libavcodec/vp3.c:1922: error: Null Dereference
  pointer `&gb->buffer` last assigned on line 1920 could be null and is dereferenced by call to `get_bits1()` at line 1922, column 22.

libavcodec/vp3.c:1910:1: start of procedure vp3_decode_frame()
1908. }
1909. 
1910. static int vp3_decode_frame(AVCodecContext *avctx,
      ^
1911.                             void *data, int *data_size,
1912.                             AVPacket *avpkt)

libavcodec/vp3.c:1914:5: 
1912.                             AVPacket *avpkt)
1913. {
1914.     const uint8_t *buf = avpkt->data;
          ^
1915.     int buf_size = avpkt->size;
1916.     Vp3DecodeContext *s = avctx->priv_data;

libavcodec/vp3.c:1915:5: 
1913. {
1914.     const uint8_t *buf = avpkt->data;
1915.     int buf_size = avpkt->size;
          ^
1916.     Vp3DecodeContext *s = avctx->priv_data;
1917.     GetBitContext gb;

libavcodec/vp3.c:1916:5: 
1914.     const uint8_t *buf = avpkt->data;
1915.     int buf_size = avpkt->size;
1916.     Vp3DecodeContext *s = avctx->priv_data;
          ^
1917.     GetBitContext gb;
1918.     int i;

libavcodec/vp3.c:1920:5: 
1918.     int i;
1919. 
1920.     init_get_bits(&gb, buf, buf_size * 8);
          ^
1921. 
1922.     if (s->theora && get_bits1(&gb))

libavcodec/get_bits.h:339:1: start of procedure init_get_bits()
  337.  * @param bit_size the size of the buffer in bits
  338.  */
  339. static inline void init_get_bits(GetBitContext *s, const uint8_t *buffer,
       ^
  340.                                  int bit_size)
  341. {

libavcodec/get_bits.h:342:5: 
  340.                                  int bit_size)
  341. {
  342.     int buffer_size = (bit_size+7)>>3;
           ^
  343.     if (buffer_size < 0 || bit_size < 0) {
  344.         buffer_size = bit_size = 0;

libavcodec/get_bits.h:343:9: Taking true branch
  341. {
  342.     int buffer_size = (bit_size+7)>>3;
  343.     if (buffer_size < 0 || bit_size < 0) {
               ^
  344.         buffer_size = bit_size = 0;
  345.         buffer = NULL;

libavcodec/get_bits.h:344:9: 
  342.     int buffer_size = (bit_size+7)>>3;
  343.     if (buffer_size < 0 || bit_size < 0) {
  344.         buffer_size = bit_size = 0;
               ^
  345.         buffer = NULL;
  346.     }

libavcodec/get_bits.h:345:9: 
  343.     if (buffer_size < 0 || bit_size < 0) {
  344.         buffer_size = bit_size = 0;
  345.         buffer = NULL;
               ^
  346.     }
  347. 

libavcodec/get_bits.h:348:5: 
  346.     }
  347. 
  348.     s->buffer       = buffer;
           ^
  349.     s->size_in_bits = bit_size;
  350. #if !UNCHECKED_BITSTREAM_READER

libavcodec/get_bits.h:349:5: 
  347. 
  348.     s->buffer       = buffer;
  349.     s->size_in_bits = bit_size;
           ^
  350. #if !UNCHECKED_BITSTREAM_READER
  351.     s->size_in_bits_plus8 = bit_size + 8;

libavcodec/get_bits.h:351:5: 
  349.     s->size_in_bits = bit_size;
  350. #if !UNCHECKED_BITSTREAM_READER
  351.     s->size_in_bits_plus8 = bit_size + 8;
           ^
  352. #endif
  353.     s->buffer_end   = buffer + buffer_size;

libavcodec/get_bits.h:353:5: 
  351.     s->size_in_bits_plus8 = bit_size + 8;
  352. #endif
  353.     s->buffer_end   = buffer + buffer_size;
           ^
  354.     s->index        = 0;
  355. }

libavcodec/get_bits.h:354:5: 
  352. #endif
  353.     s->buffer_end   = buffer + buffer_size;
  354.     s->index        = 0;
           ^
  355. }
  356. 

libavcodec/get_bits.h:355:1: return from a call to init_get_bits
  353.     s->buffer_end   = buffer + buffer_size;
  354.     s->index        = 0;
  355. }
       ^
  356. 
  357. static inline void align_get_bits(GetBitContext *s)

libavcodec/vp3.c:1922:9: Taking true branch
1920.     init_get_bits(&gb, buf, buf_size * 8);
1921. 
1922.     if (s->theora && get_bits1(&gb))
              ^
1923.     {
1924.         av_log(avctx, AV_LOG_ERROR, "Header packet passed to frame decoder, skipping\n");

libavcodec/vp3.c:1922:22: 
1920.     init_get_bits(&gb, buf, buf_size * 8);
1921. 
1922.     if (s->theora && get_bits1(&gb))
                           ^
1923.     {
1924.         av_log(avctx, AV_LOG_ERROR, "Header packet passed to frame decoder, skipping\n");

libavcodec/get_bits.h:255:1: start of procedure get_bits1()
  253. }
  254. 
  255. static inline unsigned int get_bits1(GetBitContext *s)
       ^
  256. {
  257.     unsigned int index = s->index;

libavcodec/get_bits.h:257:5: 
  255. static inline unsigned int get_bits1(GetBitContext *s)
  256. {
  257.     unsigned int index = s->index;
           ^
  258.     uint8_t result = s->buffer[index>>3];
  259. #ifdef BITSTREAM_READER_LE

libavcodec/get_bits.h:258:5: 
  256. {
  257.     unsigned int index = s->index;
  258.     uint8_t result = s->buffer[index>>3];
           ^
  259. #ifdef BITSTREAM_READER_LE
  260.     result >>= index & 7;

static int vp3_decode_frame(AVCodecContext *avctx,
                            void *data, int *data_size,
                            AVPacket *avpkt)
{
    const uint8_t *buf = avpkt->data;
    int buf_size = avpkt->size;
    Vp3DecodeContext *s = avctx->priv_data;
    GetBitContext gb;
    int i;
    init_get_bits(&gb, buf, buf_size * 8);
    if (s->theora && get_bits1(&gb))
    {
        av_log(avctx, AV_LOG_ERROR, "Header packet passed to frame decoder, skipping\n");
        return -1;
    }
    s->keyframe = !get_bits1(&gb);
    if (!s->theora)
        skip_bits(&gb, 1);
    for (i = 0; i < 3; i++)
        s->last_qps[i] = s->qps[i];
    s->nqps=0;
    do{
        s->qps[s->nqps++]= get_bits(&gb, 6);
    } while(s->theora >= 0x030200 && s->nqps<3 && get_bits1(&gb));
    for (i = s->nqps; i < 3; i++)
        s->qps[i] = -1;
    if (s->avctx->debug & FF_DEBUG_PICT_INFO)
        av_log(s->avctx, AV_LOG_INFO, " VP3 %sframe #%d: Q index = %d\n",
            s->keyframe?"key":"", avctx->frame_number+1, s->qps[0]);
    s->skip_loop_filter = !s->filter_limit_values[s->qps[0]] ||
        avctx->skip_loop_filter >= (s->keyframe ? AVDISCARD_ALL : AVDISCARD_NONKEY);
    if (s->qps[0] != s->last_qps[0])
        init_loop_filter(s);
    for (i = 0; i < s->nqps; i++)
        if (s->qps[i] != s->last_qps[i] || s->qps[0] != s->last_qps[0])
            init_dequantizer(s, i);
    if (avctx->skip_frame >= AVDISCARD_NONKEY && !s->keyframe)
        return buf_size;
    s->current_frame.reference = 3;
    s->current_frame.pict_type = s->keyframe ? AV_PICTURE_TYPE_I : AV_PICTURE_TYPE_P;
    if (ff_thread_get_buffer(avctx, &s->current_frame) < 0) {
        av_log(s->avctx, AV_LOG_ERROR, "get_buffer() failed\n");
        goto error;
    }
    if (!s->edge_emu_buffer)
        s->edge_emu_buffer = av_malloc(9*FFABS(s->current_frame.linesize[0]));
    if (s->keyframe) {
        if (!s->theora)
        {
            skip_bits(&gb, 4);
            skip_bits(&gb, 4);
            if (s->version)
            {
                s->version = get_bits(&gb, 5);
                if (avctx->frame_number == 0)
                    av_log(s->avctx, AV_LOG_DEBUG, "VP version: %d\n", s->version);
            }
        }
        if (s->version || s->theora)
        {
                if (get_bits1(&gb))
                    av_log(s->avctx, AV_LOG_ERROR, "Warning, unsupported keyframe coding type?!\n");
            skip_bits(&gb, 2);
        }
    } else {
        if (!s->golden_frame.data[0]) {
            av_log(s->avctx, AV_LOG_WARNING, "vp3: first frame not a keyframe\n");
            s->golden_frame.reference = 3;
            s->golden_frame.pict_type = AV_PICTURE_TYPE_I;
            if (ff_thread_get_buffer(avctx, &s->golden_frame) < 0) {
                av_log(s->avctx, AV_LOG_ERROR, "get_buffer() failed\n");
                goto error;
            }
            s->last_frame = s->golden_frame;
            s->last_frame.type = FF_BUFFER_TYPE_COPY;
            ff_thread_report_progress(&s->last_frame, INT_MAX, 0);
        }
    }
    memset(s->all_fragments, 0, s->fragment_count * sizeof(Vp3Fragment));
    ff_thread_finish_setup(avctx);
    if (unpack_superblocks(s, &gb)){
        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_superblocks\n");
        goto error;
    }
    if (unpack_modes(s, &gb)){
        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_modes\n");
        goto error;
    }
    if (unpack_vectors(s, &gb)){
        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_vectors\n");
        goto error;
    }
    if (unpack_block_qpis(s, &gb)){
        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_block_qpis\n");
        goto error;
    }
    if (unpack_dct_coeffs(s, &gb)){
        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_dct_coeffs\n");
        goto error;
    }
    for (i = 0; i < 3; i++) {
        int height = s->height >> (i && s->chroma_y_shift);
        if (s->flipped_image)
            s->data_offset[i] = 0;
        else
            s->data_offset[i] = (height-1) * s->current_frame.linesize[i];
    }
    s->last_slice_end = 0;
    for (i = 0; i < s->c_superblock_height; i++)
        render_slice(s, i);
    for (i = 0; i < 3; i++) {
        int row = (s->height >> (3+(i && s->chroma_y_shift))) - 1;
        apply_loop_filter(s, i, row, row+1);
    }
    vp3_draw_horiz_band(s, s->avctx->height);
    *data_size=sizeof(AVFrame);
    *(AVFrame*)data= s->current_frame;
    if (!HAVE_THREADS || !(s->avctx->active_thread_type&FF_THREAD_FRAME))
        update_frames(avctx);
    return buf_size;
error:
    ff_thread_report_progress(&s->current_frame, INT_MAX, 0);
    if (!HAVE_THREADS || !(s->avctx->active_thread_type&FF_THREAD_FRAME))
        avctx->release_buffer(avctx, &s->current_frame);
    return -1;
}
['static int vp3_decode_frame(AVCodecContext *avctx,\n                            void *data, int *data_size,\n                            AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    Vp3DecodeContext *s = avctx->priv_data;\n    GetBitContext gb;\n    int i;\n    init_get_bits(&gb, buf, buf_size * 8);\n    if (s->theora && get_bits1(&gb))\n    {\n        av_log(avctx, AV_LOG_ERROR, "Header packet passed to frame decoder, skipping\\n");\n        return -1;\n    }\n    s->keyframe = !get_bits1(&gb);\n    if (!s->theora)\n        skip_bits(&gb, 1);\n    for (i = 0; i < 3; i++)\n        s->last_qps[i] = s->qps[i];\n    s->nqps=0;\n    do{\n        s->qps[s->nqps++]= get_bits(&gb, 6);\n    } while(s->theora >= 0x030200 && s->nqps<3 && get_bits1(&gb));\n    for (i = s->nqps; i < 3; i++)\n        s->qps[i] = -1;\n    if (s->avctx->debug & FF_DEBUG_PICT_INFO)\n        av_log(s->avctx, AV_LOG_INFO, " VP3 %sframe #%d: Q index = %d\\n",\n            s->keyframe?"key":"", avctx->frame_number+1, s->qps[0]);\n    s->skip_loop_filter = !s->filter_limit_values[s->qps[0]] ||\n        avctx->skip_loop_filter >= (s->keyframe ? AVDISCARD_ALL : AVDISCARD_NONKEY);\n    if (s->qps[0] != s->last_qps[0])\n        init_loop_filter(s);\n    for (i = 0; i < s->nqps; i++)\n        if (s->qps[i] != s->last_qps[i] || s->qps[0] != s->last_qps[0])\n            init_dequantizer(s, i);\n    if (avctx->skip_frame >= AVDISCARD_NONKEY && !s->keyframe)\n        return buf_size;\n    s->current_frame.reference = 3;\n    s->current_frame.pict_type = s->keyframe ? AV_PICTURE_TYPE_I : AV_PICTURE_TYPE_P;\n    if (ff_thread_get_buffer(avctx, &s->current_frame) < 0) {\n        av_log(s->avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        goto error;\n    }\n    if (!s->edge_emu_buffer)\n        s->edge_emu_buffer = av_malloc(9*FFABS(s->current_frame.linesize[0]));\n    if (s->keyframe) {\n        if (!s->theora)\n        {\n            skip_bits(&gb, 4);\n            skip_bits(&gb, 4);\n            if (s->version)\n            {\n                s->version = get_bits(&gb, 5);\n                if (avctx->frame_number == 0)\n                    av_log(s->avctx, AV_LOG_DEBUG, "VP version: %d\\n", s->version);\n            }\n        }\n        if (s->version || s->theora)\n        {\n                if (get_bits1(&gb))\n                    av_log(s->avctx, AV_LOG_ERROR, "Warning, unsupported keyframe coding type?!\\n");\n            skip_bits(&gb, 2);\n        }\n    } else {\n        if (!s->golden_frame.data[0]) {\n            av_log(s->avctx, AV_LOG_WARNING, "vp3: first frame not a keyframe\\n");\n            s->golden_frame.reference = 3;\n            s->golden_frame.pict_type = AV_PICTURE_TYPE_I;\n            if (ff_thread_get_buffer(avctx, &s->golden_frame) < 0) {\n                av_log(s->avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n                goto error;\n            }\n            s->last_frame = s->golden_frame;\n            s->last_frame.type = FF_BUFFER_TYPE_COPY;\n            ff_thread_report_progress(&s->last_frame, INT_MAX, 0);\n        }\n    }\n    memset(s->all_fragments, 0, s->fragment_count * sizeof(Vp3Fragment));\n    ff_thread_finish_setup(avctx);\n    if (unpack_superblocks(s, &gb)){\n        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_superblocks\\n");\n        goto error;\n    }\n    if (unpack_modes(s, &gb)){\n        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_modes\\n");\n        goto error;\n    }\n    if (unpack_vectors(s, &gb)){\n        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_vectors\\n");\n        goto error;\n    }\n    if (unpack_block_qpis(s, &gb)){\n        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_block_qpis\\n");\n        goto error;\n    }\n    if (unpack_dct_coeffs(s, &gb)){\n        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_dct_coeffs\\n");\n        goto error;\n    }\n    for (i = 0; i < 3; i++) {\n        int height = s->height >> (i && s->chroma_y_shift);\n        if (s->flipped_image)\n            s->data_offset[i] = 0;\n        else\n            s->data_offset[i] = (height-1) * s->current_frame.linesize[i];\n    }\n    s->last_slice_end = 0;\n    for (i = 0; i < s->c_superblock_height; i++)\n        render_slice(s, i);\n    for (i = 0; i < 3; i++) {\n        int row = (s->height >> (3+(i && s->chroma_y_shift))) - 1;\n        apply_loop_filter(s, i, row, row+1);\n    }\n    vp3_draw_horiz_band(s, s->avctx->height);\n    *data_size=sizeof(AVFrame);\n    *(AVFrame*)data= s->current_frame;\n    if (!HAVE_THREADS || !(s->avctx->active_thread_type&FF_THREAD_FRAME))\n        update_frames(avctx);\n    return buf_size;\nerror:\n    ff_thread_report_progress(&s->current_frame, INT_MAX, 0);\n    if (!HAVE_THREADS || !(s->avctx->active_thread_type&FF_THREAD_FRAME))\n        avctx->release_buffer(avctx, &s->current_frame);\n    return -1;\n}', 'static inline void init_get_bits(GetBitContext *s, const uint8_t *buffer,\n                                 int bit_size)\n{\n    int buffer_size = (bit_size+7)>>3;\n    if (buffer_size < 0 || bit_size < 0) {\n        buffer_size = bit_size = 0;\n        buffer = NULL;\n    }\n    s->buffer       = buffer;\n    s->size_in_bits = bit_size;\n#if !UNCHECKED_BITSTREAM_READER\n    s->size_in_bits_plus8 = bit_size + 8;\n#endif\n    s->buffer_end   = buffer + buffer_size;\n    s->index        = 0;\n}', 'static inline unsigned int get_bits1(GetBitContext *s)\n{\n    unsigned int index = s->index;\n    uint8_t result = s->buffer[index>>3];\n#ifdef BITSTREAM_READER_LE\n    result >>= index & 7;\n    result &= 1;\n#else\n    result <<= index & 7;\n    result >>= 8 - 1;\n#endif\n#if !UNCHECKED_BITSTREAM_READER\n    if (s->index < s->size_in_bits_plus8)\n#endif\n        index++;\n    s->index = index;\n    return result;\n}']