libavcodec/on2avc.c:800: error: Null Dereference
  pointer `&gb->buffer` last assigned on line 799 could be null and is dereferenced by call to `get_bits1()` at line 800, column 9.

libavcodec/on2avc.c:793:1: start of procedure on2avc_decode_subframe()
791. }
792. 
793. static int on2avc_decode_subframe(On2AVCContext *c, const uint8_t *buf,
     ^
794.                                   int buf_size, AVFrame *dst, int offset)
795. {

libavcodec/on2avc.c:799:5: 
797.     int i, ret;
798. 
799.     init_get_bits(&gb, buf, buf_size * 8);
         ^
800.     if (get_bits1(&gb)) {
801.         av_log(c->avctx, AV_LOG_ERROR, "enh bit set\n");

libavcodec/get_bits.h:375:1: start of procedure init_get_bits()
  373.  * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
  374.  */
  375. static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
       ^
  376.                                 int bit_size)
  377. {

libavcodec/get_bits.h:379:5: 
  377. {
  378.     int buffer_size;
  379.     int ret = 0;
           ^
  380. 
  381.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {

libavcodec/get_bits.h:381:9: Taking true branch
  379.     int ret = 0;
  380. 
  381.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
               ^
  382.         buffer_size = bit_size = 0;
  383.         buffer      = NULL;

libavcodec/get_bits.h:382:9: 
  380. 
  381.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
  382.         buffer_size = bit_size = 0;
               ^
  383.         buffer      = NULL;
  384.         ret         = AVERROR_INVALIDDATA;

libavcodec/get_bits.h:383:9: 
  381.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
  382.         buffer_size = bit_size = 0;
  383.         buffer      = NULL;
               ^
  384.         ret         = AVERROR_INVALIDDATA;
  385.     }

libavcodec/get_bits.h:384:9: 
  382.         buffer_size = bit_size = 0;
  383.         buffer      = NULL;
  384.         ret         = AVERROR_INVALIDDATA;
               ^
  385.     }
  386. 

libavcodec/get_bits.h:387:5: 
  385.     }
  386. 
  387.     buffer_size = (bit_size + 7) >> 3;
           ^
  388. 
  389.     s->buffer             = buffer;

libavcodec/get_bits.h:389:5: 
  387.     buffer_size = (bit_size + 7) >> 3;
  388. 
  389.     s->buffer             = buffer;
           ^
  390.     s->size_in_bits       = bit_size;
  391. #if !UNCHECKED_BITSTREAM_READER

libavcodec/get_bits.h:390:5: 
  388. 
  389.     s->buffer             = buffer;
  390.     s->size_in_bits       = bit_size;
           ^
  391. #if !UNCHECKED_BITSTREAM_READER
  392.     s->size_in_bits_plus8 = bit_size + 8;

libavcodec/get_bits.h:392:5: 
  390.     s->size_in_bits       = bit_size;
  391. #if !UNCHECKED_BITSTREAM_READER
  392.     s->size_in_bits_plus8 = bit_size + 8;
           ^
  393. #endif
  394.     s->buffer_end         = buffer + buffer_size;

libavcodec/get_bits.h:394:5: 
  392.     s->size_in_bits_plus8 = bit_size + 8;
  393. #endif
  394.     s->buffer_end         = buffer + buffer_size;
           ^
  395.     s->index              = 0;
  396. 

libavcodec/get_bits.h:395:5: 
  393. #endif
  394.     s->buffer_end         = buffer + buffer_size;
  395.     s->index              = 0;
           ^
  396. 
  397.     return ret;

libavcodec/get_bits.h:397:5: 
  395.     s->index              = 0;
  396. 
  397.     return ret;
           ^
  398. }
  399. 

libavcodec/get_bits.h:398:1: return from a call to init_get_bits
  396. 
  397.     return ret;
  398. }
       ^
  399. 
  400. /**

libavcodec/on2avc.c:800:9: 
798. 
799.     init_get_bits(&gb, buf, buf_size * 8);
800.     if (get_bits1(&gb)) {
             ^
801.         av_log(c->avctx, AV_LOG_ERROR, "enh bit set\n");
802.         return AVERROR_INVALIDDATA;

libavcodec/get_bits.h:271:1: start of procedure get_bits1()
  269. }
  270. 
  271. static inline unsigned int get_bits1(GetBitContext *s)
       ^
  272. {
  273.     unsigned int index = s->index;

libavcodec/get_bits.h:273:5: 
  271. static inline unsigned int get_bits1(GetBitContext *s)
  272. {
  273.     unsigned int index = s->index;
           ^
  274.     uint8_t result     = s->buffer[index >> 3];
  275. #ifdef BITSTREAM_READER_LE

libavcodec/get_bits.h:274:5: 
  272. {
  273.     unsigned int index = s->index;
  274.     uint8_t result     = s->buffer[index >> 3];
           ^
  275. #ifdef BITSTREAM_READER_LE
  276.     result >>= index & 7;

static int on2avc_decode_subframe(On2AVCContext *c, const uint8_t *buf,
                                  int buf_size, AVFrame *dst, int offset)
{
    GetBitContext gb;
    int i, ret;
    init_get_bits(&gb, buf, buf_size * 8);
    if (get_bits1(&gb)) {
        av_log(c->avctx, AV_LOG_ERROR, "enh bit set\n");
        return AVERROR_INVALIDDATA;
    }
    c->prev_window_type = c->window_type;
    c->window_type      = get_bits(&gb, 3);
    if (c->window_type >= WINDOW_TYPE_EXT4 && c->avctx->channels == 1) {
        av_log(c->avctx, AV_LOG_ERROR, "stereo mode window for mono audio\n");
        return AVERROR_INVALIDDATA;
    }
    c->band_start  = c->modes[c->window_type].band_start;
    c->num_windows = c->modes[c->window_type].num_windows;
    c->num_bands   = c->modes[c->window_type].num_bands;
    c->is_long     = (c->window_type != WINDOW_TYPE_8SHORT);
    c->grouping[0] = 1;
    for (i = 1; i < c->num_windows; i++)
        c->grouping[i] = !get_bits1(&gb);
    on2avc_read_ms_info(c, &gb);
    for (i = 0; i < c->avctx->channels; i++)
        if ((ret = on2avc_read_channel_data(c, &gb, i)) < 0)
            return AVERROR_INVALIDDATA;
    if (c->avctx->channels == 2 && c->ms_present)
        on2avc_apply_ms(c);
    if (c->window_type < WINDOW_TYPE_EXT4) {
        for (i = 0; i < c->avctx->channels; i++)
            on2avc_reconstruct_channel(c, i, dst, offset);
    } else {
        on2avc_reconstruct_stereo(c, dst, offset);
    }
    return 0;
}
['static int on2avc_decode_subframe(On2AVCContext *c, const uint8_t *buf,\n                                  int buf_size, AVFrame *dst, int offset)\n{\n    GetBitContext gb;\n    int i, ret;\n    init_get_bits(&gb, buf, buf_size * 8);\n    if (get_bits1(&gb)) {\n        av_log(c->avctx, AV_LOG_ERROR, "enh bit set\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    c->prev_window_type = c->window_type;\n    c->window_type      = get_bits(&gb, 3);\n    if (c->window_type >= WINDOW_TYPE_EXT4 && c->avctx->channels == 1) {\n        av_log(c->avctx, AV_LOG_ERROR, "stereo mode window for mono audio\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    c->band_start  = c->modes[c->window_type].band_start;\n    c->num_windows = c->modes[c->window_type].num_windows;\n    c->num_bands   = c->modes[c->window_type].num_bands;\n    c->is_long     = (c->window_type != WINDOW_TYPE_8SHORT);\n    c->grouping[0] = 1;\n    for (i = 1; i < c->num_windows; i++)\n        c->grouping[i] = !get_bits1(&gb);\n    on2avc_read_ms_info(c, &gb);\n    for (i = 0; i < c->avctx->channels; i++)\n        if ((ret = on2avc_read_channel_data(c, &gb, i)) < 0)\n            return AVERROR_INVALIDDATA;\n    if (c->avctx->channels == 2 && c->ms_present)\n        on2avc_apply_ms(c);\n    if (c->window_type < WINDOW_TYPE_EXT4) {\n        for (i = 0; i < c->avctx->channels; i++)\n            on2avc_reconstruct_channel(c, i, dst, offset);\n    } else {\n        on2avc_reconstruct_stereo(c, dst, offset);\n    }\n    return 0;\n}', 'static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,\n                                int bit_size)\n{\n    int buffer_size;\n    int ret = 0;\n    if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {\n        buffer_size = bit_size = 0;\n        buffer      = NULL;\n        ret         = AVERROR_INVALIDDATA;\n    }\n    buffer_size = (bit_size + 7) >> 3;\n    s->buffer             = buffer;\n    s->size_in_bits       = bit_size;\n#if !UNCHECKED_BITSTREAM_READER\n    s->size_in_bits_plus8 = bit_size + 8;\n#endif\n    s->buffer_end         = buffer + buffer_size;\n    s->index              = 0;\n    return ret;\n}', 'static inline unsigned int get_bits1(GetBitContext *s)\n{\n    unsigned int index = s->index;\n    uint8_t result     = s->buffer[index >> 3];\n#ifdef BITSTREAM_READER_LE\n    result >>= index & 7;\n    result  &= 1;\n#else\n    result <<= index & 7;\n    result >>= 8 - 1;\n#endif\n#if !UNCHECKED_BITSTREAM_READER\n    if (s->index < s->size_in_bits_plus8)\n#endif\n        index++;\n    s->index = index;\n    return result;\n}']