libavformat/rtsp.c:1360: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `ff_rdt_subscribe_rule`.

libavformat/rtsp.c:1341:1: Parameter `cmd.strlen`
1339. }
1340. 
1341. static int rtsp_read_packet(AVFormatContext *s,
      ^
1342.                             AVPacket *pkt)
1343. {

libavformat/rtsp.c:1360:13: Call
1358.         for (i = 0; i < rt->nb_rtsp_streams; i++) {
1359.             if (i != 0) av_strlcat(cmd, ",", sizeof(cmd));
1360.             ff_rdt_subscribe_rule(cmd, sizeof(cmd), i, 0);
                  ^
1361.             if (rt->transport == RTSP_TRANSPORT_RDT)
1362.                 ff_rdt_subscribe_rule2(

libavformat/rdt.c:273:1: Parameter `cmd->strlen`
  271. }
  272. 
  273. void
       ^
  274. ff_rdt_subscribe_rule (char *cmd, int size,
  275.                        int stream_nr, int rule_nr)

libavformat/rdt.c:277:5: Call
  275.                        int stream_nr, int rule_nr)
  276. {
  277.     av_strlcatf(cmd, size, "stream=%d;rule=%d,stream=%d;rule=%d",
           ^
  278.                 stream_nr, rule_nr * 2, stream_nr, rule_nr * 2 + 1);
  279. }

libavutil/string.c:68:1: <LHS trace>
66. }
67. 
68. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
    ^
69. {
70.     int len = strlen(dst);

libavutil/string.c:68:1: Parameter `size`
    66. }
    67. 
    68. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
        ^
    69. {
    70.     int len = strlen(dst);

libavutil/string.c:74:12: <RHS trace>
72. 
73.     va_start(vl, fmt);
74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
               ^
75.     va_end(vl);
76. 

libavutil/string.c:74:12: Risky value from: vsnprintf
    72. 
    73.     va_start(vl, fmt);
    74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                   ^
    75.     va_end(vl);
    76. 

libavutil/string.c:74:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `ff_rdt_subscribe_rule` 
    72. 
    73.     va_start(vl, fmt);
    74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
            ^
    75.     va_end(vl);
    76. 

size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
{
    int len = strlen(dst);
    va_list vl;
    va_start(vl, fmt);
    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
    va_end(vl);
    return len;
}
['static int rtsp_read_packet(AVFormatContext *s,\n                            AVPacket *pkt)\n{\n    RTSPState *rt = s->priv_data;\n    RTSPStream *rtsp_st;\n    int ret, len;\n    uint8_t buf[RTP_MAX_PACKET_LENGTH];\n    if (rt->server_type == RTSP_SERVER_REAL && rt->need_subscription) {\n        int i;\n        RTSPHeader reply1, *reply = &reply1;\n        char cmd[1024];\n        snprintf(cmd, sizeof(cmd),\n                 "SET_PARAMETER %s RTSP/1.0\\r\\n"\n                 "Subscribe: ",\n                 s->filename);\n        for (i = 0; i < rt->nb_rtsp_streams; i++) {\n            if (i != 0) av_strlcat(cmd, ",", sizeof(cmd));\n            ff_rdt_subscribe_rule(cmd, sizeof(cmd), i, 0);\n            if (rt->transport == RTSP_TRANSPORT_RDT)\n                ff_rdt_subscribe_rule2(\n                    rt->rtsp_streams[i]->tx_ctx,\n                    cmd, sizeof(cmd), i, 0);\n        }\n        av_strlcat(cmd, "\\r\\n", sizeof(cmd));\n        rtsp_send_cmd(s, cmd, reply, NULL);\n        if (reply->status_code != RTSP_STATUS_OK)\n            return AVERROR_INVALIDDATA;\n        rt->need_subscription = 0;\n        if (rt->state == RTSP_STATE_PLAYING)\n            rtsp_read_play (s);\n    }\n    if (rt->cur_tx) {\n        if (rt->transport == RTSP_TRANSPORT_RDT)\n            ret = ff_rdt_parse_packet(rt->cur_tx, pkt, NULL, 0);\n        else\n            ret = rtp_parse_packet(rt->cur_tx, pkt, NULL, 0);\n        if (ret == 0) {\n            rt->cur_tx = NULL;\n            return 0;\n        } else if (ret == 1) {\n            return 0;\n        } else {\n            rt->cur_tx = NULL;\n        }\n    }\n redo:\n    switch(rt->lower_transport) {\n    default:\n    case RTSP_LOWER_TRANSPORT_TCP:\n        len = tcp_read_packet(s, &rtsp_st, buf, sizeof(buf));\n        break;\n    case RTSP_LOWER_TRANSPORT_UDP:\n    case RTSP_LOWER_TRANSPORT_UDP_MULTICAST:\n        len = udp_read_packet(s, &rtsp_st, buf, sizeof(buf));\n        if (len >=0 && rtsp_st->tx_ctx)\n            rtp_check_and_send_back_rr(rtsp_st->tx_ctx, len);\n        break;\n    }\n    if (len < 0)\n        return len;\n    if (rt->transport == RTSP_TRANSPORT_RDT)\n        ret = ff_rdt_parse_packet(rtsp_st->tx_ctx, pkt, buf, len);\n    else\n        ret = rtp_parse_packet(rtsp_st->tx_ctx, pkt, buf, len);\n    if (ret < 0)\n        goto redo;\n    if (ret == 1) {\n        rt->cur_tx = rtsp_st->tx_ctx;\n    }\n    return 0;\n}', 'void\nff_rdt_subscribe_rule (char *cmd, int size,\n                       int stream_nr, int rule_nr)\n{\n    av_strlcatf(cmd, size, "stream=%d;rule=%d,stream=%d;rule=%d",\n                stream_nr, rule_nr * 2, stream_nr, rule_nr * 2 + 1);\n}', 'size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)\n{\n    int len = strlen(dst);\n    va_list vl;\n    va_start(vl, fmt);\n    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);\n    va_end(vl);\n    return len;\n}']