libavformat/matroskaenc.c:926: error: Integer Overflow R2
  ([0, +oo] + [-oo, +oo]):signed32.

libavformat/matroskaenc.c:924:13: <LHS trace>
922.         size -= start - data;
923.         sscanf(data, "Dialogue: %d,", &layer);
924.         i = snprintf(buffer, sizeof(buffer), "%"PRId64",%d,",
                 ^
925.                      s->streams[pkt->stream_index]->nb_frames++, layer);
926.         size = FFMIN(i+size, sizeof(buffer));

libavformat/matroskaenc.c:924:13: Risky value from: snprintf
922.         size -= start - data;
923.         sscanf(data, "Dialogue: %d,", &layer);
924.         i = snprintf(buffer, sizeof(buffer), "%"PRId64",%d,",
                 ^
925.                      s->streams[pkt->stream_index]->nb_frames++, layer);
926.         size = FFMIN(i+size, sizeof(buffer));

libavformat/matroskaenc.c:924:9: Assignment
922.         size -= start - data;
923.         sscanf(data, "Dialogue: %d,", &layer);
924.         i = snprintf(buffer, sizeof(buffer), "%"PRId64",%d,",
             ^
925.                      s->streams[pkt->stream_index]->nb_frames++, layer);
926.         size = FFMIN(i+size, sizeof(buffer));

libavformat/matroskaenc.c:904:1: <RHS trace>
902. }
903. 
904. static int mkv_write_ass_blocks(AVFormatContext *s, AVIOContext *pb, AVPacket *pkt)
     ^
905. {
906.     MatroskaMuxContext *mkv = s->priv_data;

libavformat/matroskaenc.c:904:1: Parameter `*pkt->data`
902. }
903. 
904. static int mkv_write_ass_blocks(AVFormatContext *s, AVIOContext *pb, AVPacket *pkt)
     ^
905. {
906.     MatroskaMuxContext *mkv = s->priv_data;

libavformat/matroskaenc.c:908:5: Assignment
906.     MatroskaMuxContext *mkv = s->priv_data;
907.     int i, layer = 0, max_duration = 0, size, line_size, data_size = pkt->size;
908.     uint8_t *start, *end, *data = pkt->data;
         ^
909.     ebml_master blockgroup;
910.     char buffer[2048];

libavformat/matroskaenc.c:922:9: Assignment
920.             if (!(start = memchr(start, ',', size-(start-data))))
921.                 return max_duration;
922.         size -= start - data;
             ^
923.         sscanf(data, "Dialogue: %d,", &layer);
924.         i = snprintf(buffer, sizeof(buffer), "%"PRId64",%d,",

libavformat/matroskaenc.c:926:16: Binary operation: ([0, +oo] + [-oo, +oo]):signed32
924.         i = snprintf(buffer, sizeof(buffer), "%"PRId64",%d,",
925.                      s->streams[pkt->stream_index]->nb_frames++, layer);
926.         size = FFMIN(i+size, sizeof(buffer));
                    ^
927.         memcpy(buffer+i, start, size-i);
928. 
