ffserver.c:2728: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `avf_sdp_create`.

ffserver.c:2719:18: Unknown value from: inet_ntoa
2717.     if (stream->is_multicast) {
2718.         snprintf(avc->filename, 1024, "rtp://%s:%d?multicast=1?ttl=%d",
2719.                  inet_ntoa(stream->multicast_ip),
                       ^
2720.                  stream->multicast_port, stream->multicast_ttl);
2721.     }

ffserver.c:2728:5: Call
2726.     }
2727.     *pbuffer = av_mallocz(2048);
2728.     avf_sdp_create(&avc, 1, *pbuffer, 2048);
          ^
2729.     av_free(avc);
2730. 

libavformat/sdp.c:257:1: Parameter `buff->strlen`
  255. }
  256. 
  257. int avf_sdp_create(AVFormatContext *ac[], int n_files, char *buff, int size)
       ^
  258. {
  259.     struct sdp_session_level s;

libavformat/sdp.c:278:5: Call
  276.         }
  277.     }
  278.     sdp_write_header(buff, size, &s);
           ^
  279. 
  280.     dst[0] = 0;

libavformat/sdp.c:57:1: Parameter `buff->strlen`
    55. }
    56. 
    57. static void sdp_write_header(char *buff, int size, struct sdp_session_level *s)
        ^
    58. {
    59.     av_strlcatf(buff, size, "v=%d\r\n"

libavformat/sdp.c:68:5: Call
    66.                             s->start_time, s->end_time,
    67.                             s->name[0] ? s->name : "No Name");
    68.     sdp_write_address(buff, size, s->dst_addr, s->ttl);
            ^
    69. }
    70. 

libavformat/sdp.c:46:1: Parameter `buff->strlen`
      44. };
      45. 
      46. static void sdp_write_address(char *buff, int size, const char *dest_addr, int ttl)
          ^
      47. {
      48.     if (dest_addr) {

libavformat/sdp.c:50:13: Call
      48.     if (dest_addr) {
      49.         if (ttl > 0) {
      50.             av_strlcatf(buff, size, "c=IN IP4 %s/%d\r\n", dest_addr, ttl);
                      ^
      51.         } else {
      52.             av_strlcatf(buff, size, "c=IN IP4 %s\r\n", dest_addr);

libavutil/string.c:68:1: <LHS trace>
66. }
67. 
68. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
    ^
69. {
70.     int len = strlen(dst);

libavutil/string.c:68:1: Parameter `size`
        66. }
        67. 
        68. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
            ^
        69. {
        70.     int len = strlen(dst);

libavutil/string.c:74:12: <RHS trace>
72. 
73.     va_start(vl, fmt);
74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
               ^
75.     va_end(vl);
76. 

libavutil/string.c:74:12: Risky value from: vsnprintf
        72. 
        73.     va_start(vl, fmt);
        74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                       ^
        75.     va_end(vl);
        76. 

libavutil/string.c:74:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `avf_sdp_create` 
        72. 
        73.     va_start(vl, fmt);
        74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                ^
        75.     va_end(vl);
        76. 

size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
{
    int len = strlen(dst);
    va_list vl;
    va_start(vl, fmt);
    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
    va_end(vl);
    return len;
}
['static int prepare_sdp_description(FFStream *stream, uint8_t **pbuffer,\n                                   struct in_addr my_ip)\n{\n    AVFormatContext *avc;\n    AVStream avs[MAX_STREAMS];\n    int i;\n    avc =  av_alloc_format_context();\n    if (avc == NULL) {\n        return -1;\n    }\n    if (stream->title[0] != 0) {\n        av_strlcpy(avc->title, stream->title, sizeof(avc->title));\n    } else {\n        av_strlcpy(avc->title, "No Title", sizeof(avc->title));\n    }\n    avc->nb_streams = stream->nb_streams;\n    if (stream->is_multicast) {\n        snprintf(avc->filename, 1024, "rtp://%s:%d?multicast=1?ttl=%d",\n                 inet_ntoa(stream->multicast_ip),\n                 stream->multicast_port, stream->multicast_ttl);\n    }\n    for(i = 0; i < stream->nb_streams; i++) {\n        avc->streams[i] = &avs[i];\n        avc->streams[i]->codec = stream->streams[i]->codec;\n    }\n    *pbuffer = av_mallocz(2048);\n    avf_sdp_create(&avc, 1, *pbuffer, 2048);\n    av_free(avc);\n    return strlen(*pbuffer);\n}', 'int avf_sdp_create(AVFormatContext *ac[], int n_files, char *buff, int size)\n{\n    struct sdp_session_level s;\n    int i, j, port, ttl;\n    char dst[32];\n    memset(buff, 0, size);\n    memset(&s, 0, sizeof(struct sdp_session_level));\n    s.user = "-";\n    s.src_addr = "127.0.0.1";\n    s.name = ac[0]->title;\n    port = 0;\n    ttl = 0;\n    if (n_files == 1) {\n        port = sdp_get_address(dst, sizeof(dst), &ttl, ac[0]->filename);\n        if (port > 0) {\n            s.dst_addr = dst;\n            s.ttl = ttl;\n        }\n    }\n    sdp_write_header(buff, size, &s);\n    dst[0] = 0;\n    for (i = 0; i < n_files; i++) {\n        if (n_files != 1) {\n            port = sdp_get_address(dst, sizeof(dst), &ttl, ac[i]->filename);\n        }\n        for (j = 0; j < ac[i]->nb_streams; j++) {\n            sdp_write_media(buff, size,\n                                  ac[i]->streams[j]->codec, dst[0] ? dst : NULL,\n                                  (port > 0) ? port + j * 2 : 0, ttl);\n            if (port <= 0) {\n                av_strlcatf(buff, size,\n                                   "a=control:streamid=%d\\r\\n", i + j);\n            }\n        }\n    }\n    return 0;\n}', 'static void sdp_write_header(char *buff, int size, struct sdp_session_level *s)\n{\n    av_strlcatf(buff, size, "v=%d\\r\\n"\n                            "o=- %d %d IN IP4 %s\\r\\n"\n                            "t=%d %d\\r\\n"\n                            "s=%s\\r\\n"\n                            "a=tool:libavformat " AV_STRINGIFY(LIBAVFORMAT_VERSION) "\\r\\n",\n                            s->sdp_version,\n                            s->id, s->version, s->src_addr,\n                            s->start_time, s->end_time,\n                            s->name[0] ? s->name : "No Name");\n    sdp_write_address(buff, size, s->dst_addr, s->ttl);\n}', 'static void sdp_write_address(char *buff, int size, const char *dest_addr, int ttl)\n{\n    if (dest_addr) {\n        if (ttl > 0) {\n            av_strlcatf(buff, size, "c=IN IP4 %s/%d\\r\\n", dest_addr, ttl);\n        } else {\n            av_strlcatf(buff, size, "c=IN IP4 %s\\r\\n", dest_addr);\n        }\n    }\n}', 'size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)\n{\n    int len = strlen(dst);\n    va_list vl;\n    va_start(vl, fmt);\n    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);\n    va_end(vl);\n    return len;\n}']