libavformat/mpegtsenc.c:351: error: Buffer Overrun L2
  Offset added: [5, 189] (⇐ [4, 5] + [1, 184]) Size: 188 by call to `mpegts_write_section1`.

libavformat/mpegtsenc.c:317:1: Array declaration
315. }
316. 
317. static void mpegts_write_sdt(AVFormatContext *s)
     ^
318. {
319.     MpegTSWrite *ts = s->priv_data;

libavformat/mpegtsenc.c:351:5: Call
349.         desc_list_len_ptr[1] = val;
350.     }
351.     mpegts_write_section1(&ts->sdt, SDT_TID, ts->tsid, 0, 0, 0,
         ^
352.                           data, q - data);
353. }

libavformat/mpegtsenc.c:124:1: Parameter `len`
  122. }
  123. 
  124. static int mpegts_write_section1(MpegTSSection *s, int tid, int id,
       ^
  125.                           int version, int sec_num, int last_sec_num,
  126.                           uint8_t *buf, int len)

libavformat/mpegtsenc.c:131:5: Assignment
  129.     unsigned int tot_len;
  130. 
  131.     tot_len = 3 + 5 + len + 4;
           ^
  132.     /* check if not too big */
  133.     if (tot_len > 1024)

libavformat/mpegtsenc.c:145:5: Call
  143.     memcpy(q, buf, len);
  144. 
  145.     mpegts_write_section(s, section, tot_len);
           ^
  146.     return 0;
  147. }

libavformat/mpegtsenc.c:66:1: <Offset trace>
64. 
65. /* NOTE: 4 bytes must be left at the end for the crc32 */
66. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
    ^
67. {
68.     MpegTSWrite *ts = ((AVFormatContext*)s->opaque)->priv_data;

libavformat/mpegtsenc.c:66:1: Parameter `len`
    64. 
    65. /* NOTE: 4 bytes must be left at the end for the crc32 */
    66. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
        ^
    67. {
    68.     MpegTSWrite *ts = ((AVFormatContext*)s->opaque)->priv_data;

libavformat/mpegtsenc.c:66:1: <Length trace>
64. 
65. /* NOTE: 4 bytes must be left at the end for the crc32 */
66. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
    ^
67. {
68.     MpegTSWrite *ts = ((AVFormatContext*)s->opaque)->priv_data;

libavformat/mpegtsenc.c:66:1: Array declaration
    64. 
    65. /* NOTE: 4 bytes must be left at the end for the crc32 */
    66. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
        ^
    67. {
    68.     MpegTSWrite *ts = ((AVFormatContext*)s->opaque)->priv_data;

libavformat/mpegtsenc.c:85:9: Assignment
    83.     while (len > 0) {
    84.         first = (buf == buf_ptr);
    85.         q = packet;
                ^
    86.         *q++ = 0x47;
    87.         b = (s->pid >> 8);

libavformat/mpegtsenc.c:86:10: Assignment
    84.         first = (buf == buf_ptr);
    85.         q = packet;
    86.         *q++ = 0x47;
                 ^
    87.         b = (s->pid >> 8);
    88.         if (first)

libavformat/mpegtsenc.c:90:10: Assignment
    88.         if (first)
    89.             b |= 0x40;
    90.         *q++ = b;
                 ^
    91.         *q++ = s->pid;
    92.         *q++ = 0x10 | s->cc;

libavformat/mpegtsenc.c:91:10: Assignment
    89.             b |= 0x40;
    90.         *q++ = b;
    91.         *q++ = s->pid;
                 ^
    92.         *q++ = 0x10 | s->cc;
    93.         s->cc = (s->cc + 1) & 0xf;

libavformat/mpegtsenc.c:92:10: Assignment
    90.         *q++ = b;
    91.         *q++ = s->pid;
    92.         *q++ = 0x10 | s->cc;
                 ^
    93.         s->cc = (s->cc + 1) & 0xf;
    94.         if (first)

libavformat/mpegtsenc.c:99:9: Array access: Offset added: [5, 189] (⇐ [4, 5] + [1, 184]) Size: 188 by call to `mpegts_write_section1` 
     97.         if (len1 > len)
     98.             len1 = len;
     99.         memcpy(q, buf_ptr, len1);
                 ^
    100.         q += len1;
    101.         /* add known padding data */

static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
{
    MpegTSWrite *ts = ((AVFormatContext*)s->opaque)->priv_data;
    unsigned int crc;
    unsigned char packet[TS_PACKET_SIZE];
    const unsigned char *buf_ptr;
    unsigned char *q;
    int first, b, len1, left;
    crc = bswap_32(av_crc(av_crc_get_table(AV_CRC_32_IEEE), -1, buf, len - 4));
    buf[len - 4] = (crc >> 24) & 0xff;
    buf[len - 3] = (crc >> 16) & 0xff;
    buf[len - 2] = (crc >> 8) & 0xff;
    buf[len - 1] = (crc) & 0xff;
    buf_ptr = buf;
    while (len > 0) {
        first = (buf == buf_ptr);
        q = packet;
        *q++ = 0x47;
        b = (s->pid >> 8);
        if (first)
            b |= 0x40;
        *q++ = b;
        *q++ = s->pid;
        *q++ = 0x10 | s->cc;
        s->cc = (s->cc + 1) & 0xf;
        if (first)
            *q++ = 0;
        len1 = TS_PACKET_SIZE - (q - packet);
        if (len1 > len)
            len1 = len;
        memcpy(q, buf_ptr, len1);
        q += len1;
        left = TS_PACKET_SIZE - (q - packet);
        if (left > 0)
            memset(q, 0xff, left);
        s->write_packet(s, packet);
        buf_ptr += len1;
        len -= len1;
        ts->cur_pcr += TS_PACKET_SIZE*8*90000LL/ts->mux_rate;
    }
}
['static void mpegts_write_sdt(AVFormatContext *s)\n{\n    MpegTSWrite *ts = s->priv_data;\n    MpegTSService *service;\n    uint8_t data[1012], *q, *desc_list_len_ptr, *desc_len_ptr;\n    int i, running_status, free_ca_mode, val;\n    q = data;\n    put16(&q, ts->onid);\n    *q++ = 0xff;\n    for(i = 0; i < ts->nb_services; i++) {\n        service = ts->services[i];\n        put16(&q, service->sid);\n        *q++ = 0xfc | 0x00;\n        desc_list_len_ptr = q;\n        q += 2;\n        running_status = 4;\n        free_ca_mode = 0;\n        *q++ = 0x48;\n        desc_len_ptr = q;\n        q++;\n        *q++ = 0x01;\n        putstr8(&q, service->provider_name);\n        putstr8(&q, service->name);\n        desc_len_ptr[0] = q - desc_len_ptr - 1;\n        val = (running_status << 13) | (free_ca_mode << 12) |\n            (q - desc_list_len_ptr - 2);\n        desc_list_len_ptr[0] = val >> 8;\n        desc_list_len_ptr[1] = val;\n    }\n    mpegts_write_section1(&ts->sdt, SDT_TID, ts->tsid, 0, 0, 0,\n                          data, q - data);\n}', 'static int mpegts_write_section1(MpegTSSection *s, int tid, int id,\n                          int version, int sec_num, int last_sec_num,\n                          uint8_t *buf, int len)\n{\n    uint8_t section[1024], *q;\n    unsigned int tot_len;\n    tot_len = 3 + 5 + len + 4;\n    if (tot_len > 1024)\n        return -1;\n    q = section;\n    *q++ = tid;\n    put16(&q, 0xb000 | (len + 5 + 4));\n    put16(&q, id);\n    *q++ = 0xc1 | (version << 1);\n    *q++ = sec_num;\n    *q++ = last_sec_num;\n    memcpy(q, buf, len);\n    mpegts_write_section(s, section, tot_len);\n    return 0;\n}', 'static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)\n{\n    MpegTSWrite *ts = ((AVFormatContext*)s->opaque)->priv_data;\n    unsigned int crc;\n    unsigned char packet[TS_PACKET_SIZE];\n    const unsigned char *buf_ptr;\n    unsigned char *q;\n    int first, b, len1, left;\n    crc = bswap_32(av_crc(av_crc_get_table(AV_CRC_32_IEEE), -1, buf, len - 4));\n    buf[len - 4] = (crc >> 24) & 0xff;\n    buf[len - 3] = (crc >> 16) & 0xff;\n    buf[len - 2] = (crc >> 8) & 0xff;\n    buf[len - 1] = (crc) & 0xff;\n    buf_ptr = buf;\n    while (len > 0) {\n        first = (buf == buf_ptr);\n        q = packet;\n        *q++ = 0x47;\n        b = (s->pid >> 8);\n        if (first)\n            b |= 0x40;\n        *q++ = b;\n        *q++ = s->pid;\n        *q++ = 0x10 | s->cc;\n        s->cc = (s->cc + 1) & 0xf;\n        if (first)\n            *q++ = 0;\n        len1 = TS_PACKET_SIZE - (q - packet);\n        if (len1 > len)\n            len1 = len;\n        memcpy(q, buf_ptr, len1);\n        q += len1;\n        left = TS_PACKET_SIZE - (q - packet);\n        if (left > 0)\n            memset(q, 0xff, left);\n        s->write_packet(s, packet);\n        buf_ptr += len1;\n        len -= len1;\n        ts->cur_pcr += TS_PACKET_SIZE*8*90000LL/ts->mux_rate;\n    }\n}']