ffserver.c:2316: error: Buffer Overrun L1
  Offset: [1, +oo] Size: 1 by call to `open_input_stream`.

ffserver.c:2316:29: Call
2314.                         av_close_input_file(c->fmt_in);
2315.                         c->fmt_in = NULL;
2316.                         if (open_input_stream(c, "") < 0)
                                  ^
2317.                             goto no_loop;
2318.                         goto redo;

ffserver.c:2125:1: Parameter `*info`
  2123. }
  2124. 
  2125. static int open_input_stream(HTTPContext *c, const char *info)
        ^
  2126. {
  2127.     char buf[128];

ffserver.c:2141:20: Call
  2139.             if ((ret = av_parse_time(&stream_pos, buf, 0)) < 0)
  2140.                 return ret;
  2141.         } else if (av_find_info_tag(buf, sizeof(buf), "buffer", info)) {
                           ^
  2142.             int prebuffer = strtol(buf, 0, 10);
  2143.             stream_pos = av_gettime() - prebuffer * (int64_t)1000000;

libavutil/parseutils.c:611:1: <Length trace>
609. }
610. 
611. int av_find_info_tag(char *arg, int arg_size, const char *tag1, const char *info)
     ^
612. {
613.     const char *p;

libavutil/parseutils.c:611:1: Parameter `*info`
    609. }
    610. 
    611. int av_find_info_tag(char *arg, int arg_size, const char *tag1, const char *info)
         ^
    612. {
    613.     const char *p;

libavutil/parseutils.c:616:5: Assignment
    614.     char tag[128], *q;
    615. 
    616.     p = info;
             ^
    617.     if (*p == '?')
    618.         p++;

libavutil/parseutils.c:629:13: Assignment
    627.         q = arg;
    628.         if (*p == '=') {
    629.             p++;
                     ^
    630.             while (*p != '&' && *p != '\0') {
    631.                 if ((q - arg) < arg_size - 1) {

libavutil/parseutils.c:630:20: Array access: Offset: [1, +oo] Size: 1 by call to `open_input_stream` 
    628.         if (*p == '=') {
    629.             p++;
    630.             while (*p != '&' && *p != '\0') {
                            ^
    631.                 if ((q - arg) < arg_size - 1) {
    632.                     if (*p == '+')

int av_find_info_tag(char *arg, int arg_size, const char *tag1, const char *info)
{
    const char *p;
    char tag[128], *q;
    p = info;
    if (*p == '?')
        p++;
    for(;;) {
        q = tag;
        while (*p != '\0' && *p != '=' && *p != '&') {
            if ((q - tag) < sizeof(tag) - 1)
                *q++ = *p;
            p++;
        }
        *q = '\0';
        q = arg;
        if (*p == '=') {
            p++;
            while (*p != '&' && *p != '\0') {
                if ((q - arg) < arg_size - 1) {
                    if (*p == '+')
                        *q++ = ' ';
                    else
                        *q++ = *p;
                }
                p++;
            }
        }
        *q = '\0';
        if (!strcmp(tag, tag1))
            return 1;
        if (*p != '&')
            break;
        p++;
    }
    return 0;
}
['static int http_prepare_data(HTTPContext *c)\n{\n    int i, len, ret;\n    AVFormatContext *ctx;\n    av_freep(&c->pb_buffer);\n    switch(c->state) {\n    case HTTPSTATE_SEND_DATA_HEADER:\n        memset(&c->fmt_ctx, 0, sizeof(c->fmt_ctx));\n        av_metadata_set2(&c->fmt_ctx.metadata, "author"   , c->stream->author   , 0);\n        av_metadata_set2(&c->fmt_ctx.metadata, "comment"  , c->stream->comment  , 0);\n        av_metadata_set2(&c->fmt_ctx.metadata, "copyright", c->stream->copyright, 0);\n        av_metadata_set2(&c->fmt_ctx.metadata, "title"    , c->stream->title    , 0);\n        for(i=0;i<c->stream->nb_streams;i++) {\n            AVStream *st;\n            AVStream *src;\n            st = av_mallocz(sizeof(AVStream));\n            c->fmt_ctx.streams[i] = st;\n            if (!c->stream->feed ||\n                c->stream->feed == c->stream)\n                src = c->stream->streams[i];\n            else\n                src = c->stream->feed->streams[c->stream->feed_streams[i]];\n            *st = *src;\n            st->priv_data = 0;\n            st->codec->frame_number = 0;\n        }\n        c->fmt_ctx.oformat = c->stream->fmt;\n        c->fmt_ctx.nb_streams = c->stream->nb_streams;\n        c->got_key_frame = 0;\n        if (url_open_dyn_buf(&c->fmt_ctx.pb) < 0) {\n            return -1;\n        }\n        c->fmt_ctx.pb->is_streamed = 1;\n        c->fmt_ctx.preload   = (int)(0.5*AV_TIME_BASE);\n        c->fmt_ctx.max_delay = (int)(0.7*AV_TIME_BASE);\n        av_set_parameters(&c->fmt_ctx, NULL);\n        if (av_write_header(&c->fmt_ctx) < 0) {\n            http_log("Error writing output header\\n");\n            return -1;\n        }\n        av_metadata_free(&c->fmt_ctx.metadata);\n        len = url_close_dyn_buf(c->fmt_ctx.pb, &c->pb_buffer);\n        c->buffer_ptr = c->pb_buffer;\n        c->buffer_end = c->pb_buffer + len;\n        c->state = HTTPSTATE_SEND_DATA;\n        c->last_packet_sent = 0;\n        break;\n    case HTTPSTATE_SEND_DATA:\n        if (c->stream->feed)\n            ffm_set_write_index(c->fmt_in,\n                                c->stream->feed->feed_write_index,\n                                c->stream->feed->feed_size);\n        if (c->stream->max_time &&\n            c->stream->max_time + c->start_time - cur_time < 0)\n            c->state = HTTPSTATE_SEND_DATA_TRAILER;\n        else {\n            AVPacket pkt;\n        redo:\n            ret = av_read_frame(c->fmt_in, &pkt);\n            if (ret < 0) {\n                if (c->stream->feed) {\n                    c->state = HTTPSTATE_WAIT_FEED;\n                    return 1;\n                } else if (ret == AVERROR(EAGAIN)) {\n                    return 0;\n                } else {\n                    if (c->stream->loop) {\n                        av_close_input_file(c->fmt_in);\n                        c->fmt_in = NULL;\n                        if (open_input_stream(c, "") < 0)\n                            goto no_loop;\n                        goto redo;\n                    } else {\n                    no_loop:\n                        c->state = HTTPSTATE_SEND_DATA_TRAILER;\n                    }\n                }\n            } else {\n                int source_index = pkt.stream_index;\n                if (c->first_pts == AV_NOPTS_VALUE) {\n                    c->first_pts = av_rescale_q(pkt.dts, c->fmt_in->streams[pkt.stream_index]->time_base, AV_TIME_BASE_Q);\n                    c->start_time = cur_time;\n                }\n                if (c->stream->feed) {\n                    if (c->switch_pending) {\n                        c->switch_pending = 0;\n                        for(i=0;i<c->stream->nb_streams;i++) {\n                            if (c->switch_feed_streams[i] == pkt.stream_index)\n                                if (pkt.flags & AV_PKT_FLAG_KEY)\n                                    c->switch_feed_streams[i] = -1;\n                            if (c->switch_feed_streams[i] >= 0)\n                                c->switch_pending = 1;\n                        }\n                    }\n                    for(i=0;i<c->stream->nb_streams;i++) {\n                        if (c->stream->feed_streams[i] == pkt.stream_index) {\n                            AVStream *st = c->fmt_in->streams[source_index];\n                            pkt.stream_index = i;\n                            if (pkt.flags & AV_PKT_FLAG_KEY &&\n                                (st->codec->codec_type == AVMEDIA_TYPE_VIDEO ||\n                                 c->stream->nb_streams == 1))\n                                c->got_key_frame = 1;\n                            if (!c->stream->send_on_key || c->got_key_frame)\n                                goto send_it;\n                        }\n                    }\n                } else {\n                    AVCodecContext *codec;\n                    AVStream *ist, *ost;\n                send_it:\n                    ist = c->fmt_in->streams[source_index];\n                    if (c->is_packetized) {\n                        c->cur_pts = av_rescale_q(pkt.dts, ist->time_base, AV_TIME_BASE_Q);\n                        c->cur_pts -= c->first_pts;\n                        c->cur_frame_duration = av_rescale_q(pkt.duration, ist->time_base, AV_TIME_BASE_Q);\n                        c->packet_stream_index = pkt.stream_index;\n                        ctx = c->rtp_ctx[c->packet_stream_index];\n                        if(!ctx) {\n                            av_free_packet(&pkt);\n                            break;\n                        }\n                        codec = ctx->streams[0]->codec;\n                        pkt.stream_index = 0;\n                    } else {\n                        ctx = &c->fmt_ctx;\n                        codec = ctx->streams[pkt.stream_index]->codec;\n                    }\n                    if (c->is_packetized) {\n                        int max_packet_size;\n                        if (c->rtp_protocol == RTSP_LOWER_TRANSPORT_TCP)\n                            max_packet_size = RTSP_TCP_MAX_PACKET_SIZE;\n                        else\n                            max_packet_size = url_get_max_packet_size(c->rtp_handles[c->packet_stream_index]);\n                        ret = url_open_dyn_packet_buf(&ctx->pb, max_packet_size);\n                    } else {\n                        ret = url_open_dyn_buf(&ctx->pb);\n                    }\n                    if (ret < 0) {\n                        return -1;\n                    }\n                    ost = ctx->streams[pkt.stream_index];\n                    ctx->pb->is_streamed = 1;\n                    if (pkt.dts != AV_NOPTS_VALUE)\n                        pkt.dts = av_rescale_q(pkt.dts, ist->time_base, ost->time_base);\n                    if (pkt.pts != AV_NOPTS_VALUE)\n                        pkt.pts = av_rescale_q(pkt.pts, ist->time_base, ost->time_base);\n                    pkt.duration = av_rescale_q(pkt.duration, ist->time_base, ost->time_base);\n                    if (av_write_frame(ctx, &pkt) < 0) {\n                        http_log("Error writing frame to output\\n");\n                        c->state = HTTPSTATE_SEND_DATA_TRAILER;\n                    }\n                    len = url_close_dyn_buf(ctx->pb, &c->pb_buffer);\n                    c->cur_frame_bytes = len;\n                    c->buffer_ptr = c->pb_buffer;\n                    c->buffer_end = c->pb_buffer + len;\n                    codec->frame_number++;\n                    if (len == 0) {\n                        av_free_packet(&pkt);\n                        goto redo;\n                    }\n                }\n                av_free_packet(&pkt);\n            }\n        }\n        break;\n    default:\n    case HTTPSTATE_SEND_DATA_TRAILER:\n        if (c->last_packet_sent || c->is_packetized)\n            return -1;\n        ctx = &c->fmt_ctx;\n        if (url_open_dyn_buf(&ctx->pb) < 0) {\n            return -1;\n        }\n        c->fmt_ctx.pb->is_streamed = 1;\n        av_write_trailer(ctx);\n        len = url_close_dyn_buf(ctx->pb, &c->pb_buffer);\n        c->buffer_ptr = c->pb_buffer;\n        c->buffer_end = c->pb_buffer + len;\n        c->last_packet_sent = 1;\n        break;\n    }\n    return 0;\n}', 'static int open_input_stream(HTTPContext *c, const char *info)\n{\n    char buf[128];\n    char input_filename[1024];\n    AVFormatContext *s;\n    int buf_size, i, ret;\n    int64_t stream_pos;\n    if (c->stream->feed) {\n        strcpy(input_filename, c->stream->feed->feed_filename);\n        buf_size = FFM_PACKET_SIZE;\n        if (av_find_info_tag(buf, sizeof(buf), "date", info)) {\n            if ((ret = av_parse_time(&stream_pos, buf, 0)) < 0)\n                return ret;\n        } else if (av_find_info_tag(buf, sizeof(buf), "buffer", info)) {\n            int prebuffer = strtol(buf, 0, 10);\n            stream_pos = av_gettime() - prebuffer * (int64_t)1000000;\n        } else\n            stream_pos = av_gettime() - c->stream->prebuffer * (int64_t)1000;\n    } else {\n        strcpy(input_filename, c->stream->feed_filename);\n        buf_size = 0;\n        if (av_find_info_tag(buf, sizeof(buf), "date", info)) {\n            if ((ret = av_parse_time(&stream_pos, buf, 1)) < 0)\n                return ret;\n        } else\n            stream_pos = 0;\n    }\n    if (input_filename[0] == \'\\0\')\n        return -1;\n    if ((ret = av_open_input_file(&s, input_filename, c->stream->ifmt,\n                                  buf_size, c->stream->ap_in)) < 0) {\n        http_log("could not open %s: %d\\n", input_filename, ret);\n        return -1;\n    }\n    s->flags |= AVFMT_FLAG_GENPTS;\n    c->fmt_in = s;\n    if (strcmp(s->iformat->name, "ffm") && av_find_stream_info(c->fmt_in) < 0) {\n        http_log("Could not find stream info \'%s\'\\n", input_filename);\n        av_close_input_file(s);\n        return -1;\n    }\n    for(i=0;i<s->nb_streams;i++)\n        open_parser(s, i);\n    c->pts_stream_index = 0;\n    for(i=0;i<c->stream->nb_streams;i++) {\n        if (c->pts_stream_index == 0 &&\n            c->stream->streams[i]->codec->codec_type == AVMEDIA_TYPE_VIDEO) {\n            c->pts_stream_index = i;\n        }\n    }\n#if 1\n    if (c->fmt_in->iformat->read_seek)\n        av_seek_frame(c->fmt_in, -1, stream_pos, 0);\n#endif\n    c->start_time = cur_time;\n    c->first_pts = AV_NOPTS_VALUE;\n    return 0;\n}', "int av_find_info_tag(char *arg, int arg_size, const char *tag1, const char *info)\n{\n    const char *p;\n    char tag[128], *q;\n    p = info;\n    if (*p == '?')\n        p++;\n    for(;;) {\n        q = tag;\n        while (*p != '\\0' && *p != '=' && *p != '&') {\n            if ((q - tag) < sizeof(tag) - 1)\n                *q++ = *p;\n            p++;\n        }\n        *q = '\\0';\n        q = arg;\n        if (*p == '=') {\n            p++;\n            while (*p != '&' && *p != '\\0') {\n                if ((q - arg) < arg_size - 1) {\n                    if (*p == '+')\n                        *q++ = ' ';\n                    else\n                        *q++ = *p;\n                }\n                p++;\n            }\n        }\n        *q = '\\0';\n        if (!strcmp(tag, tag1))\n            return 1;\n        if (*p != '&')\n            break;\n        p++;\n    }\n    return 0;\n}"]