libavformat/rtsp.c:1619: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `ff_rdt_subscribe_rule`.

libavformat/rtsp.c:1572:1: Parameter `s->priv_data->last_subscription.*.strlen`
1570. }
1571. 
1572. static int rtsp_read_packet(AVFormatContext *s, AVPacket *pkt)
      ^
1573. {
1574.     RTSPState *rt = s->priv_data;

libavformat/rtsp.c:1619:29: Call
1617.                                 av_strlcat(rt->last_subscription, ",",
1618.                                            sizeof(rt->last_subscription));
1619.                             ff_rdt_subscribe_rule(
                                  ^
1620.                                 rt->last_subscription,
1621.                                 sizeof(rt->last_subscription), i, rule_nr);

libavformat/rdt.c:386:1: Parameter `cmd->strlen`
  384. }
  385. 
  386. void
       ^
  387. ff_rdt_subscribe_rule (char *cmd, int size,
  388.                        int stream_nr, int rule_nr)

libavformat/rdt.c:390:5: Call
  388.                        int stream_nr, int rule_nr)
  389. {
  390.     av_strlcatf(cmd, size, "stream=%d;rule=%d,stream=%d;rule=%d",
           ^
  391.                 stream_nr, rule_nr * 2, stream_nr, rule_nr * 2 + 1);
  392. }

libavutil/avstring.c:69:1: <LHS trace>
67. }
68. 
69. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
    ^
70. {
71.     int len = strlen(dst);

libavutil/avstring.c:69:1: Parameter `size`
    67. }
    68. 
    69. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
        ^
    70. {
    71.     int len = strlen(dst);

libavutil/avstring.c:75:12: <RHS trace>
73. 
74.     va_start(vl, fmt);
75.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
               ^
76.     va_end(vl);
77. 

libavutil/avstring.c:75:12: Risky value from: vsnprintf
    73. 
    74.     va_start(vl, fmt);
    75.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                   ^
    76.     va_end(vl);
    77. 

libavutil/avstring.c:75:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `ff_rdt_subscribe_rule` 
    73. 
    74.     va_start(vl, fmt);
    75.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
            ^
    76.     va_end(vl);
    77. 

size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
{
    int len = strlen(dst);
    va_list vl;
    va_start(vl, fmt);
    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
    va_end(vl);
    return len;
}
['static int rtsp_read_packet(AVFormatContext *s, AVPacket *pkt)\n{\n    RTSPState *rt = s->priv_data;\n    int ret;\n    RTSPMessageHeader reply1, *reply = &reply1;\n    char cmd[1024];\n    if (rt->server_type == RTSP_SERVER_REAL) {\n        int i;\n        enum AVDiscard cache[MAX_STREAMS];\n        for (i = 0; i < s->nb_streams; i++)\n            cache[i] = s->streams[i]->discard;\n        if (!rt->need_subscription) {\n            if (memcmp (cache, rt->real_setup_cache,\n                        sizeof(enum AVDiscard) * s->nb_streams)) {\n                av_strlcatf(cmd, sizeof(cmd),\n                            "SET_PARAMETER %s RTSP/1.0\\r\\n"\n                            "Unsubscribe: %s\\r\\n",\n                            s->filename, rt->last_subscription);\n                rtsp_send_cmd(s, cmd, reply, NULL);\n                if (reply->status_code != RTSP_STATUS_OK)\n                    return AVERROR_INVALIDDATA;\n                rt->need_subscription = 1;\n            }\n        }\n        if (rt->need_subscription) {\n            int r, rule_nr, first = 1;\n            memcpy(rt->real_setup_cache, cache,\n                   sizeof(enum AVDiscard) * s->nb_streams);\n            rt->last_subscription[0] = 0;\n            snprintf(cmd, sizeof(cmd),\n                     "SET_PARAMETER %s RTSP/1.0\\r\\n"\n                     "Subscribe: ",\n                     s->filename);\n            for (i = 0; i < rt->nb_rtsp_streams; i++) {\n                rule_nr = 0;\n                for (r = 0; r < s->nb_streams; r++) {\n                    if (s->streams[r]->priv_data == rt->rtsp_streams[i]) {\n                        if (s->streams[r]->discard != AVDISCARD_ALL) {\n                            if (!first)\n                                av_strlcat(rt->last_subscription, ",",\n                                           sizeof(rt->last_subscription));\n                            ff_rdt_subscribe_rule(\n                                rt->last_subscription,\n                                sizeof(rt->last_subscription), i, rule_nr);\n                            first = 0;\n                        }\n                        rule_nr++;\n                    }\n                }\n            }\n            av_strlcatf(cmd, sizeof(cmd), "%s\\r\\n", rt->last_subscription);\n            rtsp_send_cmd(s, cmd, reply, NULL);\n            if (reply->status_code != RTSP_STATUS_OK)\n                return AVERROR_INVALIDDATA;\n            rt->need_subscription = 0;\n            if (rt->state == RTSP_STATE_PLAYING)\n                rtsp_read_play (s);\n        }\n    }\n    ret = rtsp_fetch_packet(s, pkt);\n    if (ret < 0)\n        return ret;\n    if ((rt->server_type == RTSP_SERVER_WMS ||\n         rt->server_type == RTSP_SERVER_REAL) &&\n        (av_gettime() - rt->last_cmd_time) / 1000000 >= rt->timeout / 2) {\n        if (rt->server_type == RTSP_SERVER_WMS) {\n            snprintf(cmd, sizeof(cmd) - 1,\n                     "GET_PARAMETER %s RTSP/1.0\\r\\n",\n                     s->filename);\n            rtsp_send_cmd_async(s, cmd, reply, NULL);\n        } else {\n            rtsp_send_cmd_async(s, "OPTIONS * RTSP/1.0\\r\\n",\n                                reply, NULL);\n        }\n    }\n    return 0;\n}', 'void\nff_rdt_subscribe_rule (char *cmd, int size,\n                       int stream_nr, int rule_nr)\n{\n    av_strlcatf(cmd, size, "stream=%d;rule=%d,stream=%d;rule=%d",\n                stream_nr, rule_nr * 2, stream_nr, rule_nr * 2 + 1);\n}', 'size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)\n{\n    int len = strlen(dst);\n    va_list vl;\n    va_start(vl, fmt);\n    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);\n    va_end(vl);\n    return len;\n}']