libavformat/rtsp.c:1963: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `ff_rdt_subscribe_rule`.

libavformat/rtsp.c:1919:1: Parameter `s->priv_data->last_subscription.*.strlen`
1917.     return len;
1918. }
1919. static int rtsp_read_packet(AVFormatContext *s, AVPacket *pkt)
      ^
1920. {
1921.     RTSPState *rt = s->priv_data;

libavformat/rtsp.c:1963:29: Call
1961.                                 av_strlcat(rt->last_subscription, ",",
1962.                                            sizeof(rt->last_subscription));
1963.                             ff_rdt_subscribe_rule(
                                  ^
1964.                                 rt->last_subscription,
1965.                                 sizeof(rt->last_subscription), i, rule_nr);

libavformat/rdt.c:387:1: Parameter `cmd->strlen`
  385. }
  386. 
  387. void
       ^
  388. ff_rdt_subscribe_rule (char *cmd, int size,
  389.                        int stream_nr, int rule_nr)

libavformat/rdt.c:391:5: Call
  389.                        int stream_nr, int rule_nr)
  390. {
  391.     av_strlcatf(cmd, size, "stream=%d;rule=%d,stream=%d;rule=%d",
           ^
  392.                 stream_nr, rule_nr * 2, stream_nr, rule_nr * 2 + 1);
  393. }

libavutil/avstring.c:82:1: <LHS trace>
80. }
81. 
82. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
    ^
83. {
84.     int len = strlen(dst);

libavutil/avstring.c:82:1: Parameter `size`
    80. }
    81. 
    82. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
        ^
    83. {
    84.     int len = strlen(dst);

libavutil/avstring.c:88:12: <RHS trace>
86. 
87.     va_start(vl, fmt);
88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
               ^
89.     va_end(vl);
90. 

libavutil/avstring.c:88:12: Risky value from: vsnprintf
    86. 
    87.     va_start(vl, fmt);
    88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                   ^
    89.     va_end(vl);
    90. 

libavutil/avstring.c:88:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `ff_rdt_subscribe_rule` 
    86. 
    87.     va_start(vl, fmt);
    88.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
            ^
    89.     va_end(vl);
    90. 
