libavformat/mpegtsenc.c:385: error: Buffer Overrun L2
  Offset added: [5, 189] (⇐ [4, 5] + [1, 184]) Size: 188 by call to `mpegts_write_section1`.

libavformat/mpegtsenc.c:225:1: Array declaration
223. }
224. 
225. static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
     ^
226. {
227.     MpegTSWrite *ts = s->priv_data;

libavformat/mpegtsenc.c:385:5: Call
383.                "or the total number of streams.\n", i);
384. 
385.     mpegts_write_section1(&service->pmt, PMT_TID, service->sid, 0, 0, 0,
         ^
386.                           data, q - data);
387. }

libavformat/mpegtsenc.c:156:1: Parameter `len`
  154. }
  155. 
  156. static int mpegts_write_section1(MpegTSSection *s, int tid, int id,
       ^
  157.                                  int version, int sec_num, int last_sec_num,
  158.                                  uint8_t *buf, int len)

libavformat/mpegtsenc.c:165:5: Assignment
  163.     unsigned int flags = tid == SDT_TID ? 0xf000 : 0xb000;
  164. 
  165.     tot_len = 3 + 5 + len + 4;
           ^
  166.     /* check if not too big */
  167.     if (tot_len > 1024)

libavformat/mpegtsenc.c:179:5: Call
  177.     memcpy(q, buf, len);
  178. 
  179.     mpegts_write_section(s, section, tot_len);
           ^
  180.     return 0;
  181. }

libavformat/mpegtsenc.c:99:1: <Offset trace>
 97. 
 98. /* NOTE: 4 bytes must be left at the end for the crc32 */
 99. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
     ^
100. {
101.     unsigned int crc;

libavformat/mpegtsenc.c:99:1: Parameter `len`
     97. 
     98. /* NOTE: 4 bytes must be left at the end for the crc32 */
     99. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
         ^
    100. {
    101.     unsigned int crc;

libavformat/mpegtsenc.c:99:1: <Length trace>
 97. 
 98. /* NOTE: 4 bytes must be left at the end for the crc32 */
 99. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
     ^
100. {
101.     unsigned int crc;

libavformat/mpegtsenc.c:99:1: Array declaration
     97. 
     98. /* NOTE: 4 bytes must be left at the end for the crc32 */
     99. static void mpegts_write_section(MpegTSSection *s, uint8_t *buf, int len)
         ^
    100. {
    101.     unsigned int crc;

libavformat/mpegtsenc.c:119:9: Assignment
    117.     while (len > 0) {
    118.         first = buf == buf_ptr;
    119.         q     = packet;
                 ^
    120.         *q++  = 0x47;
    121.         b     = s->pid >> 8;

libavformat/mpegtsenc.c:120:10: Assignment
    118.         first = buf == buf_ptr;
    119.         q     = packet;
    120.         *q++  = 0x47;
                  ^
    121.         b     = s->pid >> 8;
    122.         if (first)

libavformat/mpegtsenc.c:124:10: Assignment
    122.         if (first)
    123.             b |= 0x40;
    124.         *q++  = b;
                  ^
    125.         *q++  = s->pid;
    126.         s->cc = s->cc + 1 & 0xf;

libavformat/mpegtsenc.c:125:10: Assignment
    123.             b |= 0x40;
    124.         *q++  = b;
    125.         *q++  = s->pid;
                  ^
    126.         s->cc = s->cc + 1 & 0xf;
    127.         *q++  = 0x10 | s->cc;

libavformat/mpegtsenc.c:127:10: Assignment
    125.         *q++  = s->pid;
    126.         s->cc = s->cc + 1 & 0xf;
    127.         *q++  = 0x10 | s->cc;
                  ^
    128.         if (first)
    129.             *q++ = 0; /* 0 offset */

libavformat/mpegtsenc.c:133:9: Array access: Offset added: [5, 189] (⇐ [4, 5] + [1, 184]) Size: 188 by call to `mpegts_write_section1` 
    131.         if (len1 > len)
    132.             len1 = len;
    133.         memcpy(q, buf_ptr, len1);
                 ^
    134.         q += len1;
    135.         /* add known padding data */
