libavformat/rtsp.c:1587: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `rtsp_read_packet`.

libavformat/rtsp.c:1587:12: Call
1585.                             AVPacket *pkt)
1586. {
1587.     return rtsp_read_packet(s, pkt);
                 ^
1588. }
1589. 

libavformat/rtsp.c:1293:1: Parameter `cmd.strlen`
  1291. }
  1292. 
  1293. static int rtsp_read_packet(AVFormatContext *s,
        ^
  1294.                             AVPacket *pkt)
  1295. {

libavformat/rtsp.c:1352:13: Call
  1350.                 }
  1351.             }
  1352.             av_strlcatf(cmd, sizeof(cmd), "%s\r\n", rt->last_subscription);
                    ^
  1353.             rtsp_send_cmd(s, cmd, reply, NULL);
  1354.             if (reply->status_code != RTSP_STATUS_OK)

libavutil/string.c:68:1: <LHS trace>
66. }
67. 
68. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
    ^
69. {
70.     int len = strlen(dst);

libavutil/string.c:68:1: Parameter `size`
    66. }
    67. 
    68. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
        ^
    69. {
    70.     int len = strlen(dst);

libavutil/string.c:74:12: <RHS trace>
72. 
73.     va_start(vl, fmt);
74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
               ^
75.     va_end(vl);
76. 

libavutil/string.c:74:12: Risky value from: vsnprintf
    72. 
    73.     va_start(vl, fmt);
    74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                   ^
    75.     va_end(vl);
    76. 

libavutil/string.c:74:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `rtsp_read_packet` 
    72. 
    73.     va_start(vl, fmt);
    74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
            ^
    75.     va_end(vl);
    76. 
