libavformat/http.c:348: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `av_strlcatf`.

libavformat/http.c:325:5: Array declaration
323.     int post, err;
324.     char line[1024];
325.     char headers[1024] = "";
         ^
326.     char *authstr = NULL, *proxyauthstr = NULL;
327.     int64_t off = s->off;

libavformat/http.c:348:16: Call
346.                           sizeof(headers) - len);
347.     if (!has_header(s->headers, "\r\nRange: ") && !post)
348.         len += av_strlcatf(headers + len, sizeof(headers) - len,
                    ^
349.                            "Range: bytes=%"PRId64"-\r\n", s->off);
350.     if (!has_header(s->headers, "\r\nConnection: "))

libavutil/avstring.c:82:1: <LHS trace>
80. }
81. 
82. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
    ^
83. {
84.     int len = strlen(dst);

libavutil/avstring.c:82:1: Parameter `size`
  80. }
  81. 
  82. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
      ^
  83. {
  84.     int len = strlen(dst);

libavutil/avstring.c:88:12: <RHS trace>
86. 
87.     va_start(vl, fmt);
88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
               ^
89.     va_end(vl);
90. 

libavutil/avstring.c:88:12: Risky value from: vsnprintf
  86. 
  87.     va_start(vl, fmt);
  88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                 ^
  89.     va_end(vl);
  90. 

libavutil/avstring.c:88:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `av_strlcatf` 
  86. 
  87.     va_start(vl, fmt);
  88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
          ^
  89.     va_end(vl);
  90. 

size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
{
    int len = strlen(dst);
    va_list vl;
    va_start(vl, fmt);
    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
    va_end(vl);
    return len;
}
['static int http_connect(URLContext *h, const char *path, const char *local_path,\n                        const char *hoststr, const char *auth,\n                        const char *proxyauth, int *new_location)\n{\n    HTTPContext *s = h->priv_data;\n    int post, err;\n    char line[1024];\n    char headers[1024] = "";\n    char *authstr = NULL, *proxyauthstr = NULL;\n    int64_t off = s->off;\n    int len = 0;\n    const char *method;\n    post = h->flags & AVIO_FLAG_WRITE;\n    method = post ? "POST" : "GET";\n    authstr = ff_http_auth_create_response(&s->auth_state, auth, local_path,\n                                           method);\n    proxyauthstr = ff_http_auth_create_response(&s->proxy_auth_state, proxyauth,\n                                                local_path, method);\n    if (!has_header(s->headers, "\\r\\nUser-Agent: "))\n       len += av_strlcatf(headers + len, sizeof(headers) - len,\n                          "User-Agent: %s\\r\\n", LIBAVFORMAT_IDENT);\n    if (!has_header(s->headers, "\\r\\nAccept: "))\n        len += av_strlcpy(headers + len, "Accept: */*\\r\\n",\n                          sizeof(headers) - len);\n    if (!has_header(s->headers, "\\r\\nRange: ") && !post)\n        len += av_strlcatf(headers + len, sizeof(headers) - len,\n                           "Range: bytes=%"PRId64"-\\r\\n", s->off);\n    if (!has_header(s->headers, "\\r\\nConnection: "))\n        len += av_strlcpy(headers + len, "Connection: close\\r\\n",\n                          sizeof(headers)-len);\n    if (!has_header(s->headers, "\\r\\nHost: "))\n        len += av_strlcatf(headers + len, sizeof(headers) - len,\n                           "Host: %s\\r\\n", hoststr);\n    if (s->headers)\n        av_strlcpy(headers + len, s->headers, sizeof(headers) - len);\n    snprintf(s->buffer, sizeof(s->buffer),\n             "%s %s HTTP/1.1\\r\\n"\n             "%s"\n             "%s"\n             "%s"\n             "%s%s"\n             "\\r\\n",\n             method,\n             path,\n             post && s->chunked_post ? "Transfer-Encoding: chunked\\r\\n" : "",\n             headers,\n             authstr ? authstr : "",\n             proxyauthstr ? "Proxy-" : "", proxyauthstr ? proxyauthstr : "");\n    av_freep(&authstr);\n    av_freep(&proxyauthstr);\n    if (ffurl_write(s->hd, s->buffer, strlen(s->buffer)) < 0)\n        return AVERROR(EIO);\n    s->buf_ptr = s->buffer;\n    s->buf_end = s->buffer;\n    s->line_count = 0;\n    s->off = 0;\n    s->filesize = -1;\n    s->willclose = 0;\n    if (post) {\n        s->http_code = 200;\n        return 0;\n    }\n    s->chunksize = -1;\n    for(;;) {\n        if (http_get_line(s, line, sizeof(line)) < 0)\n            return AVERROR(EIO);\n        av_dlog(NULL, "header=\'%s\'\\n", line);\n        err = process_line(h, line, s->line_count, new_location);\n        if (err < 0)\n            return err;\n        if (err == 0)\n            break;\n        s->line_count++;\n    }\n    return (off == s->off) ? 0 : -1;\n}', 'size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)\n{\n    int len = strlen(dst);\n    va_list vl;\n    va_start(vl, fmt);\n    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);\n    va_end(vl);\n    return len;\n}']