libavcodec/svq3.c:1048: error: Null Dereference
  pointer `s->gb_slice.buffer` last assigned on line 1045 could be null and is dereferenced at line 1048, column 31.

libavcodec/svq3.c:1011:1: start of procedure svq3_decode_slice_header()
1009. }
1010. 
1011. static int svq3_decode_slice_header(AVCodecContext *avctx)
      ^
1012. {
1013.     SVQ3Context *s = avctx->priv_data;

libavcodec/svq3.c:1013:5: 
1011. static int svq3_decode_slice_header(AVCodecContext *avctx)
1012. {
1013.     SVQ3Context *s = avctx->priv_data;
          ^
1014.     const int mb_xy   = s->mb_xy;
1015.     int i, header;

libavcodec/svq3.c:1014:5: 
1012. {
1013.     SVQ3Context *s = avctx->priv_data;
1014.     const int mb_xy   = s->mb_xy;
          ^
1015.     int i, header;
1016.     unsigned slice_id;

libavcodec/svq3.c:1018:5: Skipping get_bits(): empty list of specs
1016.     unsigned slice_id;
1017. 
1018.     header = get_bits(&s->gb, 8);
          ^
1019. 
1020.     if (((header & 0x9F) != 1 && (header & 0x9F) != 2) || (header & 0x60) == 0) {

libavcodec/svq3.c:1020:10: Taking false branch
1018.     header = get_bits(&s->gb, 8);
1019. 
1020.     if (((header & 0x9F) != 1 && (header & 0x9F) != 2) || (header & 0x60) == 0) {
               ^
1021.         /* TODO: what? */
1022.         av_log(avctx, AV_LOG_ERROR, "unsupported slice header (%02X)\n", header);

libavcodec/svq3.c:1020:59: Taking false branch
1018.     header = get_bits(&s->gb, 8);
1019. 
1020.     if (((header & 0x9F) != 1 && (header & 0x9F) != 2) || (header & 0x60) == 0) {
                                                                ^
1021.         /* TODO: what? */
1022.         av_log(avctx, AV_LOG_ERROR, "unsupported slice header (%02X)\n", header);

libavcodec/svq3.c:1026:9: 
1024.     } else {
1025.         int slice_bits, slice_bytes, slice_length;
1026.         int length = header >> 5 & 3;
              ^
1027. 
1028.         slice_length = show_bits(&s->gb, 8 * length);

libavcodec/svq3.c:1028:9: Skipping show_bits(): empty list of specs
1026.         int length = header >> 5 & 3;
1027. 
1028.         slice_length = show_bits(&s->gb, 8 * length);
              ^
1029.         slice_bits   = slice_length * 8;
1030.         slice_bytes  = slice_length + length - 1;

libavcodec/svq3.c:1029:9: 
1027. 
1028.         slice_length = show_bits(&s->gb, 8 * length);
1029.         slice_bits   = slice_length * 8;
              ^
1030.         slice_bytes  = slice_length + length - 1;
1031. 

libavcodec/svq3.c:1030:9: 
1028.         slice_length = show_bits(&s->gb, 8 * length);
1029.         slice_bits   = slice_length * 8;
1030.         slice_bytes  = slice_length + length - 1;
              ^
1031. 
1032.         if (slice_bytes > get_bits_left(&s->gb)) {

libavcodec/svq3.c:1032:13: 
1030.         slice_bytes  = slice_length + length - 1;
1031. 
1032.         if (slice_bytes > get_bits_left(&s->gb)) {
                  ^
1033.             av_log(avctx, AV_LOG_ERROR, "slice after bitstream end\n");
1034.             return -1;

libavcodec/get_bits.h:526:1: start of procedure get_bits_left()
  524. }
  525. 
  526. static inline int get_bits_left(GetBitContext *gb)
       ^
  527. {
  528.     return gb->size_in_bits - get_bits_count(gb);

libavcodec/get_bits.h:528:5: 
  526. static inline int get_bits_left(GetBitContext *gb)
  527. {
  528.     return gb->size_in_bits - get_bits_count(gb);
           ^
  529. }
  530. 

libavcodec/get_bits.h:182:1: start of procedure get_bits_count()
    180. #define GET_CACHE(name, gb) ((uint32_t) name ## _cache)
    181. 
    182. static inline int get_bits_count(const GetBitContext *s)
         ^
    183. {
    184.     return s->index;

libavcodec/get_bits.h:184:5: 
    182. static inline int get_bits_count(const GetBitContext *s)
    183. {
    184.     return s->index;
             ^
    185. }
    186. 

libavcodec/get_bits.h:185:1: return from a call to get_bits_count
    183. {
    184.     return s->index;
    185. }
         ^
    186. 
    187. static inline void skip_bits_long(GetBitContext *s, int n)

libavcodec/get_bits.h:529:1: return from a call to get_bits_left
  527. {
  528.     return gb->size_in_bits - get_bits_count(gb);
  529. }
       ^
  530. 
  531. #endif /* AVCODEC_GET_BITS_H */

libavcodec/svq3.c:1032:13: Taking false branch
1030.         slice_bytes  = slice_length + length - 1;
1031. 
1032.         if (slice_bytes > get_bits_left(&s->gb)) {
                  ^
1033.             av_log(avctx, AV_LOG_ERROR, "slice after bitstream end\n");
1034.             return -1;

libavcodec/svq3.c:1037:9: Skipping skip_bits(): empty list of specs
1035.         }
1036. 
1037.         skip_bits(&s->gb, 8);
              ^
1038. 
1039.         av_fast_malloc(&s->slice_buf, &s->slice_size, slice_bytes + AV_INPUT_BUFFER_PADDING_SIZE);

libavcodec/svq3.c:1039:9: 
1037.         skip_bits(&s->gb, 8);
1038. 
1039.         av_fast_malloc(&s->slice_buf, &s->slice_size, slice_bytes + AV_INPUT_BUFFER_PADDING_SIZE);
              ^
1040.         if (!s->slice_buf)
1041.             return AVERROR(ENOMEM);

libavutil/mem.c:371:1: start of procedure av_fast_malloc()
  369. }
  370. 
  371. void av_fast_malloc(void *ptr, unsigned int *size, size_t min_size)
       ^
  372. {
  373.     void **p = ptr;

libavutil/mem.c:373:5: 
  371. void av_fast_malloc(void *ptr, unsigned int *size, size_t min_size)
  372. {
  373.     void **p = ptr;
           ^
  374.     if (min_size < *size)
  375.         return;

libavutil/mem.c:374:9: Taking true branch
  372. {
  373.     void **p = ptr;
  374.     if (min_size < *size)
               ^
  375.         return;
  376.     min_size = FFMAX(17 * min_size / 16 + 32, min_size);

libavutil/mem.c:375:9: 
  373.     void **p = ptr;
  374.     if (min_size < *size)
  375.         return;
               ^
  376.     min_size = FFMAX(17 * min_size / 16 + 32, min_size);
  377.     av_free(*p);

libavutil/mem.c:382:1: return from a call to av_fast_malloc
  380.         min_size = 0;
  381.     *size = min_size;
  382. }
       ^

libavcodec/svq3.c:1040:14: Taking false branch
1038. 
1039.         av_fast_malloc(&s->slice_buf, &s->slice_size, slice_bytes + AV_INPUT_BUFFER_PADDING_SIZE);
1040.         if (!s->slice_buf)
                   ^
1041.             return AVERROR(ENOMEM);
1042. 

libavcodec/svq3.c:1043:9: 
1041.             return AVERROR(ENOMEM);
1042. 
1043.         memcpy(s->slice_buf, s->gb.buffer + s->gb.index / 8, slice_bytes);
              ^
1044. 
1045.         init_get_bits(&s->gb_slice, s->slice_buf, slice_bits);

libavcodec/svq3.c:1045:9: 
1043.         memcpy(s->slice_buf, s->gb.buffer + s->gb.index / 8, slice_bytes);
1044. 
1045.         init_get_bits(&s->gb_slice, s->slice_buf, slice_bits);
              ^
1046. 
1047.         if (s->watermark_key) {

libavcodec/get_bits.h:362:1: start of procedure init_get_bits()
  360.  * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
  361.  */
  362. static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
       ^
  363.                                 int bit_size)
  364. {

libavcodec/get_bits.h:366:5: 
  364. {
  365.     int buffer_size;
  366.     int ret = 0;
           ^
  367. 
  368.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {

libavcodec/get_bits.h:368:9: Taking true branch
  366.     int ret = 0;
  367. 
  368.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
               ^
  369.         bit_size    = 0;
  370.         buffer      = NULL;

libavcodec/get_bits.h:369:9: 
  367. 
  368.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
  369.         bit_size    = 0;
               ^
  370.         buffer      = NULL;
  371.         ret         = AVERROR_INVALIDDATA;

libavcodec/get_bits.h:370:9: 
  368.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
  369.         bit_size    = 0;
  370.         buffer      = NULL;
               ^
  371.         ret         = AVERROR_INVALIDDATA;
  372.     }

libavcodec/get_bits.h:371:9: 
  369.         bit_size    = 0;
  370.         buffer      = NULL;
  371.         ret         = AVERROR_INVALIDDATA;
               ^
  372.     }
  373. 

libavcodec/get_bits.h:374:5: 
  372.     }
  373. 
  374.     buffer_size = (bit_size + 7) >> 3;
           ^
  375. 
  376.     s->buffer             = buffer;

libavcodec/get_bits.h:376:5: 
  374.     buffer_size = (bit_size + 7) >> 3;
  375. 
  376.     s->buffer             = buffer;
           ^
  377.     s->size_in_bits       = bit_size;
  378. #if !UNCHECKED_BITSTREAM_READER

libavcodec/get_bits.h:377:5: 
  375. 
  376.     s->buffer             = buffer;
  377.     s->size_in_bits       = bit_size;
           ^
  378. #if !UNCHECKED_BITSTREAM_READER
  379.     s->size_in_bits_plus8 = bit_size + 8;

libavcodec/get_bits.h:379:5: 
  377.     s->size_in_bits       = bit_size;
  378. #if !UNCHECKED_BITSTREAM_READER
  379.     s->size_in_bits_plus8 = bit_size + 8;
           ^
  380. #endif
  381.     s->buffer_end         = buffer + buffer_size;

libavcodec/get_bits.h:381:5: 
  379.     s->size_in_bits_plus8 = bit_size + 8;
  380. #endif
  381.     s->buffer_end         = buffer + buffer_size;
           ^
  382.     s->index              = 0;
  383. 

libavcodec/get_bits.h:382:5: 
  380. #endif
  381.     s->buffer_end         = buffer + buffer_size;
  382.     s->index              = 0;
           ^
  383. 
  384.     return ret;

libavcodec/get_bits.h:384:5: 
  382.     s->index              = 0;
  383. 
  384.     return ret;
           ^
  385. }
  386. 

libavcodec/get_bits.h:385:1: return from a call to init_get_bits
  383. 
  384.     return ret;
  385. }
       ^
  386. 
  387. /**

libavcodec/svq3.c:1047:13: Taking true branch
1045.         init_get_bits(&s->gb_slice, s->slice_buf, slice_bits);
1046. 
1047.         if (s->watermark_key) {
                  ^
1048.             uint32_t header = AV_RL32(&s->gb_slice.buffer[1]);
1049.             AV_WL32(&s->gb_slice.buffer[1], header ^ s->watermark_key);

libavcodec/svq3.c:1048:13: 
1046. 
1047.         if (s->watermark_key) {
1048.             uint32_t header = AV_RL32(&s->gb_slice.buffer[1]);
                  ^
1049.             AV_WL32(&s->gb_slice.buffer[1], header ^ s->watermark_key);
1050.         }

static int svq3_decode_slice_header(AVCodecContext *avctx)
{
    SVQ3Context *s = avctx->priv_data;
    const int mb_xy   = s->mb_xy;
    int i, header;
    unsigned slice_id;
    header = get_bits(&s->gb, 8);
    if (((header & 0x9F) != 1 && (header & 0x9F) != 2) || (header & 0x60) == 0) {
        av_log(avctx, AV_LOG_ERROR, "unsupported slice header (%02X)\n", header);
        return -1;
    } else {
        int slice_bits, slice_bytes, slice_length;
        int length = header >> 5 & 3;
        slice_length = show_bits(&s->gb, 8 * length);
        slice_bits   = slice_length * 8;
        slice_bytes  = slice_length + length - 1;
        if (slice_bytes > get_bits_left(&s->gb)) {
            av_log(avctx, AV_LOG_ERROR, "slice after bitstream end\n");
            return -1;
        }
        skip_bits(&s->gb, 8);
        av_fast_malloc(&s->slice_buf, &s->slice_size, slice_bytes + AV_INPUT_BUFFER_PADDING_SIZE);
        if (!s->slice_buf)
            return AVERROR(ENOMEM);
        memcpy(s->slice_buf, s->gb.buffer + s->gb.index / 8, slice_bytes);
        init_get_bits(&s->gb_slice, s->slice_buf, slice_bits);
        if (s->watermark_key) {
            uint32_t header = AV_RL32(&s->gb_slice.buffer[1]);
            AV_WL32(&s->gb_slice.buffer[1], header ^ s->watermark_key);
        }
        if (length > 0) {
            memcpy(s->slice_buf, &s->slice_buf[slice_length], length - 1);
        }
        skip_bits_long(&s->gb, slice_bytes * 8);
    }
    if ((slice_id = get_interleaved_ue_golomb(&s->gb_slice)) >= 3) {
        av_log(s->avctx, AV_LOG_ERROR, "illegal slice type %u \n", slice_id);
        return -1;
    }
    s->pict_type = ff_h264_golomb_to_pict_type[slice_id];
    if ((header & 0x9F) == 2) {
        i = (s->mb_num < 64) ? 6 : (1 + av_log2(s->mb_num - 1));
        get_bits(&s->gb_slice, i);
    } else {
        skip_bits1(&s->gb_slice);
    }
    s->slice_num      = get_bits(&s->gb_slice, 8);
    s->qscale         = get_bits(&s->gb_slice, 5);
    s->adaptive_quant = get_bits1(&s->gb_slice);
    skip_bits1(&s->gb_slice);
    if (s->unknown_flag)
        skip_bits1(&s->gb_slice);
    skip_bits1(&s->gb_slice);
    skip_bits(&s->gb_slice, 2);
    while (get_bits1(&s->gb_slice))
        skip_bits(&s->gb_slice, 8);
    if (s->mb_x > 0) {
        memset(s->intra4x4_pred_mode + s->mb2br_xy[mb_xy - 1] + 3,
               -1, 4 * sizeof(int8_t));
        memset(s->intra4x4_pred_mode + s->mb2br_xy[mb_xy - s->mb_x],
               -1, 8 * sizeof(int8_t) * s->mb_x);
    }
    if (s->mb_y > 0) {
        memset(s->intra4x4_pred_mode + s->mb2br_xy[mb_xy - s->mb_stride],
               -1, 8 * sizeof(int8_t) * (s->mb_width - s->mb_x));
        if (s->mb_x > 0)
            s->intra4x4_pred_mode[s->mb2br_xy[mb_xy - s->mb_stride - 1] + 3] = -1;
    }
    return 0;
}
['static int svq3_decode_slice_header(AVCodecContext *avctx)\n{\n    SVQ3Context *s = avctx->priv_data;\n    const int mb_xy   = s->mb_xy;\n    int i, header;\n    unsigned slice_id;\n    header = get_bits(&s->gb, 8);\n    if (((header & 0x9F) != 1 && (header & 0x9F) != 2) || (header & 0x60) == 0) {\n        av_log(avctx, AV_LOG_ERROR, "unsupported slice header (%02X)\\n", header);\n        return -1;\n    } else {\n        int slice_bits, slice_bytes, slice_length;\n        int length = header >> 5 & 3;\n        slice_length = show_bits(&s->gb, 8 * length);\n        slice_bits   = slice_length * 8;\n        slice_bytes  = slice_length + length - 1;\n        if (slice_bytes > get_bits_left(&s->gb)) {\n            av_log(avctx, AV_LOG_ERROR, "slice after bitstream end\\n");\n            return -1;\n        }\n        skip_bits(&s->gb, 8);\n        av_fast_malloc(&s->slice_buf, &s->slice_size, slice_bytes + AV_INPUT_BUFFER_PADDING_SIZE);\n        if (!s->slice_buf)\n            return AVERROR(ENOMEM);\n        memcpy(s->slice_buf, s->gb.buffer + s->gb.index / 8, slice_bytes);\n        init_get_bits(&s->gb_slice, s->slice_buf, slice_bits);\n        if (s->watermark_key) {\n            uint32_t header = AV_RL32(&s->gb_slice.buffer[1]);\n            AV_WL32(&s->gb_slice.buffer[1], header ^ s->watermark_key);\n        }\n        if (length > 0) {\n            memcpy(s->slice_buf, &s->slice_buf[slice_length], length - 1);\n        }\n        skip_bits_long(&s->gb, slice_bytes * 8);\n    }\n    if ((slice_id = get_interleaved_ue_golomb(&s->gb_slice)) >= 3) {\n        av_log(s->avctx, AV_LOG_ERROR, "illegal slice type %u \\n", slice_id);\n        return -1;\n    }\n    s->pict_type = ff_h264_golomb_to_pict_type[slice_id];\n    if ((header & 0x9F) == 2) {\n        i = (s->mb_num < 64) ? 6 : (1 + av_log2(s->mb_num - 1));\n        get_bits(&s->gb_slice, i);\n    } else {\n        skip_bits1(&s->gb_slice);\n    }\n    s->slice_num      = get_bits(&s->gb_slice, 8);\n    s->qscale         = get_bits(&s->gb_slice, 5);\n    s->adaptive_quant = get_bits1(&s->gb_slice);\n    skip_bits1(&s->gb_slice);\n    if (s->unknown_flag)\n        skip_bits1(&s->gb_slice);\n    skip_bits1(&s->gb_slice);\n    skip_bits(&s->gb_slice, 2);\n    while (get_bits1(&s->gb_slice))\n        skip_bits(&s->gb_slice, 8);\n    if (s->mb_x > 0) {\n        memset(s->intra4x4_pred_mode + s->mb2br_xy[mb_xy - 1] + 3,\n               -1, 4 * sizeof(int8_t));\n        memset(s->intra4x4_pred_mode + s->mb2br_xy[mb_xy - s->mb_x],\n               -1, 8 * sizeof(int8_t) * s->mb_x);\n    }\n    if (s->mb_y > 0) {\n        memset(s->intra4x4_pred_mode + s->mb2br_xy[mb_xy - s->mb_stride],\n               -1, 8 * sizeof(int8_t) * (s->mb_width - s->mb_x));\n        if (s->mb_x > 0)\n            s->intra4x4_pred_mode[s->mb2br_xy[mb_xy - s->mb_stride - 1] + 3] = -1;\n    }\n    return 0;\n}', 'static inline int get_bits_left(GetBitContext *gb)\n{\n    return gb->size_in_bits - get_bits_count(gb);\n}', 'static inline int get_bits_count(const GetBitContext *s)\n{\n    return s->index;\n}', 'void av_fast_malloc(void *ptr, unsigned int *size, size_t min_size)\n{\n    void **p = ptr;\n    if (min_size < *size)\n        return;\n    min_size = FFMAX(17 * min_size / 16 + 32, min_size);\n    av_free(*p);\n    *p = av_malloc(min_size);\n    if (!*p)\n        min_size = 0;\n    *size = min_size;\n}', 'static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,\n                                int bit_size)\n{\n    int buffer_size;\n    int ret = 0;\n    if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {\n        bit_size    = 0;\n        buffer      = NULL;\n        ret         = AVERROR_INVALIDDATA;\n    }\n    buffer_size = (bit_size + 7) >> 3;\n    s->buffer             = buffer;\n    s->size_in_bits       = bit_size;\n#if !UNCHECKED_BITSTREAM_READER\n    s->size_in_bits_plus8 = bit_size + 8;\n#endif\n    s->buffer_end         = buffer + buffer_size;\n    s->index              = 0;\n    return ret;\n}']