libavformat/gxfenc.c:199: error: Integer Overflow R2
  ([0, +oo] + 3):signed32.

libavformat/gxfenc.c:191:12: <LHS trace>
189.         starting_line = 23; // default PAL
190. 
191.     size = snprintf(buffer, 1024, "Ver 1\nBr %.6f\nIpg 1\nPpi %d\nBpiop %d\n"
                ^
192.                     "Pix 0\nCf %d\nCg %d\nSl %d\nnl16 %d\nVi 1\nf1 1\n",
193.                     (float)st->codecpar->bit_rate, sc->p_per_gop, sc->b_per_i_or_p,

libavformat/gxfenc.c:191:12: Risky value from: snprintf
189.         starting_line = 23; // default PAL
190. 
191.     size = snprintf(buffer, 1024, "Ver 1\nBr %.6f\nIpg 1\nPpi %d\nBpiop %d\n"
                ^
192.                     "Pix 0\nCf %d\nCg %d\nSl %d\nnl16 %d\nVi 1\nf1 1\n",
193.                     (float)st->codecpar->bit_rate, sc->p_per_gop, sc->b_per_i_or_p,

libavformat/gxfenc.c:191:5: Assignment
189.         starting_line = 23; // default PAL
190. 
191.     size = snprintf(buffer, 1024, "Ver 1\nBr %.6f\nIpg 1\nPpi %d\nBpiop %d\n"
         ^
192.                     "Pix 0\nCf %d\nCg %d\nSl %d\nnl16 %d\nVi 1\nf1 1\n",
193.                     (float)st->codecpar->bit_rate, sc->p_per_gop, sc->b_per_i_or_p,

libavformat/gxfenc.c:199:5: Binary operation: ([0, +oo] + 3):signed32
197.     avio_w8(pb, size + 1);
198.     avio_write(pb, (uint8_t *)buffer, size + 1);
199.     return size + 3;
         ^
200. }
201. 

static int gxf_write_mpeg_auxiliary(AVIOContext *pb, AVStream *st)
{
    GXFStreamContext *sc = st->priv_data;
    char buffer[1024];
    int size, starting_line;
    if (sc->iframes) {
        sc->p_per_gop = sc->pframes / sc->iframes;
        if (sc->pframes % sc->iframes)
            sc->p_per_gop++;
        if (sc->pframes) {
            sc->b_per_i_or_p = sc->bframes / sc->pframes;
            if (sc->bframes % sc->pframes)
                sc->b_per_i_or_p++;
        }
        if (sc->p_per_gop > 9)
            sc->p_per_gop = 9;
        if (sc->b_per_i_or_p > 9)
            sc->b_per_i_or_p = 9;
    }
    if (st->codecpar->height == 512 || st->codecpar->height == 608)
        starting_line = 7;
    else if (st->codecpar->height == 480)
        starting_line = 20;
    else
        starting_line = 23;
    size = snprintf(buffer, 1024, "Ver 1\nBr %.6f\nIpg 1\nPpi %d\nBpiop %d\n"
                    "Pix 0\nCf %d\nCg %d\nSl %d\nnl16 %d\nVi 1\nf1 1\n",
                    (float)st->codecpar->bit_rate, sc->p_per_gop, sc->b_per_i_or_p,
                    st->codecpar->format  == AV_PIX_FMT_YUV422P ? 2 : 1, sc->first_gop_closed == 1,
                    starting_line, (st->codecpar->height + 15) / 16);
    avio_w8(pb, TRACK_MPG_AUX);
    avio_w8(pb, size + 1);
    avio_write(pb, (uint8_t *)buffer, size + 1);
    return size + 3;
}
['static int gxf_write_mpeg_auxiliary(AVIOContext *pb, AVStream *st)\n{\n    GXFStreamContext *sc = st->priv_data;\n    char buffer[1024];\n    int size, starting_line;\n    if (sc->iframes) {\n        sc->p_per_gop = sc->pframes / sc->iframes;\n        if (sc->pframes % sc->iframes)\n            sc->p_per_gop++;\n        if (sc->pframes) {\n            sc->b_per_i_or_p = sc->bframes / sc->pframes;\n            if (sc->bframes % sc->pframes)\n                sc->b_per_i_or_p++;\n        }\n        if (sc->p_per_gop > 9)\n            sc->p_per_gop = 9;\n        if (sc->b_per_i_or_p > 9)\n            sc->b_per_i_or_p = 9;\n    }\n    if (st->codecpar->height == 512 || st->codecpar->height == 608)\n        starting_line = 7;\n    else if (st->codecpar->height == 480)\n        starting_line = 20;\n    else\n        starting_line = 23;\n    size = snprintf(buffer, 1024, "Ver 1\\nBr %.6f\\nIpg 1\\nPpi %d\\nBpiop %d\\n"\n                    "Pix 0\\nCf %d\\nCg %d\\nSl %d\\nnl16 %d\\nVi 1\\nf1 1\\n",\n                    (float)st->codecpar->bit_rate, sc->p_per_gop, sc->b_per_i_or_p,\n                    st->codecpar->format  == AV_PIX_FMT_YUV422P ? 2 : 1, sc->first_gop_closed == 1,\n                    starting_line, (st->codecpar->height + 15) / 16);\n    avio_w8(pb, TRACK_MPG_AUX);\n    avio_w8(pb, size + 1);\n    avio_write(pb, (uint8_t *)buffer, size + 1);\n    return size + 3;\n}']