libavformat/mpegtsenc.c:195: error: Buffer Overrun L2
  Offset added: [5, 189] (⇐ [4, 5] + [1, 184]) Size: 188 by call to `mpegts_write_section1`.

libavformat/mpegtsenc.c:182:1: Array declaration
180. } MpegTSWriteStream;
181. 
182. static void mpegts_write_pat(AVFormatContext *s)
     ^
183. {
184.     MpegTSWrite *ts = s->priv_data;

libavformat/mpegtsenc.c:195:5: Call
193.         put16(&q, 0xe000 | service->pmt.pid);
194.     }
195.     mpegts_write_section1(&ts->pat, PAT_TID, ts->tsid, 0, 0, 0,
         ^
196.                           data, q - data);
197. }

libavformat/mpegtsenc.c:124:1: Parameter `len`
  122. }
  123. 
  124. static int mpegts_write_section1(MpegTSSection *s, int tid, int id,
       ^
  125.                           int version, int sec_num, int last_sec_num,
  126.                           uint8_t *buf, int len)

libavformat/mpegtsenc.c:131:5: Assignment
  129.     unsigned int tot_len;
  130. 
  131.     tot_len = 3 + 5 + len + 4;
           ^
  132.     /* check if not too big */
  133.     if (tot_len > 1024)

libavformat/mpegtsenc.c:145:5: Call
  143.     memcpy(q, buf, len);
  144. 
  145.     mpegts_write_section(s, section, tot_len);
           ^
  146.     return 0;
  147. }

libavformat/mpegtsenc.c:66:1: <Offset trace>
64. 
65. /* NOTE: 4 bytes must be left at the end for the crc32 */
66. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
    ^
67. {
68.     MpegTSWrite *ts = ((AVFormatContext*)s->opaque)->priv_data;

libavformat/mpegtsenc.c:66:1: Parameter `len`
    64. 
    65. /* NOTE: 4 bytes must be left at the end for the crc32 */
    66. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
        ^
    67. {
    68.     MpegTSWrite *ts = ((AVFormatContext*)s->opaque)->priv_data;

libavformat/mpegtsenc.c:66:1: <Length trace>
64. 
65. /* NOTE: 4 bytes must be left at the end for the crc32 */
66. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
    ^
67. {
68.     MpegTSWrite *ts = ((AVFormatContext*)s->opaque)->priv_data;

libavformat/mpegtsenc.c:66:1: Array declaration
    64. 
    65. /* NOTE: 4 bytes must be left at the end for the crc32 */
    66. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
        ^
    67. {
    68.     MpegTSWrite *ts = ((AVFormatContext*)s->opaque)->priv_data;

libavformat/mpegtsenc.c:85:9: Assignment
    83.     while (len > 0) {
    84.         first = (buf == buf_ptr);
    85.         q = packet;
                ^
    86.         *q++ = 0x47;
    87.         b = (s->pid >> 8);

libavformat/mpegtsenc.c:86:10: Assignment
    84.         first = (buf == buf_ptr);
    85.         q = packet;
    86.         *q++ = 0x47;
                 ^
    87.         b = (s->pid >> 8);
    88.         if (first)

libavformat/mpegtsenc.c:90:10: Assignment
    88.         if (first)
    89.             b |= 0x40;
    90.         *q++ = b;
                 ^
    91.         *q++ = s->pid;
    92.         s->cc = (s->cc + 1) & 0xf;

libavformat/mpegtsenc.c:91:10: Assignment
    89.             b |= 0x40;
    90.         *q++ = b;
    91.         *q++ = s->pid;
                 ^
    92.         s->cc = (s->cc + 1) & 0xf;
    93.         *q++ = 0x10 | s->cc;

libavformat/mpegtsenc.c:93:10: Assignment
    91.         *q++ = s->pid;
    92.         s->cc = (s->cc + 1) & 0xf;
    93.         *q++ = 0x10 | s->cc;
                 ^
    94.         if (first)
    95.             *q++ = 0; /* 0 offset */

libavformat/mpegtsenc.c:99:9: Array access: Offset added: [5, 189] (⇐ [4, 5] + [1, 184]) Size: 188 by call to `mpegts_write_section1` 
     97.         if (len1 > len)
     98.             len1 = len;
     99.         memcpy(q, buf_ptr, len1);
                 ^
    100.         q += len1;
    101.         /* add known padding data */
