libavformat/rtsp.c:1619: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `ff_rdt_subscribe_rule`.

libavformat/rtsp.c:1572:1: Parameter `s->priv_data->last_subscription.*.strlen`
1570. }
1571. 
1572. static int rtsp_read_packet(AVFormatContext *s, AVPacket *pkt)
      ^
1573. {
1574.     RTSPState *rt = s->priv_data;

libavformat/rtsp.c:1619:29: Call
1617.                                 av_strlcat(rt->last_subscription, ",",
1618.                                            sizeof(rt->last_subscription));
1619.                             ff_rdt_subscribe_rule(
                                  ^
1620.                                 rt->last_subscription,
1621.                                 sizeof(rt->last_subscription), i, rule_nr);

libavformat/rdt.c:386:1: Parameter `cmd->strlen`
  384. }
  385. 
  386. void
       ^
  387. ff_rdt_subscribe_rule (char *cmd, int size,
  388.                        int stream_nr, int rule_nr)

libavformat/rdt.c:390:5: Call
  388.                        int stream_nr, int rule_nr)
  389. {
  390.     av_strlcatf(cmd, size, "stream=%d;rule=%d,stream=%d;rule=%d",
           ^
  391.                 stream_nr, rule_nr * 2, stream_nr, rule_nr * 2 + 1);
  392. }

libavutil/avstring.c:69:1: <LHS trace>
67. }
68. 
69. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
    ^
70. {
71.     int len = strlen(dst);

libavutil/avstring.c:69:1: Parameter `size`
    67. }
    68. 
    69. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
        ^
    70. {
    71.     int len = strlen(dst);

libavutil/avstring.c:75:12: <RHS trace>
73. 
74.     va_start(vl, fmt);
75.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
               ^
76.     va_end(vl);
77. 

libavutil/avstring.c:75:12: Risky value from: vsnprintf
    73. 
    74.     va_start(vl, fmt);
    75.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                   ^
    76.     va_end(vl);
    77. 

libavutil/avstring.c:75:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `ff_rdt_subscribe_rule` 
    73. 
    74.     va_start(vl, fmt);
    75.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
            ^
    76.     va_end(vl);
    77. 
