \'%s\' is not a suitable output format\\n", o->format);\n            exit_program(1);\n        }\n    } else {\n        file_oformat = av_guess_format(NULL, filename, NULL);\n        if (!file_oformat) {\n            av_log(NULL, AV_LOG_FATAL, "Unable to find a suitable output format for \'%s\'\\n",\n                   filename);\n            exit_program(1);\n        }\n    }\n    oc->oformat = file_oformat;\n    oc->interrupt_callback = int_cb;\n    av_strlcpy(oc->filename, filename, sizeof(oc->filename));\n    if (!o->nb_stream_maps) {\n#define NEW_STREAM(type, index)\\\n        if (index >= 0) {\\\n            ost = new_ ## type ## _stream(o, oc);\\\n            ost->source_index = index;\\\n            ost->sync_ist     = &input_streams[index];\\\n            input_streams[index].discard = 0;\\\n        }\n        if (!o->video_disable && oc->oformat->video_codec != CODEC_ID_NONE) {\n            int area = 0, idx = -1;\n            for (i = 0; i < nb_input_streams; i++) {\n                ist = &input_streams[i];\n                if (ist->st->codec->codec_type == AVMEDIA_TYPE_VIDEO &&\n                    ist->st->codec->width * ist->st->codec->height > area) {\n                    area = ist->st->codec->width * ist->st->codec->height;\n                    idx = i;\n                }\n            }\n            NEW_STREAM(video, idx);\n        }\n        if (!o->audio_disable && oc->oformat->audio_codec != CODEC_ID_NONE) {\n            int channels = 0, idx = -1;\n            for (i = 0; i < nb_input_streams; i++) {\n                ist = &input_streams[i];\n                if (ist->st->codec->codec_type == AVMEDIA_TYPE_AUDIO &&\n                    ist->st->codec->channels > channels) {\n                    channels = ist->st->codec->channels;\n                    idx = i;\n                }\n            }\n            NEW_STREAM(audio, idx);\n        }\n        if (!o->subtitle_disable && oc->oformat->subtitle_codec != CODEC_ID_NONE) {\n            for (i = 0; i < nb_input_streams; i++)\n                if (input_streams[i].st->codec->codec_type == AVMEDIA_TYPE_SUBTITLE) {\n                    NEW_STREAM(subtitle, i);\n                    break;\n                }\n        }\n    } else {\n        for (i = 0; i < o->nb_stream_maps; i++) {\n            StreamMap *map = &o->stream_maps[i];\n            if (map->disabled)\n                continue;\n            ist = &input_streams[input_files[map->file_index].ist_index + map->stream_index];\n            switch (ist->st->codec->codec_type) {\n            case AVMEDIA_TYPE_VIDEO:    ost = new_video_stream(o, oc);    break;\n            case AVMEDIA_TYPE_AUDIO:    ost = new_audio_stream(o, oc);    break;\n            case AVMEDIA_TYPE_SUBTITLE: ost = new_subtitle_stream(o, oc); break;\n            case AVMEDIA_TYPE_DATA:     ost = new_data_stream(o, oc);     break;\n            case AVMEDIA_TYPE_ATTACHMENT: ost = new_attachment_stream(o, oc); break;\n            default:\n                av_log(NULL, AV_LOG_FATAL, "Cannot map stream #%d:%d - unsupported type.\\n",\n                       map->file_index, map->stream_index);\n                exit_program(1);\n            }\n            ost->source_index = input_files[map->file_index].ist_index + map->stream_index;\n            ost->sync_ist     = &input_streams[input_files[map->sync_file_index].ist_index +\n                                           map->sync_stream_index];\n            ist->discard = 0;\n        }\n    }\n    for (i = 0; i < o->nb_attachments; i++) {\n        AVIOContext *pb;\n        uint8_t *attachment;\n        const char *p;\n        int64_t len;\n        if ((err = avio_open2(&pb, o->attachments[i], AVIO_FLAG_READ, &int_cb, NULL)) < 0) {\n            av_log(NULL, AV_LOG_FATAL, "Could not open attachment file %s.\\n",\n                   o->attachments[i]);\n            exit_program(1);\n        }\n        if ((len = avio_size(pb)) <= 0) {\n            av_log(NULL, AV_LOG_FATAL, "Could not get size of the attachment %s.\\n",\n                   o->attachments[i]);\n            exit_program(1);\n        }\n        if (!(attachment = av_malloc(len))) {\n            av_log(NULL, AV_LOG_FATAL, "Attachment %s too large to fit into memory.\\n",\n                   o->attachments[i]);\n            exit_program(1);\n        }\n        avio_read(pb, attachment, len);\n        ost = new_attachment_stream(o, oc);\n        ost->stream_copy               = 0;\n        ost->source_index              = -1;\n        ost->attachment_filename       = o->attachments[i];\n        ost->st->codec->extradata      = attachment;\n        ost->st->codec->extradata_size = len;\n        p = strrchr(o->attachments[i], \'/\');\n        av_dict_set(&ost->st->metadata, "filename", (p && *p) ? p + 1 : o->attachments[i], AV_DICT_DONT_OVERWRITE);\n        avio_close(pb);\n    }\n    output_files = grow_array(output_files, sizeof(*output_files), &nb_output_files, nb_output_files + 1);\n    output_files[nb_output_files - 1].ctx       = oc;\n    output_files[nb_output_files - 1].ost_index = nb_output_streams - oc->nb_streams;\n    output_files[nb_output_files - 1].recording_time = o->recording_time;\n    output_files[nb_output_files - 1].start_time     = o->start_time;\n    output_files[nb_output_files - 1].limit_filesize = o->limit_filesize;\n    av_dict_copy(&output_files[nb_output_files - 1].opts, format_opts, 0);\n    if (oc->oformat->flags & AVFMT_NEEDNUMBER) {\n        if (!av_filename_number_test(oc->filename)) {\n            print_error(oc->filename, AVERROR(EINVAL));\n            exit_program(1);\n        }\n    }\n    if (!(oc->oformat->flags & AVFMT_NOFILE)) {\n        assert_file_overwrite(filename);\n        if ((err = avio_open2(&oc->pb, filename, AVIO_FLAG_WRITE,\n                              &oc->interrupt_callback,\n                              &output_files[nb_output_files - 1].opts)) < 0) {\n            print_error(filename, err);\n            exit_program(1);\n        }\n    }\n    if (o->mux_preload) {\n        uint8_t buf[64];\n        snprintf(buf, sizeof(buf), "%d", (int)(o->mux_preload*AV_TIME_BASE));\n        av_dict_set(&output_files[nb_output_files - 1].opts, "preload", buf, 0);\n    }\n    oc->max_delay = (int)(o->mux_max_delay * AV_TIME_BASE);\n    oc->flags |= AVFMT_FLAG_NONBLOCK;\n    for (i = 0; i < o->nb_metadata_map; i++) {\n        char *p;\n        int in_file_index = strtol(o->metadata_map[i].u.str, &p, 0);\n        if (in_file_index < 0)\n            continue;\n        if (in_file_index >= nb_input_files) {\n            av_log(NULL, AV_LOG_FATAL, "Invalid input file index %d while processing metadata maps\\n", in_file_index);\n            exit_program(1);\n        }\n        copy_metadata(o->metadata_map[i].specifier, *p ? p + 1 : p, oc, input_files[in_file_index].ctx, o);\n    }\n    if (o->chapters_input_file >= nb_input_files) {\n        if (o->chapters_input_file == INT_MAX) {\n            o->chapters_input_file = -1;\n            for (i = 0; i < nb_input_files; i++)\n                if (input_files[i].ctx->nb_chapters) {\n                    o->chapters_input_file = i;\n                    break;\n                }\n        } else {\n            av_log(NULL, AV_LOG_FATAL, "Invalid input file index %d in chapter mapping.\\n",\n                   o->chapters_input_file);\n            exit_program(1);\n        }\n    }\n    if (o->chapters_input_file >= 0)\n        copy_chapters(&input_files[o->chapters_input_file], &output_files[nb_output_files - 1],\n                      !o->metadata_chapters_manual);\n    if (!o->metadata_global_manual && nb_input_files)\n        av_dict_copy(&oc->metadata, input_files[0].ctx->metadata,\n                     AV_DICT_DONT_OVERWRITE);\n    if (!o->metadata_streams_manual)\n        for (i = output_files[nb_output_files - 1].ost_index; i < nb_output_streams; i++) {\n            InputStream *ist;\n            if (output_streams[i].source_index < 0)\n                continue;\n            ist = &input_streams[output_streams[i].source_index];\n            av_dict_copy(&output_streams[i].st->metadata, ist->st->metadata, AV_DICT_DONT_OVERWRITE);\n        }\n    for (i = 0; i < o->nb_metadata; i++) {\n        AVDictionary **m;\n        char type, *val;\n        const char *stream_spec;\n        int index = 0, j, ret;\n        val = strchr(o->metadata[i].u.str, \'=\');\n        if (!val) {\n            av_log(NULL, AV_LOG_FATAL, "No \'=\' character in metadata string %s.\\n",\n                   o->metadata[i].u.str);\n            exit_program(1);\n        }\n        *val++ = 0;\n        parse_meta_type(o->metadata[i].specifier, &type, &index, &stream_spec);\n        if (type == \'s\') {\n            for (j = 0; j < oc->nb_streams; j++) {\n                if ((ret = check_stream_specifier(oc, oc->streams[j], stream_spec)) > 0) {\n                    av_dict_set(&oc->streams[j]->metadata, o->metadata[i].u.str, *val ? val : NULL, 0);\n                } else if (ret < 0)\n                    exit_program(1);\n            }\n            printf("ret %d, stream_spec %s\\n", ret, stream_spec);\n        }\n        else {\n            switch (type) {\n            case \'g\':\n                m = &oc->metadata;\n                break;\n            case \'c\':\n                if (index < 0 || index >= oc->nb_chapters) {\n                    av_log(NULL, AV_LOG_FATAL, "Invalid chapter index %d in metadata specifier.\\n", index);\n                    exit_program(1);\n                }\n                m = &oc->chapters[index]->metadata;\n                break;\n            default:\n                av_log(NULL, AV_LOG_FATAL, "Invalid metadata specifier %s.\\n", o->metadata[i].specifier);\n                exit_program(1);\n            }\n            av_dict_set(m, o->metadata[i].u.str, *val ? val : NULL, 0);\n        }\n    }\n    reset_options(o);\n}', 'static void parse_meta_type(char *arg, char *type, int *index, const char **stream_spec)\n{\n    if (*arg) {\n        *type = *arg;\n        switch (*arg) {\n        case \'g\':\n            break;\n        case \'s\':\n            if (*(++arg) && *arg != \':\') {\n                av_log(NULL, AV_LOG_FATAL, "Invalid metadata specifier %s.\\n", arg);\n                exit_program(1);\n            }\n            *stream_spec = *arg == \':\' ? arg + 1 : "";\n            break;\n        case \'c\':\n        case \'p\':\n            if (*(++arg) == \':\')\n                *index = strtol(++arg, NULL, 0);\n            break;\n        default:\n            av_log(NULL, AV_LOG_FATAL, "Invalid metadata type %c.\\n", *arg);\n            exit_program(1);\n        }\n    } else\n        *type = \'g\';\n}', 'int check_stream_specifier(AVFormatContext *s, AVStream *st, const char *spec)\n{\n    if (*spec <= \'9\' && *spec >= \'0\')\n        return strtol(spec, NULL, 0) == st->index;\n    else if (*spec == \'v\' || *spec == \'a\' || *spec == \'s\' || *spec == \'d\' ||\n             *spec == \'t\') {\n        enum AVMediaType type;\n        switch (*spec++) {\n        case \'v\': type = AVMEDIA_TYPE_VIDEO;      break;\n        case \'a\': type = AVMEDIA_TYPE_AUDIO;      break;\n        case \'s\': type = AVMEDIA_TYPE_SUBTITLE;   break;\n        case \'d\': type = AVMEDIA_TYPE_DATA;       break;\n        case \'t\': type = AVMEDIA_TYPE_ATTACHMENT; break;\n        }\n        if (type != st->codec->codec_type)\n            return 0;\n        if (*spec++ == \':\') {\n            int i, index = strtol(spec, NULL, 0);\n            for (i = 0; i < s->nb_streams; i++)\n                if (s->streams[i]->codec->codec_type == type && index-- == 0)\n                   return i == st->index;\n            return 0;\n        }\n        return 1;\n    } else if (*spec == \'p\' && *(spec + 1) == \':\') {\n        int prog_id, i, j;\n        char *endptr;\n        spec += 2;\n        prog_id = strtol(spec, &endptr, 0);\n        for (i = 0; i < s->nb_programs; i++) {\n            if (s->programs[i]->id != prog_id)\n                continue;\n            if (*endptr++ == \':\') {\n                int stream_idx = strtol(endptr, NULL, 0);\n                return stream_idx >= 0 &&\n                    stream_idx < s->programs[i]->nb_stream_indexes &&\n                    st->index == s->programs[i]->stream_index[stream_idx];\n            }\n            for (j = 0; j < s->programs[i]->nb_stream_indexes; j++)\n                if (st->index == s->programs[i]->stream_index[j])\n                    return 1;\n        }\n        return 0;\n    } else if (!*spec)\n        return 1;\n    av_log(s, AV_LOG_ERROR, "Invalid stream specifier: %s.\\n", spec);\n    return AVERROR(EINVAL);\n}']