ffserver.c:2516: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `av_close_input_stream`.

ffserver.c:2508:45: Call
2506.                 memcpy(fst->codec, st->codec, sizeof(AVCodecContext));
2507.                 if (fst->codec->extradata_size) {
2508.                     fst->codec->extradata = av_malloc(fst->codec->extradata_size);
                                                  ^
2509.                     if (!fst->codec->extradata)
2510.                         goto fail;

libavutil/mem.c:61:11: Unknown value from: memalign
  59.     ((char*)ptr)[-1]= diff;
  60. #elif defined (HAVE_MEMALIGN)
  61.     ptr = memalign(16,size);
                ^
  62.     /* Why 64?
  63.        Indeed, we should align it:

ffserver.c:2516:13: Call
2514.             }
2515. 
2516.             av_close_input_stream(s);
                  ^
2517.             av_free(pb);
2518.         }

libavformat/utils.c:2196:1: <LHS trace>
2194. }
2195. 
2196. void av_close_input_stream(AVFormatContext *s)
      ^
2197. {
2198.     int i;

libavformat/utils.c:2196:1: Parameter `s->nb_programs`
  2194. }
  2195. 
  2196. void av_close_input_stream(AVFormatContext *s)
        ^
  2197. {
  2198.     int i;

libavformat/utils.c:2220:9: Binary operation: ([0, +oo] - 1):unsigned32 by call to `av_close_input_stream` 
  2218.         av_free(st);
  2219.     }
  2220.     for(i=s->nb_programs-1; i>=0; i--) {
                ^
  2221.         av_freep(&s->programs[i]->provider_name);
  2222.         av_freep(&s->programs[i]->name);

void av_close_input_stream(AVFormatContext *s)
{
    int i;
    AVStream *st;
    if (s->cur_st && s->cur_st->parser)
        av_free_packet(&s->cur_pkt);
    if (s->iformat->read_close)
        s->iformat->read_close(s);
    for(i=0;i<s->nb_streams;i++) {
        st = s->streams[i];
        if (st->parser) {
            av_parser_close(st->parser);
        }
        av_free(st->index_entries);
        av_free(st->codec->extradata);
        av_free(st->codec);
        av_free(st->filename);
        av_free(st->priv_data);
        av_free(st);
    }
    for(i=s->nb_programs-1; i>=0; i--) {
        av_freep(&s->programs[i]->provider_name);
        av_freep(&s->programs[i]->name);
        av_freep(&s->programs[i]->stream_index);
        av_freep(&s->programs[i]);
    }
    av_freep(&s->programs);
    flush_packet_queue(s);
    av_freep(&s->priv_data);
    while(s->nb_chapters--) {
        av_free(s->chapters[s->nb_chapters]->title);
        av_free(s->chapters[s->nb_chapters]);
    }
    av_freep(&s->chapters);
    av_free(s);
}
['static int http_receive_data(HTTPContext *c)\n{\n    HTTPContext *c1;\n    if (c->buffer_end > c->buffer_ptr) {\n        int len;\n        len = recv(c->fd, c->buffer_ptr, c->buffer_end - c->buffer_ptr, 0);\n        if (len < 0) {\n            if (ff_neterrno() != FF_NETERROR(EAGAIN) &&\n                ff_neterrno() != FF_NETERROR(EINTR))\n                goto fail;\n        } else if (len == 0)\n            goto fail;\n        else {\n            c->buffer_ptr += len;\n            c->data_count += len;\n            update_datarate(&c->datarate, c->data_count);\n        }\n    }\n    if (c->buffer_ptr - c->buffer >= 2 && c->data_count > FFM_PACKET_SIZE) {\n        if (c->buffer[0] != \'f\' ||\n            c->buffer[1] != \'m\') {\n            http_log("Feed stream has become desynchronized -- disconnecting\\n");\n            goto fail;\n        }\n    }\n    if (c->buffer_ptr >= c->buffer_end) {\n        FFStream *feed = c->stream;\n        if (c->data_count > FFM_PACKET_SIZE) {\n            lseek(c->feed_fd, feed->feed_write_index, SEEK_SET);\n            if (write(c->feed_fd, c->buffer, FFM_PACKET_SIZE) < 0) {\n                http_log("Error writing to feed file: %s\\n", strerror(errno));\n                goto fail;\n            }\n            feed->feed_write_index += FFM_PACKET_SIZE;\n            if (feed->feed_write_index > c->stream->feed_size)\n                feed->feed_size = feed->feed_write_index;\n            if (c->stream->feed_max_size && feed->feed_write_index >= c->stream->feed_max_size)\n                feed->feed_write_index = FFM_PACKET_SIZE;\n            ffm_write_write_index(c->feed_fd, feed->feed_write_index);\n            for(c1 = first_http_ctx; c1 != NULL; c1 = c1->next) {\n                if (c1->state == HTTPSTATE_WAIT_FEED &&\n                    c1->stream->feed == c->stream->feed)\n                    c1->state = HTTPSTATE_SEND_DATA;\n            }\n        } else {\n            AVFormatContext *s = NULL;\n            ByteIOContext *pb;\n            AVInputFormat *fmt_in;\n            int i;\n            fmt_in = av_find_input_format(feed->fmt->name);\n            if (!fmt_in)\n                goto fail;\n            url_open_buf(&pb, c->buffer, c->buffer_end - c->buffer, URL_RDONLY);\n            pb->is_streamed = 1;\n            if (av_open_input_stream(&s, pb, c->stream->feed_filename, fmt_in, NULL) < 0) {\n                av_free(pb);\n                goto fail;\n            }\n            if (s->nb_streams != feed->nb_streams) {\n                av_close_input_stream(s);\n                av_free(pb);\n                goto fail;\n            }\n            for (i = 0; i < s->nb_streams; i++) {\n                AVStream *fst = feed->streams[i];\n                AVStream *st = s->streams[i];\n                memcpy(fst->codec, st->codec, sizeof(AVCodecContext));\n                if (fst->codec->extradata_size) {\n                    fst->codec->extradata = av_malloc(fst->codec->extradata_size);\n                    if (!fst->codec->extradata)\n                        goto fail;\n                    memcpy(fst->codec->extradata, st->codec->extradata,\n                           fst->codec->extradata_size);\n                }\n            }\n            av_close_input_stream(s);\n            av_free(pb);\n        }\n        c->buffer_ptr = c->buffer;\n    }\n    return 0;\n fail:\n    c->stream->feed_opened = 0;\n    close(c->feed_fd);\n    for(c1 = first_http_ctx; c1 != NULL; c1 = c1->next) {\n        if (c1->state == HTTPSTATE_WAIT_FEED &&\n            c1->stream->feed == c->stream->feed)\n            c1->state = HTTPSTATE_SEND_DATA_TRAILER;\n    }\n    return -1;\n}', 'void *av_malloc(unsigned int size)\n{\n    void *ptr;\n#ifdef CONFIG_MEMALIGN_HACK\n    long diff;\n#endif\n    if(size > (INT_MAX-16) )\n        return NULL;\n#ifdef CONFIG_MEMALIGN_HACK\n    ptr = malloc(size+16);\n    if(!ptr)\n        return ptr;\n    diff= ((-(long)ptr - 1)&15) + 1;\n    ptr = (char*)ptr + diff;\n    ((char*)ptr)[-1]= diff;\n#elif defined (HAVE_MEMALIGN)\n    ptr = memalign(16,size);\n#else\n    ptr = malloc(size);\n#endif\n    return ptr;\n}', 'void av_close_input_stream(AVFormatContext *s)\n{\n    int i;\n    AVStream *st;\n    if (s->cur_st && s->cur_st->parser)\n        av_free_packet(&s->cur_pkt);\n    if (s->iformat->read_close)\n        s->iformat->read_close(s);\n    for(i=0;i<s->nb_streams;i++) {\n        st = s->streams[i];\n        if (st->parser) {\n            av_parser_close(st->parser);\n        }\n        av_free(st->index_entries);\n        av_free(st->codec->extradata);\n        av_free(st->codec);\n        av_free(st->filename);\n        av_free(st->priv_data);\n        av_free(st);\n    }\n    for(i=s->nb_programs-1; i>=0; i--) {\n        av_freep(&s->programs[i]->provider_name);\n        av_freep(&s->programs[i]->name);\n        av_freep(&s->programs[i]->stream_index);\n        av_freep(&s->programs[i]);\n    }\n    av_freep(&s->programs);\n    flush_packet_queue(s);\n    av_freep(&s->priv_data);\n    while(s->nb_chapters--) {\n        av_free(s->chapters[s->nb_chapters]->title);\n        av_free(s->chapters[s->nb_chapters]);\n    }\n    av_freep(&s->chapters);\n    av_free(s);\n}']