libavformat/matroskaenc.c:1189: error: Integer Overflow R2
  ([0, +oo] + [-oo, +oo]):signed32.

libavformat/matroskaenc.c:1187:13: <LHS trace>
1185.         size -= start - data;
1186.         sscanf(data, "Dialogue: %d,", &layer);
1187.         i = snprintf(buffer, sizeof(buffer), "%" PRId64 ",%d,",
                  ^
1188.                      s->streams[pkt->stream_index]->nb_frames, layer);
1189.         size = FFMIN(i + size, sizeof(buffer));

libavformat/matroskaenc.c:1187:13: Risky value from: snprintf
1185.         size -= start - data;
1186.         sscanf(data, "Dialogue: %d,", &layer);
1187.         i = snprintf(buffer, sizeof(buffer), "%" PRId64 ",%d,",
                  ^
1188.                      s->streams[pkt->stream_index]->nb_frames, layer);
1189.         size = FFMIN(i + size, sizeof(buffer));

libavformat/matroskaenc.c:1187:9: Assignment
1185.         size -= start - data;
1186.         sscanf(data, "Dialogue: %d,", &layer);
1187.         i = snprintf(buffer, sizeof(buffer), "%" PRId64 ",%d,",
              ^
1188.                      s->streams[pkt->stream_index]->nb_frames, layer);
1189.         size = FFMIN(i + size, sizeof(buffer));

libavformat/matroskaenc.c:1166:1: <RHS trace>
1164. }
1165. 
1166. static int mkv_write_ass_blocks(AVFormatContext *s, AVIOContext *pb,
      ^
1167.                                 AVPacket *pkt)
1168. {

libavformat/matroskaenc.c:1166:1: Parameter `*pkt->data`
1164. }
1165. 
1166. static int mkv_write_ass_blocks(AVFormatContext *s, AVIOContext *pb,
      ^
1167.                                 AVPacket *pkt)
1168. {

libavformat/matroskaenc.c:1171:5: Assignment
1169.     MatroskaMuxContext *mkv = s->priv_data;
1170.     int i, layer = 0, max_duration = 0, size, line_size, data_size = pkt->size;
1171.     uint8_t *start, *end, *data = pkt->data;
          ^
1172.     ebml_master blockgroup;
1173.     char buffer[2048];

libavformat/matroskaenc.c:1185:9: Assignment
1183.             if (!(start = memchr(start, ',', size - (start - data))))
1184.                 return max_duration;
1185.         size -= start - data;
              ^
1186.         sscanf(data, "Dialogue: %d,", &layer);
1187.         i = snprintf(buffer, sizeof(buffer), "%" PRId64 ",%d,",

libavformat/matroskaenc.c:1189:16: Binary operation: ([0, +oo] + [-oo, +oo]):signed32
1187.         i = snprintf(buffer, sizeof(buffer), "%" PRId64 ",%d,",
1188.                      s->streams[pkt->stream_index]->nb_frames, layer);
1189.         size = FFMIN(i + size, sizeof(buffer));
                     ^
1190.         memcpy(buffer + i, start, size - i);
1191. 

static int mkv_write_ass_blocks(AVFormatContext *s, AVIOContext *pb,
                                AVPacket *pkt)
{
    MatroskaMuxContext *mkv = s->priv_data;
    int i, layer = 0, max_duration = 0, size, line_size, data_size = pkt->size;
    uint8_t *start, *end, *data = pkt->data;
    ebml_master blockgroup;
    char buffer[2048];
    while (data_size) {
        int duration = ass_get_duration(data);
        max_duration = FFMAX(duration, max_duration);
        end          = memchr(data, '\n', data_size);
        size         = line_size = end ? end - data + 1 : data_size;
        size        -= end ? (end[-1] == '\r') + 1 : 0;
        start        = data;
        for (i = 0; i < 3; i++, start++)
            if (!(start = memchr(start, ',', size - (start - data))))
                return max_duration;
        size -= start - data;
        sscanf(data, "Dialogue: %d,", &layer);
        i = snprintf(buffer, sizeof(buffer), "%" PRId64 ",%d,",
                     s->streams[pkt->stream_index]->nb_frames, layer);
        size = FFMIN(i + size, sizeof(buffer));
        memcpy(buffer + i, start, size - i);
        av_log(s, AV_LOG_DEBUG,
               "Writing block at offset %" PRIu64 ", size %d, "
               "pts %" PRId64 ", duration %d\n",
               avio_tell(pb), size, pkt->pts, duration);
        blockgroup = start_ebml_master(pb, MATROSKA_ID_BLOCKGROUP,
                                       mkv_blockgroup_size(size));
        put_ebml_id(pb, MATROSKA_ID_BLOCK);
        put_ebml_num(pb, size + 4, 0);
        avio_w8(pb, 0x80 | (pkt->stream_index + 1));
        avio_wb16(pb, pkt->pts - mkv->cluster_pts);
        avio_w8(pb, 0);
        avio_write(pb, buffer, size);
        put_ebml_uint(pb, MATROSKA_ID_BLOCKDURATION, duration);
        end_ebml_master(pb, blockgroup);
        data      += line_size;
        data_size -= line_size;
    }
    return max_duration;
}
['static int mkv_write_ass_blocks(AVFormatContext *s, AVIOContext *pb,\n                                AVPacket *pkt)\n{\n    MatroskaMuxContext *mkv = s->priv_data;\n    int i, layer = 0, max_duration = 0, size, line_size, data_size = pkt->size;\n    uint8_t *start, *end, *data = pkt->data;\n    ebml_master blockgroup;\n    char buffer[2048];\n    while (data_size) {\n        int duration = ass_get_duration(data);\n        max_duration = FFMAX(duration, max_duration);\n        end          = memchr(data, \'\\n\', data_size);\n        size         = line_size = end ? end - data + 1 : data_size;\n        size        -= end ? (end[-1] == \'\\r\') + 1 : 0;\n        start        = data;\n        for (i = 0; i < 3; i++, start++)\n            if (!(start = memchr(start, \',\', size - (start - data))))\n                return max_duration;\n        size -= start - data;\n        sscanf(data, "Dialogue: %d,", &layer);\n        i = snprintf(buffer, sizeof(buffer), "%" PRId64 ",%d,",\n                     s->streams[pkt->stream_index]->nb_frames, layer);\n        size = FFMIN(i + size, sizeof(buffer));\n        memcpy(buffer + i, start, size - i);\n        av_log(s, AV_LOG_DEBUG,\n               "Writing block at offset %" PRIu64 ", size %d, "\n               "pts %" PRId64 ", duration %d\\n",\n               avio_tell(pb), size, pkt->pts, duration);\n        blockgroup = start_ebml_master(pb, MATROSKA_ID_BLOCKGROUP,\n                                       mkv_blockgroup_size(size));\n        put_ebml_id(pb, MATROSKA_ID_BLOCK);\n        put_ebml_num(pb, size + 4, 0);\n        avio_w8(pb, 0x80 | (pkt->stream_index + 1));\n        avio_wb16(pb, pkt->pts - mkv->cluster_pts);\n        avio_w8(pb, 0);\n        avio_write(pb, buffer, size);\n        put_ebml_uint(pb, MATROSKA_ID_BLOCKDURATION, duration);\n        end_ebml_master(pb, blockgroup);\n        data      += line_size;\n        data_size -= line_size;\n    }\n    return max_duration;\n}']