libavformat/srtpproto.c:76: error: Buffer Overrun L3
  Offset: [-43, 79] Size: 80 by call to `ff_srtp_set_crypto`.

libavformat/srtpproto.c:76:20: Call
74.             goto fail;
75.     if (s->in_suite && s->in_params)
76.         if ((ret = ff_srtp_set_crypto(&s->srtp_in, s->in_suite, s->in_params)) < 0)
                       ^
77.             goto fail;
78. 

libavformat/srtp.c:64:1: Parameter `*params`
  62. }
  63. 
  64. int ff_srtp_set_crypto(struct SRTPContext *s, const char *suite,
      ^
  65.                        const char *params)
  66. {

libavformat/srtp.c:81:9: Call
  79.         return AVERROR(EINVAL);
  80.     }
  81.     if (av_base64_decode(buf, params, sizeof(buf)) != sizeof(buf)) {
              ^
  82.         av_log(NULL, AV_LOG_WARNING, "Incorrect amount of SRTP params\n");
  83.         return AVERROR(EINVAL);

libavutil/base64.c:45:1: <Offset trace>
43. };
44. 
45. int av_base64_decode(uint8_t *out, const char *in, int out_size)
    ^
46. {
47.     int i;

libavutil/base64.c:45:1: Parameter `*in`
    43. };
    44. 
    45. int av_base64_decode(uint8_t *out, const char *in, int out_size)
        ^
    46. {
    47.     int i;

libavutil/base64.c:52:9: Assignment
    50. 
    51.     for (i = 0; in[i] && in[i] != '='; i++) {
    52.         unsigned int index= in[i]-43;
                ^
    53.         if (index>=FF_ARRAY_ELEMS(map2) || map2[index] == 0xff)
    54.             return -1;

libavutil/base64.c:31:1: <Length trace>
29. 
30. /* ---------------- private code */
31. static const uint8_t map2[] =
    ^
32. {
33.     0x3e, 0xff, 0xff, 0xff, 0x3f, 0x34, 0x35, 0x36,

libavutil/base64.c:31:1: Array declaration
    29. 
    30. /* ---------------- private code */
    31. static const uint8_t map2[] =
        ^
    32. {
    33.     0x3e, 0xff, 0xff, 0xff, 0x3f, 0x34, 0x35, 0x36,

libavutil/base64.c:55:24: Array access: Offset: [-43, 79] Size: 80 by call to `ff_srtp_set_crypto` 
    53.         if (index>=FF_ARRAY_ELEMS(map2) || map2[index] == 0xff)
    54.             return -1;
    55.         v = (v << 6) + map2[index];
                               ^
    56.         if (i & 3) {
    57.             if (dst - out < out_size) {

int av_base64_decode(uint8_t *out, const char *in, int out_size)
{
    int i;
    unsigned v = 0;
    uint8_t *dst = out;
    for (i = 0; in[i] && in[i] != '='; i++) {
        unsigned int index= in[i]-43;
        if (index>=FF_ARRAY_ELEMS(map2) || map2[index] == 0xff)
            return -1;
        v = (v << 6) + map2[index];
        if (i & 3) {
            if (dst - out < out_size) {
                *dst++ = v >> (6 - 2 * (i & 3));
            }
        }
    }
    return dst - out;
}
['static int srtp_open(URLContext *h, const char *uri, int flags)\n{\n    SRTPProtoContext *s = h->priv_data;\n    char hostname[256], buf[1024], path[1024];\n    int rtp_port, ret;\n    if (s->out_suite && s->out_params)\n        if ((ret = ff_srtp_set_crypto(&s->srtp_out, s->out_suite, s->out_params)) < 0)\n            goto fail;\n    if (s->in_suite && s->in_params)\n        if ((ret = ff_srtp_set_crypto(&s->srtp_in, s->in_suite, s->in_params)) < 0)\n            goto fail;\n    av_url_split(NULL, 0, NULL, 0, hostname, sizeof(hostname), &rtp_port,\n                 path, sizeof(path), uri);\n    ff_url_join(buf, sizeof(buf), "rtp", NULL, hostname, rtp_port, "%s", path);\n    if ((ret = ffurl_open(&s->rtp_hd, buf, flags, &h->interrupt_callback, NULL)) < 0)\n        goto fail;\n    h->max_packet_size = FFMIN(s->rtp_hd->max_packet_size,\n                               sizeof(s->encryptbuf)) - 14;\n    h->is_streamed = 1;\n    return 0;\nfail:\n    srtp_close(h);\n    return ret;\n}', 'int ff_srtp_set_crypto(struct SRTPContext *s, const char *suite,\n                       const char *params)\n{\n    uint8_t buf[30];\n    ff_srtp_free(s);\n    if (!strcmp(suite, "AES_CM_128_HMAC_SHA1_80")) {\n        s->hmac_size = 10;\n    } else if (!strcmp(suite, "AES_CM_128_HMAC_SHA1_32")) {\n        s->hmac_size = 4;\n    } else {\n        av_log(NULL, AV_LOG_WARNING, "SRTP Crypto suite %s not supported\\n",\n                                     suite);\n        return AVERROR(EINVAL);\n    }\n    if (av_base64_decode(buf, params, sizeof(buf)) != sizeof(buf)) {\n        av_log(NULL, AV_LOG_WARNING, "Incorrect amount of SRTP params\\n");\n        return AVERROR(EINVAL);\n    }\n    s->aes  = av_aes_alloc();\n    s->hmac = av_hmac_alloc(AV_HMAC_SHA1);\n    if (!s->aes || !s->hmac)\n        return AVERROR(ENOMEM);\n    memcpy(s->master_key, buf, 16);\n    memcpy(s->master_salt, buf + 16, 14);\n    av_aes_init(s->aes, s->master_key, 128, 0);\n    derive_key(s->aes, s->master_salt, 0x00, s->rtp_key, sizeof(s->rtp_key));\n    derive_key(s->aes, s->master_salt, 0x02, s->rtp_salt, sizeof(s->rtp_salt));\n    derive_key(s->aes, s->master_salt, 0x01, s->rtp_auth, sizeof(s->rtp_auth));\n    derive_key(s->aes, s->master_salt, 0x03, s->rtcp_key, sizeof(s->rtcp_key));\n    derive_key(s->aes, s->master_salt, 0x05, s->rtcp_salt, sizeof(s->rtcp_salt));\n    derive_key(s->aes, s->master_salt, 0x04, s->rtcp_auth, sizeof(s->rtcp_auth));\n    return 0;\n}', "int av_base64_decode(uint8_t *out, const char *in, int out_size)\n{\n    int i;\n    unsigned v = 0;\n    uint8_t *dst = out;\n    for (i = 0; in[i] && in[i] != '='; i++) {\n        unsigned int index= in[i]-43;\n        if (index>=FF_ARRAY_ELEMS(map2) || map2[index] == 0xff)\n            return -1;\n        v = (v << 6) + map2[index];\n        if (i & 3) {\n            if (dst - out < out_size) {\n                *dst++ = v >> (6 - 2 * (i & 3));\n            }\n        }\n    }\n    return dst - out;\n}"]