libavformat/rtsp.c:1028: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `av_strlcatf`.

libavformat/rtsp.c:1002:1: Parameter `buf.strlen`
1000. }
1001. 
1002. void ff_rtsp_send_cmd_with_content_async(AVFormatContext *s,
      ^
1003.                                          const char *method, const char *url,
1004.                                          const char *headers,

libavformat/rtsp.c:1028:9: Call
1026.     }
1027.     if (send_content_length > 0 && send_content)
1028.         av_strlcatf(buf, sizeof(buf), "Content-Length: %d\r\n", send_content_length);
              ^
1029.     av_strlcat(buf, "\r\n", sizeof(buf));
1030. 

libavutil/avstring.c:82:1: <LHS trace>
80. }
81. 
82. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
    ^
83. {
84.     int len = strlen(dst);

libavutil/avstring.c:82:1: Parameter `size`
  80. }
  81. 
  82. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
      ^
  83. {
  84.     int len = strlen(dst);

libavutil/avstring.c:88:12: <RHS trace>
86. 
87.     va_start(vl, fmt);
88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
               ^
89.     va_end(vl);
90. 

libavutil/avstring.c:88:12: Risky value from: vsnprintf
  86. 
  87.     va_start(vl, fmt);
  88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                 ^
  89.     va_end(vl);
  90. 

libavutil/avstring.c:88:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `av_strlcatf` 
  86. 
  87.     va_start(vl, fmt);
  88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
          ^
  89.     va_end(vl);
  90. 

size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
{
    int len = strlen(dst);
    va_list vl;
    va_start(vl, fmt);
    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
    va_end(vl);
    return len;
}
['void ff_rtsp_send_cmd_with_content_async(AVFormatContext *s,\n                                         const char *method, const char *url,\n                                         const char *headers,\n                                         const unsigned char *send_content,\n                                         int send_content_length)\n{\n    RTSPState *rt = s->priv_data;\n    char buf[4096];\n    rt->seq++;\n    snprintf(buf, sizeof(buf), "%s %s RTSP/1.0\\r\\n", method, url);\n    if (headers)\n        av_strlcat(buf, headers, sizeof(buf));\n    av_strlcatf(buf, sizeof(buf), "CSeq: %d\\r\\n", rt->seq);\n    if (rt->session_id[0] != \'\\0\' && (!headers ||\n        !strstr(headers, "\\nIf-Match:"))) {\n        av_strlcatf(buf, sizeof(buf), "Session: %s\\r\\n", rt->session_id);\n    }\n    if (rt->auth[0]) {\n        char *str = ff_http_auth_create_response(&rt->auth_state,\n                                                 rt->auth, url, method);\n        if (str)\n            av_strlcat(buf, str, sizeof(buf));\n        av_free(str);\n    }\n    if (send_content_length > 0 && send_content)\n        av_strlcatf(buf, sizeof(buf), "Content-Length: %d\\r\\n", send_content_length);\n    av_strlcat(buf, "\\r\\n", sizeof(buf));\n    dprintf(s, "Sending:\\n%s--\\n", buf);\n    url_write(rt->rtsp_hd, buf, strlen(buf));\n    if (send_content_length > 0 && send_content)\n        url_write(rt->rtsp_hd, send_content, send_content_length);\n    rt->last_cmd_time = av_gettime();\n}', 'size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)\n{\n    int len = strlen(dst);\n    va_list vl;\n    va_start(vl, fmt);\n    len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);\n    va_end(vl);\n    return len;\n}']