libavformat/mpegtsenc.c:492: error: Null Dereference
  pointer `pcr_st` last assigned on line 388 could be null and is dereferenced at line 492, column 13.

libavformat/mpegtsenc.c:383:1: start of procedure mpegts_write_header()
381. }
382. 
383. static int mpegts_write_header(AVFormatContext *s)
     ^
384. {
385.     MpegTSWrite *ts = s->priv_data;

libavformat/mpegtsenc.c:385:5: 
383. static int mpegts_write_header(AVFormatContext *s)
384. {
385.     MpegTSWrite *ts = s->priv_data;
         ^
386.     MpegTSWriteStream *ts_st;
387.     MpegTSService *service;

libavformat/mpegtsenc.c:388:5: 
386.     MpegTSWriteStream *ts_st;
387.     MpegTSService *service;
388.     AVStream *st, *pcr_st = NULL;
         ^
389.     AVMetadataTag *title;
390.     int i, j;

libavformat/mpegtsenc.c:394:5: 
392.     int *pids;
393. 
394.     ts->tsid = DEFAULT_TSID;
         ^
395.     ts->onid = DEFAULT_ONID;
396.     /* allocate a single DVB service */

libavformat/mpegtsenc.c:395:5: 
393. 
394.     ts->tsid = DEFAULT_TSID;
395.     ts->onid = DEFAULT_ONID;
         ^
396.     /* allocate a single DVB service */
397.     title = av_metadata_get(s->metadata, "title", NULL, 0);

libavformat/mpegtsenc.c:397:5: Skipping av_metadata_get(): empty list of specs
395.     ts->onid = DEFAULT_ONID;
396.     /* allocate a single DVB service */
397.     title = av_metadata_get(s->metadata, "title", NULL, 0);
         ^
398.     service_name = title ? title->value : DEFAULT_SERVICE_NAME;
399.     service = mpegts_add_service(ts, DEFAULT_SID,

libavformat/mpegtsenc.c:398:20: Condition is false
396.     /* allocate a single DVB service */
397.     title = av_metadata_get(s->metadata, "title", NULL, 0);
398.     service_name = title ? title->value : DEFAULT_SERVICE_NAME;
                        ^
399.     service = mpegts_add_service(ts, DEFAULT_SID,
400.                                  DEFAULT_PROVIDER_NAME, service_name);

libavformat/mpegtsenc.c:398:5: 
396.     /* allocate a single DVB service */
397.     title = av_metadata_get(s->metadata, "title", NULL, 0);
398.     service_name = title ? title->value : DEFAULT_SERVICE_NAME;
         ^
399.     service = mpegts_add_service(ts, DEFAULT_SID,
400.                                  DEFAULT_PROVIDER_NAME, service_name);

libavformat/mpegtsenc.c:399:5: Skipping mpegts_add_service(): empty list of specs
397.     title = av_metadata_get(s->metadata, "title", NULL, 0);
398.     service_name = title ? title->value : DEFAULT_SERVICE_NAME;
399.     service = mpegts_add_service(ts, DEFAULT_SID,
         ^
400.                                  DEFAULT_PROVIDER_NAME, service_name);
401.     service->pmt.write_packet = section_write_packet;

libavformat/mpegtsenc.c:401:5: 
399.     service = mpegts_add_service(ts, DEFAULT_SID,
400.                                  DEFAULT_PROVIDER_NAME, service_name);
401.     service->pmt.write_packet = section_write_packet;
         ^
402.     service->pmt.opaque = s;
403.     service->pmt.cc = 15;

libavformat/mpegtsenc.c:402:5: 
400.                                  DEFAULT_PROVIDER_NAME, service_name);
401.     service->pmt.write_packet = section_write_packet;
402.     service->pmt.opaque = s;
         ^
403.     service->pmt.cc = 15;
404. 

libavformat/mpegtsenc.c:403:5: 
401.     service->pmt.write_packet = section_write_packet;
402.     service->pmt.opaque = s;
403.     service->pmt.cc = 15;
         ^
404. 
405.     ts->pat.pid = PAT_PID;

libavformat/mpegtsenc.c:405:5: 
403.     service->pmt.cc = 15;
404. 
405.     ts->pat.pid = PAT_PID;
         ^
406.     ts->pat.cc = 15; // Initialize at 15 so that it wraps and be equal to 0 for the first packet we write
407.     ts->pat.write_packet = section_write_packet;

libavformat/mpegtsenc.c:406:5: 
404. 
405.     ts->pat.pid = PAT_PID;
406.     ts->pat.cc = 15; // Initialize at 15 so that it wraps and be equal to 0 for the first packet we write
         ^
407.     ts->pat.write_packet = section_write_packet;
408.     ts->pat.opaque = s;

libavformat/mpegtsenc.c:407:5: 
405.     ts->pat.pid = PAT_PID;
406.     ts->pat.cc = 15; // Initialize at 15 so that it wraps and be equal to 0 for the first packet we write
407.     ts->pat.write_packet = section_write_packet;
         ^
408.     ts->pat.opaque = s;
409. 

libavformat/mpegtsenc.c:408:5: 
406.     ts->pat.cc = 15; // Initialize at 15 so that it wraps and be equal to 0 for the first packet we write
407.     ts->pat.write_packet = section_write_packet;
408.     ts->pat.opaque = s;
         ^
409. 
410.     ts->sdt.pid = SDT_PID;

libavformat/mpegtsenc.c:410:5: 
408.     ts->pat.opaque = s;
409. 
410.     ts->sdt.pid = SDT_PID;
         ^
411.     ts->sdt.cc = 15;
412.     ts->sdt.write_packet = section_write_packet;

libavformat/mpegtsenc.c:411:5: 
409. 
410.     ts->sdt.pid = SDT_PID;
411.     ts->sdt.cc = 15;
         ^
412.     ts->sdt.write_packet = section_write_packet;
413.     ts->sdt.opaque = s;

libavformat/mpegtsenc.c:412:5: 
410.     ts->sdt.pid = SDT_PID;
411.     ts->sdt.cc = 15;
412.     ts->sdt.write_packet = section_write_packet;
         ^
413.     ts->sdt.opaque = s;
414. 

libavformat/mpegtsenc.c:413:5: 
411.     ts->sdt.cc = 15;
412.     ts->sdt.write_packet = section_write_packet;
413.     ts->sdt.opaque = s;
         ^
414. 
415.     pids = av_malloc(s->nb_streams * sizeof(*pids));

libavformat/mpegtsenc.c:415:5: 
413.     ts->sdt.opaque = s;
414. 
415.     pids = av_malloc(s->nb_streams * sizeof(*pids));
         ^
416.     if (!pids)
417.         return AVERROR(ENOMEM);

libavutil/mem.c:64:1: start of procedure av_malloc()
  62.    linker will do it automatically. */
  63. 
  64. void *av_malloc(unsigned int size)
      ^
  65. {
  66.     void *ptr = NULL;

libavutil/mem.c:66:5: 
  64. void *av_malloc(unsigned int size)
  65. {
  66.     void *ptr = NULL;
          ^
  67. #if CONFIG_MEMALIGN_HACK
  68.     long diff;

libavutil/mem.c:72:8: Taking false branch
  70. 
  71.     /* let's disallow possible ambiguous cases */
  72.     if(size > (INT_MAX-16) )
             ^
  73.         return NULL;
  74. 

libavutil/mem.c:83:9: Taking false branch
  81.     ((char*)ptr)[-1]= diff;
  82. #elif HAVE_POSIX_MEMALIGN
  83.     if (posix_memalign(&ptr,16,size))
              ^
  84.         ptr = NULL;
  85. #elif HAVE_MEMALIGN

libavutil/mem.c:116:5: 
  114.     ptr = malloc(size);
  115. #endif
  116.     return ptr;
           ^
  117. }
  118. 

libavutil/mem.c:117:1: return from a call to av_malloc
  115. #endif
  116.     return ptr;
  117. }
       ^
  118. 
  119. void *av_realloc(void *ptr, unsigned int size)

libavformat/mpegtsenc.c:416:10: Taking false branch
414. 
415.     pids = av_malloc(s->nb_streams * sizeof(*pids));
416.     if (!pids)
              ^
417.         return AVERROR(ENOMEM);
418. 

libavformat/mpegtsenc.c:420:9: 
418. 
419.     /* assign pids to each stream */
420.     for(i = 0;i < s->nb_streams; i++) {
             ^
421.         st = s->streams[i];
422.         ts_st = av_mallocz(sizeof(MpegTSWriteStream));

libavformat/mpegtsenc.c:420:15: Loop condition is false. Leaving loop
418. 
419.     /* assign pids to each stream */
420.     for(i = 0;i < s->nb_streams; i++) {
                   ^
421.         st = s->streams[i];
422.         ts_st = av_mallocz(sizeof(MpegTSWriteStream));

libavformat/mpegtsenc.c:468:5: 
466.     }
467. 
468.     av_free(pids);
         ^
469. 
470.     /* if no video stream, use the first stream as PCR */

libavutil/mem.c:139:1: start of procedure av_free()
  137. }
  138. 
  139. void av_free(void *ptr)
       ^
  140. {
  141.     /* XXX: this test should not be needed on most libcs */

libavutil/mem.c:142:9: Taking true branch
  140. {
  141.     /* XXX: this test should not be needed on most libcs */
  142.     if (ptr)
               ^
  143. #if CONFIG_MEMALIGN_HACK
  144.         free((char*)ptr - ((char*)ptr)[-1]);

libavutil/mem.c:146:9: 
  144.         free((char*)ptr - ((char*)ptr)[-1]);
  145. #else
  146.         free(ptr);
               ^
  147. #endif
  148. }

libavutil/mem.c:142:5: 
  140. {
  141.     /* XXX: this test should not be needed on most libcs */
  142.     if (ptr)
           ^
  143. #if CONFIG_MEMALIGN_HACK
  144.         free((char*)ptr - ((char*)ptr)[-1]);

libavutil/mem.c:148:1: return from a call to av_free
  146.         free(ptr);
  147. #endif
  148. }
       ^
  149. 
  150. void av_freep(void *arg)

libavformat/mpegtsenc.c:471:9: Taking false branch
469. 
470.     /* if no video stream, use the first stream as PCR */
471.     if (service->pcr_pid == 0x1fff && s->nb_streams > 0) {
             ^
472.         pcr_st = s->streams[0];
473.         ts_st = pcr_st->priv_data;

libavformat/mpegtsenc.c:477:20: Condition is true
475.     }
476. 
477.     ts->mux_rate = s->mux_rate ? s->mux_rate : 1;
                        ^
478. 
479.     if (ts->mux_rate > 1) {

libavformat/mpegtsenc.c:477:5: 
475.     }
476. 
477.     ts->mux_rate = s->mux_rate ? s->mux_rate : 1;
         ^
478. 
479.     if (ts->mux_rate > 1) {

libavformat/mpegtsenc.c:479:9: Taking false branch
477.     ts->mux_rate = s->mux_rate ? s->mux_rate : 1;
478. 
479.     if (ts->mux_rate > 1) {
             ^
480.         service->pcr_packet_period = (ts->mux_rate * PCR_RETRANS_TIME) /
481.             (TS_PACKET_SIZE * 8 * 1000);

libavformat/mpegtsenc.c:490:9: 
488.     } else {
489.         /* Arbitrary values, PAT/PMT could be written on key frames */
490.         ts->sdt_packet_period = 200;
             ^
491.         ts->pat_packet_period = 40;
492.         if (pcr_st->codec->codec_type == AVMEDIA_TYPE_AUDIO) {

libavformat/mpegtsenc.c:491:9: 
489.         /* Arbitrary values, PAT/PMT could be written on key frames */
490.         ts->sdt_packet_period = 200;
491.         ts->pat_packet_period = 40;
             ^
492.         if (pcr_st->codec->codec_type == AVMEDIA_TYPE_AUDIO) {
493.             if (!pcr_st->codec->frame_size) {

libavformat/mpegtsenc.c:492:13: 
490.         ts->sdt_packet_period = 200;
491.         ts->pat_packet_period = 40;
492.         if (pcr_st->codec->codec_type == AVMEDIA_TYPE_AUDIO) {
                 ^
493.             if (!pcr_st->codec->frame_size) {
494.                 av_log(s, AV_LOG_WARNING, "frame size not set\n");

static int mpegts_write_header(AVFormatContext *s)
{
    MpegTSWrite *ts = s->priv_data;
    MpegTSWriteStream *ts_st;
    MpegTSService *service;
    AVStream *st, *pcr_st = NULL;
    AVMetadataTag *title;
    int i, j;
    const char *service_name;
    int *pids;
    ts->tsid = DEFAULT_TSID;
    ts->onid = DEFAULT_ONID;
    title = av_metadata_get(s->metadata, "title", NULL, 0);
    service_name = title ? title->value : DEFAULT_SERVICE_NAME;
    service = mpegts_add_service(ts, DEFAULT_SID,
                                 DEFAULT_PROVIDER_NAME, service_name);
    service->pmt.write_packet = section_write_packet;
    service->pmt.opaque = s;
    service->pmt.cc = 15;
    ts->pat.pid = PAT_PID;
    ts->pat.cc = 15;
    ts->pat.write_packet = section_write_packet;
    ts->pat.opaque = s;
    ts->sdt.pid = SDT_PID;
    ts->sdt.cc = 15;
    ts->sdt.write_packet = section_write_packet;
    ts->sdt.opaque = s;
    pids = av_malloc(s->nb_streams * sizeof(*pids));
    if (!pids)
        return AVERROR(ENOMEM);
    for(i = 0;i < s->nb_streams; i++) {
        st = s->streams[i];
        ts_st = av_mallocz(sizeof(MpegTSWriteStream));
        if (!ts_st)
            goto fail;
        st->priv_data = ts_st;
        ts_st->service = service;
        if (st->id < 16) {
            ts_st->pid = DEFAULT_START_PID + i;
        } else if (st->id < 0x1FFF) {
            ts_st->pid = st->id;
        } else {
            av_log(s, AV_LOG_ERROR, "Invalid stream id %d, must be less than 8191\n", st->id);
            goto fail;
        }
        if (ts_st->pid == service->pmt.pid) {
            av_log(s, AV_LOG_ERROR, "Duplicate stream id %d\n", ts_st->pid);
            goto fail;
        }
        for (j = 0; j < i; j++)
            if (pids[j] == ts_st->pid) {
                av_log(s, AV_LOG_ERROR, "Duplicate stream id %d\n", ts_st->pid);
                goto fail;
            }
        pids[i] = ts_st->pid;
        ts_st->payload_pts = AV_NOPTS_VALUE;
        ts_st->payload_dts = AV_NOPTS_VALUE;
        ts_st->first_pts_check = 1;
        ts_st->cc = 15;
        if (st->codec->codec_type == AVMEDIA_TYPE_VIDEO &&
            service->pcr_pid == 0x1fff) {
            service->pcr_pid = ts_st->pid;
            pcr_st = st;
        }
        if (st->codec->codec_id == CODEC_ID_AAC &&
            st->codec->extradata_size > 0) {
            ts_st->adts = av_mallocz(sizeof(*ts_st->adts));
            if (!ts_st->adts)
                return AVERROR(ENOMEM);
            if (ff_adts_decode_extradata(s, ts_st->adts, st->codec->extradata,
                                         st->codec->extradata_size) < 0)
                return -1;
        }
    }
    av_free(pids);
    if (service->pcr_pid == 0x1fff && s->nb_streams > 0) {
        pcr_st = s->streams[0];
        ts_st = pcr_st->priv_data;
        service->pcr_pid = ts_st->pid;
    }
    ts->mux_rate = s->mux_rate ? s->mux_rate : 1;
    if (ts->mux_rate > 1) {
        service->pcr_packet_period = (ts->mux_rate * PCR_RETRANS_TIME) /
            (TS_PACKET_SIZE * 8 * 1000);
        ts->sdt_packet_period      = (ts->mux_rate * SDT_RETRANS_TIME) /
            (TS_PACKET_SIZE * 8 * 1000);
        ts->pat_packet_period      = (ts->mux_rate * PAT_RETRANS_TIME) /
            (TS_PACKET_SIZE * 8 * 1000);
        ts->cur_pcr = av_rescale(s->max_delay, 90000, AV_TIME_BASE);
    } else {
        ts->sdt_packet_period = 200;
        ts->pat_packet_period = 40;
        if (pcr_st->codec->codec_type == AVMEDIA_TYPE_AUDIO) {
            if (!pcr_st->codec->frame_size) {
                av_log(s, AV_LOG_WARNING, "frame size not set\n");
                service->pcr_packet_period =
                    pcr_st->codec->sample_rate/(10*512);
            } else {
                service->pcr_packet_period =
                    pcr_st->codec->sample_rate/(10*pcr_st->codec->frame_size);
            }
        } else {
            service->pcr_packet_period =
                pcr_st->codec->time_base.den/(10*pcr_st->codec->time_base.num);
        }
    }
    service->pcr_packet_count = service->pcr_packet_period;
    ts->pat_packet_count = ts->pat_packet_period-1;
    ts->sdt_packet_count = ts->sdt_packet_period-1;
    av_log(s, AV_LOG_INFO,
           "muxrate %d bps, pcr every %d pkts, "
           "sdt every %d, pat/pmt every %d pkts\n",
           ts->mux_rate, service->pcr_packet_period,
           ts->sdt_packet_period, ts->pat_packet_period);
    put_flush_packet(s->pb);
    return 0;
 fail:
    av_free(pids);
    for(i = 0;i < s->nb_streams; i++) {
        st = s->streams[i];
        av_free(st->priv_data);
    }
    return -1;
}
['static int mpegts_write_header(AVFormatContext *s)\n{\n    MpegTSWrite *ts = s->priv_data;\n    MpegTSWriteStream *ts_st;\n    MpegTSService *service;\n    AVStream *st, *pcr_st = NULL;\n    AVMetadataTag *title;\n    int i, j;\n    const char *service_name;\n    int *pids;\n    ts->tsid = DEFAULT_TSID;\n    ts->onid = DEFAULT_ONID;\n    title = av_metadata_get(s->metadata, "title", NULL, 0);\n    service_name = title ? title->value : DEFAULT_SERVICE_NAME;\n    service = mpegts_add_service(ts, DEFAULT_SID,\n                                 DEFAULT_PROVIDER_NAME, service_name);\n    service->pmt.write_packet = section_write_packet;\n    service->pmt.opaque = s;\n    service->pmt.cc = 15;\n    ts->pat.pid = PAT_PID;\n    ts->pat.cc = 15;\n    ts->pat.write_packet = section_write_packet;\n    ts->pat.opaque = s;\n    ts->sdt.pid = SDT_PID;\n    ts->sdt.cc = 15;\n    ts->sdt.write_packet = section_write_packet;\n    ts->sdt.opaque = s;\n    pids = av_malloc(s->nb_streams * sizeof(*pids));\n    if (!pids)\n        return AVERROR(ENOMEM);\n    for(i = 0;i < s->nb_streams; i++) {\n        st = s->streams[i];\n        ts_st = av_mallocz(sizeof(MpegTSWriteStream));\n        if (!ts_st)\n            goto fail;\n        st->priv_data = ts_st;\n        ts_st->service = service;\n        if (st->id < 16) {\n            ts_st->pid = DEFAULT_START_PID + i;\n        } else if (st->id < 0x1FFF) {\n            ts_st->pid = st->id;\n        } else {\n            av_log(s, AV_LOG_ERROR, "Invalid stream id %d, must be less than 8191\\n", st->id);\n            goto fail;\n        }\n        if (ts_st->pid == service->pmt.pid) {\n            av_log(s, AV_LOG_ERROR, "Duplicate stream id %d\\n", ts_st->pid);\n            goto fail;\n        }\n        for (j = 0; j < i; j++)\n            if (pids[j] == ts_st->pid) {\n                av_log(s, AV_LOG_ERROR, "Duplicate stream id %d\\n", ts_st->pid);\n                goto fail;\n            }\n        pids[i] = ts_st->pid;\n        ts_st->payload_pts = AV_NOPTS_VALUE;\n        ts_st->payload_dts = AV_NOPTS_VALUE;\n        ts_st->first_pts_check = 1;\n        ts_st->cc = 15;\n        if (st->codec->codec_type == AVMEDIA_TYPE_VIDEO &&\n            service->pcr_pid == 0x1fff) {\n            service->pcr_pid = ts_st->pid;\n            pcr_st = st;\n        }\n        if (st->codec->codec_id == CODEC_ID_AAC &&\n            st->codec->extradata_size > 0) {\n            ts_st->adts = av_mallocz(sizeof(*ts_st->adts));\n            if (!ts_st->adts)\n                return AVERROR(ENOMEM);\n            if (ff_adts_decode_extradata(s, ts_st->adts, st->codec->extradata,\n                                         st->codec->extradata_size) < 0)\n                return -1;\n        }\n    }\n    av_free(pids);\n    if (service->pcr_pid == 0x1fff && s->nb_streams > 0) {\n        pcr_st = s->streams[0];\n        ts_st = pcr_st->priv_data;\n        service->pcr_pid = ts_st->pid;\n    }\n    ts->mux_rate = s->mux_rate ? s->mux_rate : 1;\n    if (ts->mux_rate > 1) {\n        service->pcr_packet_period = (ts->mux_rate * PCR_RETRANS_TIME) /\n            (TS_PACKET_SIZE * 8 * 1000);\n        ts->sdt_packet_period      = (ts->mux_rate * SDT_RETRANS_TIME) /\n            (TS_PACKET_SIZE * 8 * 1000);\n        ts->pat_packet_period      = (ts->mux_rate * PAT_RETRANS_TIME) /\n            (TS_PACKET_SIZE * 8 * 1000);\n        ts->cur_pcr = av_rescale(s->max_delay, 90000, AV_TIME_BASE);\n    } else {\n        ts->sdt_packet_period = 200;\n        ts->pat_packet_period = 40;\n        if (pcr_st->codec->codec_type == AVMEDIA_TYPE_AUDIO) {\n            if (!pcr_st->codec->frame_size) {\n                av_log(s, AV_LOG_WARNING, "frame size not set\\n");\n                service->pcr_packet_period =\n                    pcr_st->codec->sample_rate/(10*512);\n            } else {\n                service->pcr_packet_period =\n                    pcr_st->codec->sample_rate/(10*pcr_st->codec->frame_size);\n            }\n        } else {\n            service->pcr_packet_period =\n                pcr_st->codec->time_base.den/(10*pcr_st->codec->time_base.num);\n        }\n    }\n    service->pcr_packet_count = service->pcr_packet_period;\n    ts->pat_packet_count = ts->pat_packet_period-1;\n    ts->sdt_packet_count = ts->sdt_packet_period-1;\n    av_log(s, AV_LOG_INFO,\n           "muxrate %d bps, pcr every %d pkts, "\n           "sdt every %d, pat/pmt every %d pkts\\n",\n           ts->mux_rate, service->pcr_packet_period,\n           ts->sdt_packet_period, ts->pat_packet_period);\n    put_flush_packet(s->pb);\n    return 0;\n fail:\n    av_free(pids);\n    for(i = 0;i < s->nb_streams; i++) {\n        st = s->streams[i];\n        av_free(st->priv_data);\n    }\n    return -1;\n}', 'void *av_malloc(unsigned int size)\n{\n    void *ptr = NULL;\n#if CONFIG_MEMALIGN_HACK\n    long diff;\n#endif\n    if(size > (INT_MAX-16) )\n        return NULL;\n#if CONFIG_MEMALIGN_HACK\n    ptr = malloc(size+16);\n    if(!ptr)\n        return ptr;\n    diff= ((-(long)ptr - 1)&15) + 1;\n    ptr = (char*)ptr + diff;\n    ((char*)ptr)[-1]= diff;\n#elif HAVE_POSIX_MEMALIGN\n    if (posix_memalign(&ptr,16,size))\n        ptr = NULL;\n#elif HAVE_MEMALIGN\n    ptr = memalign(16,size);\n#else\n    ptr = malloc(size);\n#endif\n    return ptr;\n}', 'void av_free(void *ptr)\n{\n    if (ptr)\n#if CONFIG_MEMALIGN_HACK\n        free((char*)ptr - ((char*)ptr)[-1]);\n#else\n        free(ptr);\n#endif\n}']