libavformat/mov.c:1346: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `av_strlcatf`.

libavformat/mov.c:1340:5: Call
1338.         snprintf(buf, sizeof(buf), "size: %dx%d\n",
1339.                  st->codec->width, st->codec->height);
1340.     av_strlcat(buf, "palette: ", sizeof(buf));
          ^
1341. 
1342.     for (i = 0; i < 16; i++) {

libavutil/avstring.c:91:1: Parameter `dst->strlen`
  89. }
  90. 
  91. size_t av_strlcat(char *dst, const char *src, size_t size)
      ^
  92. {
  93.     size_t len = strlen(dst);

libavformat/mov.c:1346:9: Call
1344.         uint32_t rgba = yuv_to_rgba(yuv);
1345. 
1346.         av_strlcatf(buf, sizeof(buf), "%06"PRIx32"%s", rgba, i != 15 ? ", " : "");
              ^
1347.     }
1348. 

libavutil/avstring.c:99:1: <LHS trace>
 97. }
 98. 
 99. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
     ^
100. {
101.     int len = strlen(dst);

libavutil/avstring.c:99:1: Parameter `size`
   97. }
   98. 
   99. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
       ^
  100. {
  101.     int len = strlen(dst);

libavutil/avstring.c:105:12: <RHS trace>
103. 
104.     va_start(vl, fmt);
105.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                ^
106.     va_end(vl);
107. 

libavutil/avstring.c:105:12: Risky value from: vsnprintf
  103. 
  104.     va_start(vl, fmt);
  105.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                  ^
  106.     va_end(vl);
  107. 

libavutil/avstring.c:105:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `av_strlcatf` 
  103. 
  104.     va_start(vl, fmt);
  105.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
           ^
  106.     va_end(vl);
  107. 

size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
{
    int len = strlen(dst);
    va_list vl;
    va_start(vl, fmt);
    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
    va_end(vl);
    return len;
}
['static int mov_rewrite_dvd_sub_extradata(AVStream *st)\n{\n    char buf[256] = {0};\n    uint8_t *src = st->codec->extradata;\n    int i;\n    if (st->codec->extradata_size != 64)\n        return 0;\n    if (st->codec->width > 0 &&  st->codec->height > 0)\n        snprintf(buf, sizeof(buf), "size: %dx%d\\n",\n                 st->codec->width, st->codec->height);\n    av_strlcat(buf, "palette: ", sizeof(buf));\n    for (i = 0; i < 16; i++) {\n        uint32_t yuv = AV_RB32(src + i * 4);\n        uint32_t rgba = yuv_to_rgba(yuv);\n        av_strlcatf(buf, sizeof(buf), "%06"PRIx32"%s", rgba, i != 15 ? ", " : "");\n    }\n    if (av_strlcat(buf, "\\n", sizeof(buf)) >= sizeof(buf))\n        return 0;\n    av_freep(&st->codec->extradata);\n    st->codec->extradata_size = 0;\n    st->codec->extradata = av_mallocz(strlen(buf) + FF_INPUT_BUFFER_PADDING_SIZE);\n    if (!st->codec->extradata)\n        return AVERROR(ENOMEM);\n    st->codec->extradata_size = strlen(buf);\n    memcpy(st->codec->extradata, buf, st->codec->extradata_size);\n    return 0;\n}', 'size_t av_strlcat(char *dst, const char *src, size_t size)\n{\n    size_t len = strlen(dst);\n    if (size <= len + 1)\n        return len + strlen(src);\n    return len + av_strlcpy(dst + len, src, size - len);\n}', 'size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)\n{\n    int len = strlen(dst);\n    va_list vl;\n    va_start(vl, fmt);\n    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);\n    va_end(vl);\n    return len;\n}']