libavformat/rtsp.c:1217: error: Integer Overflow R2
  ([0, +oo] + [0, +oo]):signed32 by call to `make_setup_request`.

libavformat/rtsp.c:1141:9: Call
1139.     /* open the tcp connexion */
1140.     snprintf(tcpname, sizeof(tcpname), "tcp://%s:%d", host, port);
1141.     if (url_open(&rtsp_hd, tcpname, URL_RDWR) < 0)
              ^
1142.         return AVERROR(EIO);
1143.     rt->rtsp_hd = rtsp_hd;

libavformat/avio.c:111:14: Unknown value from: __ctype_b_loc
  109.     while (*p != '\0' && *p != ':') {
  110.         /* protocols can only contain alphabetic chars */
  111.         if (!isalpha(*p))
                    ^
  112.             goto file_proto;
  113.         if ((q - proto_str) < sizeof(proto_str) - 1)

libavformat/rtsp.c:1217:15: Call
1215.         int lower_transport = ff_log2_tab[lower_transport_mask & ~(lower_transport_mask - 1)];
1216. 
1217.         err = make_setup_request(s, host, port, lower_transport,
                    ^
1218.                                  rt->server_type == RTSP_SERVER_REAL ?
1219.                                      real_challenge : NULL);

libavformat/rtsp.c:928:1: Parameter `cmd.strlen`
  926.  * @returns 0 on success, <0 on error, 1 if protocol is unavailable.
  927.  */
  928. static int
       ^
  929. make_setup_request (AVFormatContext *s, const char *host, int port,
  930.                     int lower_transport, const char *real_challenge)

libavformat/rtsp.c:1007:13: Call
  1005.             ff_rdt_calc_response_and_checksum(real_res, real_csum,
  1006.                                               real_challenge);
  1007.             av_strlcatf(cmd, sizeof(cmd),
                    ^
  1008.                         "If-Match: %s\r\n"
  1009.                         "RealChallenge2: %s, sd=%s\r\n",

libavutil/string.c:68:1: <LHS trace>
66. }
67. 
68. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
    ^
69. {
70.     int len = strlen(dst);

libavutil/string.c:68:1: Parameter `size`
    66. }
    67. 
    68. size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
        ^
    69. {
    70.     int len = strlen(dst);

libavutil/string.c:74:12: <RHS trace>
72. 
73.     va_start(vl, fmt);
74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
               ^
75.     va_end(vl);
76. 

libavutil/string.c:74:12: Risky value from: vsnprintf
    72. 
    73.     va_start(vl, fmt);
    74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
                   ^
    75.     va_end(vl);
    76. 

libavutil/string.c:74:5: Binary operation: ([0, +oo] + [0, +oo]):signed32 by call to `make_setup_request` 
    72. 
    73.     va_start(vl, fmt);
    74.     len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
            ^
    75.     va_end(vl);
    76. 
