libavformat/rtsp.c:1343: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `ff_rdt_subscribe_rule`.

libavformat/rtsp.c:1293:1: Parameter `s->priv_data->last_subscription.*.strlen`
1291. }
1292. 
1293. static int rtsp_read_packet(AVFormatContext *s,
      ^
1294.                             AVPacket *pkt)
1295. {

libavformat/rtsp.c:1343:29: Call
1341.                                 av_strlcat(rt->last_subscription, ",",
1342.                                            sizeof(rt->last_subscription));
1343.                             ff_rdt_subscribe_rule(
                                  ^
1344.                                 rt->last_subscription,
1345.                                 sizeof(rt->last_subscription), i, rule_nr);

libavformat/rdt.c:384:1: Parameter `cmd->strlen`
  382. }
  383. 
  384. void
       ^
  385. ff_rdt_subscribe_rule (char *cmd, int size,
  386.                        int stream_nr, int rule_nr)

libavformat/rdt.c:388:5: Call
  386.                        int stream_nr, int rule_nr)
  387. {
  388.     av_strlcatf(cmd, size, "stream=%d;rule=%d,stream=%d;rule=%d",
           ^
  389.                 stream_nr, rule_nr * 2, stream_nr, rule_nr * 2 + 1);
  390. }

libavutil/string.c:68:1: <LHS trace>
66. }
67. 
68. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
    ^
69. {
70.     int len = strlen(dst);

libavutil/string.c:68:1: Parameter `size`
    66. }
    67. 
    68. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
        ^
    69. {
    70.     int len = strlen(dst);

libavutil/string.c:74:12: <RHS trace>
72. 
73.     va_start(vl, fmt);
74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
               ^
75.     va_end(vl);
76. 

libavutil/string.c:74:12: Risky value from: vsnprintf
    72. 
    73.     va_start(vl, fmt);
    74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                   ^
    75.     va_end(vl);
    76. 

libavutil/string.c:74:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `ff_rdt_subscribe_rule` 
    72. 
    73.     va_start(vl, fmt);
    74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
            ^
    75.     va_end(vl);
    76. 

size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
{
    int len = strlen(dst);
    va_list vl;
    va_start(vl, fmt);
    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
    va_end(vl);
    return len;
}
['static int rtsp_read_packet(AVFormatContext *s,\n                            AVPacket *pkt)\n{\n    RTSPState *rt = s->priv_data;\n    RTSPStream *rtsp_st;\n    int ret, len;\n    uint8_t buf[10 * RTP_MAX_PACKET_LENGTH];\n    if (rt->server_type == RTSP_SERVER_REAL) {\n        int i;\n        RTSPHeader reply1, *reply = &reply1;\n        enum AVDiscard cache[MAX_STREAMS];\n        char cmd[1024];\n        for (i = 0; i < s->nb_streams; i++)\n            cache[i] = s->streams[i]->discard;\n        if (!rt->need_subscription) {\n            if (memcmp (cache, rt->real_setup_cache,\n                        sizeof(enum AVDiscard) * s->nb_streams)) {\n                av_strlcatf(cmd, sizeof(cmd),\n                            "SET_PARAMETER %s RTSP/1.0\\r\\n"\n                            "Unsubscribe: %s\\r\\n",\n                            s->filename, rt->last_subscription);\n                rtsp_send_cmd(s, cmd, reply, NULL);\n                if (reply->status_code != RTSP_STATUS_OK)\n                    return AVERROR_INVALIDDATA;\n                rt->need_subscription = 1;\n            }\n        }\n        if (rt->need_subscription) {\n            int r, rule_nr, first = 1;\n            memcpy(rt->real_setup_cache, cache,\n                   sizeof(enum AVDiscard) * s->nb_streams);\n            rt->last_subscription[0] = 0;\n            snprintf(cmd, sizeof(cmd),\n                     "SET_PARAMETER %s RTSP/1.0\\r\\n"\n                     "Subscribe: ",\n                     s->filename);\n            for (i = 0; i < rt->nb_rtsp_streams; i++) {\n                rule_nr = 0;\n                for (r = 0; r < s->nb_streams; r++) {\n                    if (s->streams[r]->priv_data == rt->rtsp_streams[i]) {\n                        if (s->streams[r]->discard != AVDISCARD_ALL) {\n                            if (!first)\n                                av_strlcat(rt->last_subscription, ",",\n                                           sizeof(rt->last_subscription));\n                            ff_rdt_subscribe_rule(\n                                rt->last_subscription,\n                                sizeof(rt->last_subscription), i, rule_nr);\n                            first = 0;\n                        }\n                        rule_nr++;\n                    }\n                }\n            }\n            av_strlcatf(cmd, sizeof(cmd), "%s\\r\\n", rt->last_subscription);\n            rtsp_send_cmd(s, cmd, reply, NULL);\n            if (reply->status_code != RTSP_STATUS_OK)\n                return AVERROR_INVALIDDATA;\n            rt->need_subscription = 0;\n            if (rt->state == RTSP_STATE_PLAYING)\n                rtsp_read_play (s);\n        }\n    }\n    if (rt->cur_tx) {\n        if (rt->transport == RTSP_TRANSPORT_RDT)\n            ret = ff_rdt_parse_packet(rt->cur_tx, pkt, NULL, 0);\n        else\n            ret = rtp_parse_packet(rt->cur_tx, pkt, NULL, 0);\n        if (ret == 0) {\n            rt->cur_tx = NULL;\n            return 0;\n        } else if (ret == 1) {\n            return 0;\n        } else {\n            rt->cur_tx = NULL;\n        }\n    }\n redo:\n    switch(rt->lower_transport) {\n    default:\n    case RTSP_LOWER_TRANSPORT_TCP:\n        len = tcp_read_packet(s, &rtsp_st, buf, sizeof(buf));\n        break;\n    case RTSP_LOWER_TRANSPORT_UDP:\n    case RTSP_LOWER_TRANSPORT_UDP_MULTICAST:\n        len = udp_read_packet(s, &rtsp_st, buf, sizeof(buf));\n        if (len >=0 && rtsp_st->tx_ctx && rt->transport == RTSP_TRANSPORT_RTP)\n            rtp_check_and_send_back_rr(rtsp_st->tx_ctx, len);\n        break;\n    }\n    if (len < 0)\n        return len;\n    if (rt->transport == RTSP_TRANSPORT_RDT)\n        ret = ff_rdt_parse_packet(rtsp_st->tx_ctx, pkt, buf, len);\n    else\n        ret = rtp_parse_packet(rtsp_st->tx_ctx, pkt, buf, len);\n    if (ret < 0)\n        goto redo;\n    if (ret == 1) {\n        rt->cur_tx = rtsp_st->tx_ctx;\n    }\n    return 0;\n}', 'void\nff_rdt_subscribe_rule (char *cmd, int size,\n                       int stream_nr, int rule_nr)\n{\n    av_strlcatf(cmd, size, "stream=%d;rule=%d,stream=%d;rule=%d",\n                stream_nr, rule_nr * 2, stream_nr, rule_nr * 2 + 1);\n}', 'size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)\n{\n    int len = strlen(dst);\n    va_list vl;\n    va_start(vl, fmt);\n    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);\n    va_end(vl);\n    return len;\n}']