libavformat/http.c:612: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `av_strlcatf`.

libavformat/http.c:536:5: Array declaration
534.     HTTPContext *s = h->priv_data;
535.     int post, err;
536.     char headers[1024] = "";
         ^
537.     char *authstr = NULL, *proxyauthstr = NULL;
538.     int64_t off = s->off;

libavformat/http.c:612:16: Call
610. 
611.     if (!has_header(s->headers, "\r\nContent-Type: ") && s->content_type)
612.         len += av_strlcatf(headers + len, sizeof(headers) - len,
                    ^
613.                            "Content-Type: %s\r\n", s->content_type);
614.     if (!has_header(s->headers, "\r\nIcy-MetaData: ") && s->icy) {

libavutil/avstring.c:99:1: <LHS trace>
 97. }
 98. 
 99. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
     ^
100. {
101.     int len = strlen(dst);

libavutil/avstring.c:99:1: Parameter `size`
   97. }
   98. 
   99. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
       ^
  100. {
  101.     int len = strlen(dst);

libavutil/avstring.c:105:12: <RHS trace>
103. 
104.     va_start(vl, fmt);
105.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                ^
106.     va_end(vl);
107. 

libavutil/avstring.c:105:12: Risky value from: vsnprintf
  103. 
  104.     va_start(vl, fmt);
  105.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                  ^
  106.     va_end(vl);
  107. 

libavutil/avstring.c:105:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `av_strlcatf` 
  103. 
  104.     va_start(vl, fmt);
  105.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
           ^
  106.     va_end(vl);
  107. 

size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
{
    int len = strlen(dst);
    va_list vl;
    va_start(vl, fmt);
    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
    va_end(vl);
    return len;
}
['static int http_connect(URLContext *h, const char *path, const char *local_path,\n                        const char *hoststr, const char *auth,\n                        const char *proxyauth, int *new_location)\n{\n    HTTPContext *s = h->priv_data;\n    int post, err;\n    char headers[1024] = "";\n    char *authstr = NULL, *proxyauthstr = NULL;\n    int64_t off = s->off;\n    int len = 0;\n    const char *method;\n    int send_expect_100 = 0;\n    post = h->flags & AVIO_FLAG_WRITE;\n    if (s->post_data) {\n        post = 1;\n        s->chunked_post = 0;\n    }\n    method = post ? "POST" : "GET";\n    authstr = ff_http_auth_create_response(&s->auth_state, auth, local_path,\n                                           method);\n    proxyauthstr = ff_http_auth_create_response(&s->proxy_auth_state, proxyauth,\n                                                local_path, method);\n    if (post && !s->post_data) {\n        send_expect_100 = s->send_expect_100;\n        if (auth && *auth &&\n            s->auth_state.auth_type == HTTP_AUTH_NONE &&\n            s->http_code != 401)\n            send_expect_100 = 1;\n    }\n    if (!has_header(s->headers, "\\r\\nUser-Agent: "))\n        len += av_strlcatf(headers + len, sizeof(headers) - len,\n                           "User-Agent: %s\\r\\n", s->user_agent);\n    if (!has_header(s->headers, "\\r\\nAccept: "))\n        len += av_strlcpy(headers + len, "Accept: */*\\r\\n",\n                          sizeof(headers) - len);\n    if (!has_header(s->headers, "\\r\\nRange: ") && !post) {\n        len += av_strlcatf(headers + len, sizeof(headers) - len,\n                           "Range: bytes=%"PRId64"-", s->off);\n        if (s->end_off)\n            len += av_strlcatf(headers + len, sizeof(headers) - len,\n                               "%"PRId64, s->end_off - 1);\n        len += av_strlcpy(headers + len, "\\r\\n",\n                          sizeof(headers) - len);\n    }\n    if (send_expect_100 && !has_header(s->headers, "\\r\\nExpect: "))\n        len += av_strlcatf(headers + len, sizeof(headers) - len,\n                           "Expect: 100-continue\\r\\n");\n    if (!has_header(s->headers, "\\r\\nConnection: ")) {\n        if (s->multiple_requests) {\n            len += av_strlcpy(headers + len, "Connection: keep-alive\\r\\n",\n                              sizeof(headers) - len);\n        } else {\n            len += av_strlcpy(headers + len, "Connection: close\\r\\n",\n                              sizeof(headers) - len);\n        }\n    }\n    if (!has_header(s->headers, "\\r\\nHost: "))\n        len += av_strlcatf(headers + len, sizeof(headers) - len,\n                           "Host: %s\\r\\n", hoststr);\n    if (!has_header(s->headers, "\\r\\nContent-Length: ") && s->post_data)\n        len += av_strlcatf(headers + len, sizeof(headers) - len,\n                           "Content-Length: %d\\r\\n", s->post_datalen);\n    if (!has_header(s->headers, "\\r\\nContent-Type: ") && s->content_type)\n        len += av_strlcatf(headers + len, sizeof(headers) - len,\n                           "Content-Type: %s\\r\\n", s->content_type);\n    if (!has_header(s->headers, "\\r\\nIcy-MetaData: ") && s->icy) {\n        len += av_strlcatf(headers + len, sizeof(headers) - len,\n                           "Icy-MetaData: %d\\r\\n", 1);\n    }\n    if (s->headers)\n        av_strlcpy(headers + len, s->headers, sizeof(headers) - len);\n    snprintf(s->buffer, sizeof(s->buffer),\n             "%s %s HTTP/1.1\\r\\n"\n             "%s"\n             "%s"\n             "%s"\n             "%s%s"\n             "\\r\\n",\n             method,\n             path,\n             post && s->chunked_post ? "Transfer-Encoding: chunked\\r\\n" : "",\n             headers,\n             authstr ? authstr : "",\n             proxyauthstr ? "Proxy-" : "", proxyauthstr ? proxyauthstr : "");\n    av_freep(&authstr);\n    av_freep(&proxyauthstr);\n    if ((err = ffurl_write(s->hd, s->buffer, strlen(s->buffer))) < 0)\n        return err;\n    if (s->post_data)\n        if ((err = ffurl_write(s->hd, s->post_data, s->post_datalen)) < 0)\n            return err;\n    s->buf_ptr = s->buffer;\n    s->buf_end = s->buffer;\n    s->line_count = 0;\n    s->off = 0;\n    s->icy_data_read = 0;\n    s->filesize = -1;\n    s->willclose = 0;\n    s->end_chunked_post = 0;\n    s->end_header = 0;\n    if (post && !s->post_data && !send_expect_100) {\n        s->http_code = 200;\n        return 0;\n    }\n    err = http_read_header(h, new_location);\n    if (err < 0)\n        return err;\n    return (off == s->off) ? 0 : -1;\n}', 'size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)\n{\n    int len = strlen(dst);\n    va_list vl;\n    va_start(vl, fmt);\n    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);\n    va_end(vl);\n    return len;\n}']