libavformat/rtsp.c:1313: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `ff_rdt_subscribe_rule`.

libavformat/rtsp.c:1294:1: Parameter `cmd.strlen`
1292. }
1293. 
1294. static int rtsp_read_packet(AVFormatContext *s,
      ^
1295.                             AVPacket *pkt)
1296. {

libavformat/rtsp.c:1313:13: Call
1311.         for (i = 0; i < rt->nb_rtsp_streams; i++) {
1312.             if (i != 0) av_strlcat(cmd, ",", sizeof(cmd));
1313.             ff_rdt_subscribe_rule(
                  ^
1314.                 rt->rtsp_streams[i]->rtp_ctx,
1315.                 cmd, sizeof(cmd), i, 0);

libavformat/rdt.c:236:1: Parameter `cmd->strlen`
  234. }
  235. 
  236. void
       ^
  237. ff_rdt_subscribe_rule (RTPDemuxContext *s, char *cmd, int size,
  238.                        int stream_nr, int rule_nr)

libavformat/rdt.c:242:5: Call
  240.     rdt_data *rdt = s->dynamic_protocol_context;
  241. 
  242.     av_strlcatf(cmd, size, "stream=%d;rule=%d,stream=%d;rule=%d",
           ^
  243.                 stream_nr, rule_nr, stream_nr, rule_nr + 1);
  244. 

libavutil/string.c:68:1: <LHS trace>
66. }
67. 
68. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
    ^
69. {
70.     int len = strlen(dst);

libavutil/string.c:68:1: Parameter `size`
    66. }
    67. 
    68. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
        ^
    69. {
    70.     int len = strlen(dst);

libavutil/string.c:74:12: <RHS trace>
72. 
73.     va_start(vl, fmt);
74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
               ^
75.     va_end(vl);
76. 

libavutil/string.c:74:12: Risky value from: vsnprintf
    72. 
    73.     va_start(vl, fmt);
    74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                   ^
    75.     va_end(vl);
    76. 

libavutil/string.c:74:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `ff_rdt_subscribe_rule` 
    72. 
    73.     va_start(vl, fmt);
    74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
            ^
    75.     va_end(vl);
    76. 
