libavformat/mpegtsenc.c:385: error: Buffer Overrun L2
  Offset added: [6, 372] (⇐ [5, 189] + [1, 183]) Size: 188 by call to `mpegts_write_section1`.

libavformat/mpegtsenc.c:225:1: Array declaration
223. }
224. 
225. static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
     ^
226. {
227.     MpegTSWrite *ts = s->priv_data;

libavformat/mpegtsenc.c:385:5: Call
383.                "or the total number of streams.\n", i);
384. 
385.     mpegts_write_section1(&service->pmt, PMT_TID, service->sid, 0, 0, 0,
         ^
386.                           data, q - data);
387. }

libavformat/mpegtsenc.c:156:1: Parameter `len`
  154. }
  155. 
  156. static int mpegts_write_section1(MpegTSSection *s, int tid, int id,
       ^
  157.                                  int version, int sec_num, int last_sec_num,
  158.                                  uint8_t *buf, int len)

libavformat/mpegtsenc.c:165:5: Assignment
  163.     unsigned int flags = tid == SDT_TID ? 0xf000 : 0xb000;
  164. 
  165.     tot_len = 3 + 5 + len + 4;
           ^
  166.     /* check if not too big */
  167.     if (tot_len > 1024)

libavformat/mpegtsenc.c:179:5: Call
  177.     memcpy(q, buf, len);
  178. 
  179.     mpegts_write_section(s, section, tot_len);
           ^
  180.     return 0;
  181. }

libavformat/mpegtsenc.c:99:1: <Offset trace>
 97. 
 98. /* NOTE: 4 bytes must be left at the end for the crc32 */
 99. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
     ^
100. {
101.     unsigned int crc;

libavformat/mpegtsenc.c:99:1: Array declaration
     97. 
     98. /* NOTE: 4 bytes must be left at the end for the crc32 */
     99. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
         ^
    100. {
    101.     unsigned int crc;

libavformat/mpegtsenc.c:136:9: Assignment
    134.         q += len1;
    135.         /* add known padding data */
    136.         left = TS_PACKET_SIZE - (q - packet);
                 ^
    137.         if (left > 0)
    138.             memset(q, 0xff, left);

libavformat/mpegtsenc.c:99:1: <Length trace>
 97. 
 98. /* NOTE: 4 bytes must be left at the end for the crc32 */
 99. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
     ^
100. {
101.     unsigned int crc;

libavformat/mpegtsenc.c:99:1: Parameter `len`
     97. 
     98. /* NOTE: 4 bytes must be left at the end for the crc32 */
     99. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
         ^
    100. {
    101.     unsigned int crc;

libavformat/mpegtsenc.c:134:9: Assignment
    132.             len1 = len;
    133.         memcpy(q, buf_ptr, len1);
    134.         q += len1;
                 ^
    135.         /* add known padding data */
    136.         left = TS_PACKET_SIZE - (q - packet);

libavformat/mpegtsenc.c:138:13: Array access: Offset added: [6, 372] (⇐ [5, 189] + [1, 183]) Size: 188 by call to `mpegts_write_section1` 
    136.         left = TS_PACKET_SIZE - (q - packet);
    137.         if (left > 0)
    138.             memset(q, 0xff, left);
                     ^
    139. 
    140.         s->write_packet(s, packet);
