libavformat/rtsp.c:1170: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `av_strlcatf`.

libavformat/rtsp.c:1085:1: Parameter `transport.strlen`
1083.  * @return 0 on success, <0 on error, 1 if protocol is unavailable.
1084.  */
1085. static int make_setup_request(AVFormatContext *s, const char *host, int port,
      ^
1086.                               int lower_transport, const char *real_challenge)
1087. {

libavformat/rtsp.c:1170:13: Call
1168.             if (rt->server_type != RTSP_SERVER_REAL)
1169.                 av_strlcat(transport, "unicast;", sizeof(transport));
1170.             av_strlcatf(transport, sizeof(transport),
                  ^
1171.                      "client_port=%d", port);
1172.             if (rt->transport == RTSP_TRANSPORT_RTP &&

libavutil/avstring.c:82:1: <LHS trace>
80. }
81. 
82. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
    ^
83. {
84.     int len = strlen(dst);

libavutil/avstring.c:82:1: Parameter `size`
  80. }
  81. 
  82. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
      ^
  83. {
  84.     int len = strlen(dst);

libavutil/avstring.c:88:12: <RHS trace>
86. 
87.     va_start(vl, fmt);
88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
               ^
89.     va_end(vl);
90. 

libavutil/avstring.c:88:12: Risky value from: vsnprintf
  86. 
  87.     va_start(vl, fmt);
  88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                 ^
  89.     va_end(vl);
  90. 

libavutil/avstring.c:88:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `av_strlcatf` 
  86. 
  87.     va_start(vl, fmt);
  88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
          ^
  89.     va_end(vl);
  90. 

size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
{
    int len = strlen(dst);
    va_list vl;
    va_start(vl, fmt);
    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
    va_end(vl);
    return len;
}
['static int make_setup_request(AVFormatContext *s, const char *host, int port,\n                              int lower_transport, const char *real_challenge)\n{\n    RTSPState *rt = s->priv_data;\n    int rtx, j, i, err, interleave = 0;\n    RTSPStream *rtsp_st;\n    RTSPMessageHeader reply1, *reply = &reply1;\n    char cmd[2048];\n    const char *trans_pref;\n    if (rt->transport == RTSP_TRANSPORT_RDT)\n        trans_pref = "x-pn-tng";\n    else\n        trans_pref = "RTP/AVP";\n    rt->timeout = 60;\n    for (j = RTSP_RTP_PORT_MIN, i = 0; i < rt->nb_rtsp_streams; ++i) {\n        char transport[2048];\n        if (lower_transport == RTSP_LOWER_TRANSPORT_UDP &&\n             rt->server_type == RTSP_SERVER_WMS) {\n            if (i == 0) {\n                for (rtx = 0; rtx < rt->nb_rtsp_streams; rtx++) {\n                    int len = strlen(rt->rtsp_streams[rtx]->control_url);\n                    if (len >= 4 &&\n                        !strcmp(rt->rtsp_streams[rtx]->control_url + len - 4,\n                                "/rtx"))\n                        break;\n                }\n                if (rtx == rt->nb_rtsp_streams)\n                    return -1;\n                rtsp_st = rt->rtsp_streams[rtx];\n            } else\n                rtsp_st = rt->rtsp_streams[i > rtx ? i : i - 1];\n        } else\n            rtsp_st = rt->rtsp_streams[i];\n        if (lower_transport == RTSP_LOWER_TRANSPORT_UDP) {\n            char buf[256];\n            if (rt->server_type == RTSP_SERVER_WMS && i > 1) {\n                port = reply->transports[0].client_port_min;\n                goto have_port;\n            }\n            if (RTSP_RTP_PORT_MIN != 0) {\n                while (j <= RTSP_RTP_PORT_MAX) {\n                    ff_url_join(buf, sizeof(buf), "rtp", NULL, host, -1,\n                                "?localport=%d", j);\n                    j += 2;\n                    if (url_open(&rtsp_st->rtp_handle, buf, URL_RDWR) == 0)\n                        goto rtp_opened;\n                }\n            }\n#if 0\n            if (url_open(&rtsp_st->rtp_handle, "rtp://", URL_RDONLY) < 0) {\n                err = AVERROR_INVALIDDATA;\n                goto fail;\n            }\n#endif\n        rtp_opened:\n            port = rtp_get_local_port(rtsp_st->rtp_handle);\n        have_port:\n            snprintf(transport, sizeof(transport) - 1,\n                     "%s/UDP;", trans_pref);\n            if (rt->server_type != RTSP_SERVER_REAL)\n                av_strlcat(transport, "unicast;", sizeof(transport));\n            av_strlcatf(transport, sizeof(transport),\n                     "client_port=%d", port);\n            if (rt->transport == RTSP_TRANSPORT_RTP &&\n                !(rt->server_type == RTSP_SERVER_WMS && i > 0))\n                av_strlcatf(transport, sizeof(transport), "-%d", port + 1);\n        }\n        else if (lower_transport == RTSP_LOWER_TRANSPORT_TCP) {\n            if (rt->server_type == RTSP_SERVER_WMS &&\n                s->streams[rtsp_st->stream_index]->codec->codec_type ==\n                    CODEC_TYPE_DATA)\n                continue;\n            snprintf(transport, sizeof(transport) - 1,\n                     "%s/TCP;", trans_pref);\n            if (rt->server_type == RTSP_SERVER_WMS)\n                av_strlcat(transport, "unicast;", sizeof(transport));\n            av_strlcatf(transport, sizeof(transport),\n                        "interleaved=%d-%d",\n                        interleave, interleave + 1);\n            interleave += 2;\n        }\n        else if (lower_transport == RTSP_LOWER_TRANSPORT_UDP_MULTICAST) {\n            snprintf(transport, sizeof(transport) - 1,\n                     "%s/UDP;multicast", trans_pref);\n        }\n        if (s->oformat) {\n            av_strlcat(transport, ";mode=receive", sizeof(transport));\n        } else if (rt->server_type == RTSP_SERVER_REAL ||\n                   rt->server_type == RTSP_SERVER_WMS)\n            av_strlcat(transport, ";mode=play", sizeof(transport));\n        snprintf(cmd, sizeof(cmd),\n                 "Transport: %s\\r\\n",\n                 transport);\n        if (i == 0 && rt->server_type == RTSP_SERVER_REAL) {\n            char real_res[41], real_csum[9];\n            ff_rdt_calc_response_and_checksum(real_res, real_csum,\n                                              real_challenge);\n            av_strlcatf(cmd, sizeof(cmd),\n                        "If-Match: %s\\r\\n"\n                        "RealChallenge2: %s, sd=%s\\r\\n",\n                        rt->session_id, real_res, real_csum);\n        }\n        ff_rtsp_send_cmd(s, "SETUP", rtsp_st->control_url, cmd, reply, NULL);\n        if (reply->status_code == 461   && i == 0) {\n            err = 1;\n            goto fail;\n        } else if (reply->status_code != RTSP_STATUS_OK ||\n                   reply->nb_transports != 1) {\n            err = AVERROR_INVALIDDATA;\n            goto fail;\n        }\n        if (i > 0) {\n            if (reply->transports[0].lower_transport != rt->lower_transport ||\n                reply->transports[0].transport != rt->transport) {\n                err = AVERROR_INVALIDDATA;\n                goto fail;\n            }\n        } else {\n            rt->lower_transport = reply->transports[0].lower_transport;\n            rt->transport = reply->transports[0].transport;\n        }\n        if (reply->transports[0].lower_transport != RTSP_LOWER_TRANSPORT_UDP &&\n            (lower_transport == RTSP_LOWER_TRANSPORT_UDP)) {\n            url_close(rtsp_st->rtp_handle);\n            rtsp_st->rtp_handle = NULL;\n        }\n        switch(reply->transports[0].lower_transport) {\n        case RTSP_LOWER_TRANSPORT_TCP:\n            rtsp_st->interleaved_min = reply->transports[0].interleaved_min;\n            rtsp_st->interleaved_max = reply->transports[0].interleaved_max;\n            break;\n        case RTSP_LOWER_TRANSPORT_UDP: {\n            char url[1024];\n            ff_url_join(url, sizeof(url), "rtp", NULL, host,\n                        reply->transports[0].server_port_min, NULL);\n            if (!(rt->server_type == RTSP_SERVER_WMS && i > 1) &&\n                rtp_set_remote_url(rtsp_st->rtp_handle, url) < 0) {\n                err = AVERROR_INVALIDDATA;\n                goto fail;\n            }\n            if (!(rt->server_type == RTSP_SERVER_WMS && i > 1) && s->iformat)\n                rtp_send_punch_packets(rtsp_st->rtp_handle);\n            break;\n        }\n        case RTSP_LOWER_TRANSPORT_UDP_MULTICAST: {\n            char url[1024];\n            struct in_addr in;\n            int port, ttl;\n            if (reply->transports[0].destination) {\n                in.s_addr = htonl(reply->transports[0].destination);\n                port      = reply->transports[0].port_min;\n                ttl       = reply->transports[0].ttl;\n            } else {\n                in        = rtsp_st->sdp_ip;\n                port      = rtsp_st->sdp_port;\n                ttl       = rtsp_st->sdp_ttl;\n            }\n            ff_url_join(url, sizeof(url), "rtp", NULL, inet_ntoa(in),\n                        port, "?ttl=%d", ttl);\n            if (url_open(&rtsp_st->rtp_handle, url, URL_RDWR) < 0) {\n                err = AVERROR_INVALIDDATA;\n                goto fail;\n            }\n            break;\n        }\n        }\n        if ((err = rtsp_open_transport_ctx(s, rtsp_st)))\n            goto fail;\n    }\n    if (reply->timeout > 0)\n        rt->timeout = reply->timeout;\n    if (rt->server_type == RTSP_SERVER_REAL)\n        rt->need_subscription = 1;\n    return 0;\nfail:\n    for (i = 0; i < rt->nb_rtsp_streams; i++) {\n        if (rt->rtsp_streams[i]->rtp_handle) {\n            url_close(rt->rtsp_streams[i]->rtp_handle);\n            rt->rtsp_streams[i]->rtp_handle = NULL;\n        }\n    }\n    return err;\n}', 'size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)\n{\n    int len = strlen(dst);\n    va_list vl;\n    va_start(vl, fmt);\n    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);\n    va_end(vl);\n    return len;\n}']