ffserver.c:2666: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `avf_sdp_create`.

ffserver.c:2657:18: Unknown value from: inet_ntoa
2655.     if (stream->is_multicast) {
2656.         snprintf(avc->filename, 1024, "rtp://%s:%d?multicast=1?ttl=%d",
2657.                  inet_ntoa(stream->multicast_ip),
                       ^
2658.                  stream->multicast_port, stream->multicast_ttl);
2659.     }

ffserver.c:2666:5: Call
2664.     }
2665.     *pbuffer = av_mallocz(2048);
2666.     avf_sdp_create(&avc, 1, *pbuffer, 2048);
          ^
2667.     av_free(avc);
2668. 

libavformat/sdp.c:277:1: Parameter `buff->strlen`
  275. }
  276. 
  277. int avf_sdp_create(AVFormatContext *ac[], int n_files, char *buff, int size)
       ^
  278. {
  279.     struct sdp_session_level s;

libavformat/sdp.c:298:5: Call
  296.         }
  297.     }
  298.     sdp_write_header(buff, size, &s);
           ^
  299. 
  300.     dst[0] = 0;

libavformat/sdp.c:56:1: Parameter `buff->strlen`
    54. }
    55. 
    56. static void sdp_write_header(char *buff, int size, struct sdp_session_level *s)
        ^
    57. {
    58.     av_strlcatf(buff, size, "v=%d\r\n"

libavformat/sdp.c:67:5: Call
    65.                             s->start_time, s->end_time,
    66.                             s->name[0] ? s->name : "No Name");
    67.     dest_write(buff, size, s->dst_addr, s->ttl);
            ^
    68. }
    69. 

libavformat/sdp.c:45:1: Parameter `buff->strlen`
      43. };
      44. 
      45. static void dest_write(char *buff, int size, const char *dest_addr, int ttl)
          ^
      46. {
      47.     if (dest_addr) {

libavformat/sdp.c:49:13: Call
      47.     if (dest_addr) {
      48.         if (ttl > 0) {
      49.             av_strlcatf(buff, size, "c=IN IP4 %s/%d\r\n", dest_addr, ttl);
                      ^
      50.         } else {
      51.             av_strlcatf(buff, size, "c=IN IP4 %s\r\n", dest_addr);

libavutil/string.c:68:1: <LHS trace>
66. }
67. 
68. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
    ^
69. {
70.     int len = strlen(dst);

libavutil/string.c:68:1: Parameter `size`
        66. }
        67. 
        68. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
            ^
        69. {
        70.     int len = strlen(dst);

libavutil/string.c:74:12: <RHS trace>
72. 
73.     va_start(vl, fmt);
74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
               ^
75.     va_end(vl);
76. 

libavutil/string.c:74:12: Risky value from: vsnprintf
        72. 
        73.     va_start(vl, fmt);
        74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                       ^
        75.     va_end(vl);
        76. 

libavutil/string.c:74:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `avf_sdp_create` 
        72. 
        73.     va_start(vl, fmt);
        74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                ^
        75.     va_end(vl);
        76. 
