libavformat/matroskadec.c:1916: error: Buffer Overrun L3
  Offset: [-1, 0] Size: [0, 2147483631] by call to `av_dict_set`.

libavformat/matroskadec.c:1813:1: Parameter `**s->chapters`
1811. }
1812. 
1813. static int matroska_read_header(AVFormatContext *s)
      ^
1814. {
1815.     MatroskaDemuxContext *matroska = s->priv_data;

libavformat/matroskadec.c:1912:17: Call
1910.             (max_start == 0 || chapters[i].start > max_start)) {
1911.             chapters[i].chapter =
1912.                 avpriv_new_chapter(s, chapters[i].uid,
                      ^
1913.                                    (AVRational) { 1, 1000000000 },
1914.                                    chapters[i].start, chapters[i].end,

libavformat/utils.c:2601:13: Assignment
  2599.         chapter = av_mallocz(sizeof(AVChapter));
  2600.         if (!chapter)
  2601.             return NULL;
                    ^
  2602.         dynarray_add(&s->chapters, &s->nb_chapters, chapter);
  2603.     }

libavformat/matroskadec.c:1911:13: Assignment
1909.         if (chapters[i].start != AV_NOPTS_VALUE && chapters[i].uid &&
1910.             (max_start == 0 || chapters[i].start > max_start)) {
1911.             chapters[i].chapter =
                  ^
1912.                 avpriv_new_chapter(s, chapters[i].uid,
1913.                                    (AVRational) { 1, 1000000000 },

libavformat/matroskadec.c:1916:13: Call
1914.                                    chapters[i].start, chapters[i].end,
1915.                                    chapters[i].title);
1916.             av_dict_set(&chapters[i].chapter->metadata,
                  ^
1917.                         "title", chapters[i].title, 0);
1918.             max_start = chapters[i].start;

libavutil/dict.c:68:1: <Offset trace>
66. }
67. 
68. int av_dict_set(AVDictionary **pm, const char *key, const char *value,
    ^
69.                 int flags)
70. {

libavutil/dict.c:68:1: Parameter `(*pm)->count`
  66. }
  67. 
  68. int av_dict_set(AVDictionary **pm, const char *key, const char *value,
      ^
  69.                 int flags)
  70. {

libavutil/dict.c:72:30: Call
  70. {
  71.     AVDictionary *m = *pm;
  72.     AVDictionaryEntry *tag = av_dict_get(m, key, NULL, flags);
                                   ^
  73.     char *oldval = NULL;
  74.     int allocated = !!m;

libavutil/dict.c:38:1: Parameter `m->count`
    36. }
    37. 
    38. AVDictionaryEntry *av_dict_get(const AVDictionary *m, const char *key,
        ^
    39.                                const AVDictionaryEntry *prev, int flags)
    40. {

libavutil/dict.c:68:1: <Length trace>
66. }
67. 
68. int av_dict_set(AVDictionary **pm, const char *key, const char *value,
    ^
69.                 int flags)
70. {

libavutil/dict.c:68:1: Parameter `*(*pm)->elems`
  66. }
  67. 
  68. int av_dict_set(AVDictionary **pm, const char *key, const char *value,
      ^
  69.                 int flags)
  70. {

libavutil/dict.c:105:13: Array access: Offset: [-1, 0] Size: [0, 2147483631] by call to `av_dict_set` 
  103.     if (value) {
  104.         if (flags & AV_DICT_DONT_STRDUP_KEY)
  105.             m->elems[m->count].key = key;
                   ^
  106.         else
  107.             m->elems[m->count].key = av_strdup(key);
