libavformat/oggparsespeex.c:73: error: Null Dereference
  pointer `st->codec->extradata` last assigned on line 71 could be null and is dereferenced by call to `memcpy()` at line 73, column 9.

libavformat/oggparsespeex.c:38:1: start of procedure speex_header()
36. };
37. 
38. static int speex_header(AVFormatContext *s, int idx) {
    ^
39.     struct ogg *ogg = s->priv_data;
40.     struct ogg_stream *os = ogg->streams + idx;

libavformat/oggparsespeex.c:39:5: 
37. 
38. static int speex_header(AVFormatContext *s, int idx) {
39.     struct ogg *ogg = s->priv_data;
        ^
40.     struct ogg_stream *os = ogg->streams + idx;
41.     struct speex_params *spxp = os->private;

libavformat/oggparsespeex.c:40:5: 
38. static int speex_header(AVFormatContext *s, int idx) {
39.     struct ogg *ogg = s->priv_data;
40.     struct ogg_stream *os = ogg->streams + idx;
        ^
41.     struct speex_params *spxp = os->private;
42.     AVStream *st = s->streams[idx];

libavformat/oggparsespeex.c:41:5: 
39.     struct ogg *ogg = s->priv_data;
40.     struct ogg_stream *os = ogg->streams + idx;
41.     struct speex_params *spxp = os->private;
        ^
42.     AVStream *st = s->streams[idx];
43.     uint8_t *p = os->buf + os->pstart;

libavformat/oggparsespeex.c:42:5: 
40.     struct ogg_stream *os = ogg->streams + idx;
41.     struct speex_params *spxp = os->private;
42.     AVStream *st = s->streams[idx];
        ^
43.     uint8_t *p = os->buf + os->pstart;
44. 

libavformat/oggparsespeex.c:43:5: 
41.     struct speex_params *spxp = os->private;
42.     AVStream *st = s->streams[idx];
43.     uint8_t *p = os->buf + os->pstart;
        ^
44. 
45.     if (!spxp) {

libavformat/oggparsespeex.c:45:10: Taking false branch
43.     uint8_t *p = os->buf + os->pstart;
44. 
45.     if (!spxp) {
             ^
46.         spxp = av_mallocz(sizeof(*spxp));
47.         os->private = spxp;

libavformat/oggparsespeex.c:50:9: Taking false branch
48.     }
49. 
50.     if (spxp->seq > 1)
            ^
51.         return 0;
52. 

libavformat/oggparsespeex.c:53:9: Taking true branch
51.         return 0;
52. 
53.     if (spxp->seq == 0) {
            ^
54.         int frames_per_packet;
55.         st->codec->codec_type = AVMEDIA_TYPE_AUDIO;

libavformat/oggparsespeex.c:55:9: 
53.     if (spxp->seq == 0) {
54.         int frames_per_packet;
55.         st->codec->codec_type = AVMEDIA_TYPE_AUDIO;
            ^
56.         st->codec->codec_id = CODEC_ID_SPEEX;
57. 

libavformat/oggparsespeex.c:56:9: 
54.         int frames_per_packet;
55.         st->codec->codec_type = AVMEDIA_TYPE_AUDIO;
56.         st->codec->codec_id = CODEC_ID_SPEEX;
            ^
57. 
58.         st->codec->sample_rate = AV_RL32(p + 36);

libavformat/oggparsespeex.c:58:9: 
56.         st->codec->codec_id = CODEC_ID_SPEEX;
57. 
58.         st->codec->sample_rate = AV_RL32(p + 36);
            ^
59.         st->codec->channels = AV_RL32(p + 48);
60. 

libavformat/oggparsespeex.c:59:9: 
57. 
58.         st->codec->sample_rate = AV_RL32(p + 36);
59.         st->codec->channels = AV_RL32(p + 48);
            ^
60. 
61.         /* We treat the whole Speex packet as a single frame everywhere Speex

libavformat/oggparsespeex.c:65:9: 
63.            and joining individual Speex frames, which are not always
64.            byte-aligned. */
65.         st->codec->frame_size = AV_RL32(p + 56);
            ^
66.         frames_per_packet     = AV_RL32(p + 64);
67.         if (frames_per_packet)

libavformat/oggparsespeex.c:66:9: 
64.            byte-aligned. */
65.         st->codec->frame_size = AV_RL32(p + 56);
66.         frames_per_packet     = AV_RL32(p + 64);
            ^
67.         if (frames_per_packet)
68.             st->codec->frame_size *= frames_per_packet;

libavformat/oggparsespeex.c:67:13: Taking true branch
65.         st->codec->frame_size = AV_RL32(p + 56);
66.         frames_per_packet     = AV_RL32(p + 64);
67.         if (frames_per_packet)
                ^
68.             st->codec->frame_size *= frames_per_packet;
69. 

libavformat/oggparsespeex.c:68:13: 
66.         frames_per_packet     = AV_RL32(p + 64);
67.         if (frames_per_packet)
68.             st->codec->frame_size *= frames_per_packet;
                ^
69. 
70.         st->codec->extradata_size = os->psize;

libavformat/oggparsespeex.c:70:9: 
68.             st->codec->frame_size *= frames_per_packet;
69. 
70.         st->codec->extradata_size = os->psize;
            ^
71.         st->codec->extradata = av_malloc(st->codec->extradata_size
72.                                          + FF_INPUT_BUFFER_PADDING_SIZE);

libavformat/oggparsespeex.c:71:9: 
69. 
70.         st->codec->extradata_size = os->psize;
71.         st->codec->extradata = av_malloc(st->codec->extradata_size
            ^
72.                                          + FF_INPUT_BUFFER_PADDING_SIZE);
73.         memcpy(st->codec->extradata, p, st->codec->extradata_size);

libavutil/mem.c:64:1: start of procedure av_malloc()
  62.    linker will do it automatically. */
  63. 
  64. void *av_malloc(size_t size)
      ^
  65. {
  66.     void *ptr = NULL;

libavutil/mem.c:66:5: 
  64. void *av_malloc(size_t size)
  65. {
  66.     void *ptr = NULL;
          ^
  67. #if CONFIG_MEMALIGN_HACK
  68.     long diff;

libavutil/mem.c:72:8: Taking true branch
  70. 
  71.     /* let's disallow possible ambiguous cases */
  72.     if(size > (INT_MAX-32) )
             ^
  73.         return NULL;
  74. 

libavutil/mem.c:73:9: 
  71.     /* let's disallow possible ambiguous cases */
  72.     if(size > (INT_MAX-32) )
  73.         return NULL;
              ^
  74. 
  75. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:115:1: return from a call to av_malloc
  113. #endif
  114.     return ptr;
  115. }
       ^
  116. 
  117. void *av_realloc(void *ptr, size_t size)

libavformat/oggparsespeex.c:73:9: 
71.         st->codec->extradata = av_malloc(st->codec->extradata_size
72.                                          + FF_INPUT_BUFFER_PADDING_SIZE);
73.         memcpy(st->codec->extradata, p, st->codec->extradata_size);
            ^
74. 
75.         av_set_pts_info(st, 64, 1, st->codec->sample_rate);

static int speex_header(AVFormatContext *s, int idx) {
    struct ogg *ogg = s->priv_data;
    struct ogg_stream *os = ogg->streams + idx;
    struct speex_params *spxp = os->private;
    AVStream *st = s->streams[idx];
    uint8_t *p = os->buf + os->pstart;
    if (!spxp) {
        spxp = av_mallocz(sizeof(*spxp));
        os->private = spxp;
    }
    if (spxp->seq > 1)
        return 0;
    if (spxp->seq == 0) {
        int frames_per_packet;
        st->codec->codec_type = AVMEDIA_TYPE_AUDIO;
        st->codec->codec_id = CODEC_ID_SPEEX;
        st->codec->sample_rate = AV_RL32(p + 36);
        st->codec->channels = AV_RL32(p + 48);
        st->codec->frame_size = AV_RL32(p + 56);
        frames_per_packet     = AV_RL32(p + 64);
        if (frames_per_packet)
            st->codec->frame_size *= frames_per_packet;
        st->codec->extradata_size = os->psize;
        st->codec->extradata = av_malloc(st->codec->extradata_size
                                         + FF_INPUT_BUFFER_PADDING_SIZE);
        memcpy(st->codec->extradata, p, st->codec->extradata_size);
        av_set_pts_info(st, 64, 1, st->codec->sample_rate);
    } else
        ff_vorbis_comment(s, &st->metadata, p, os->psize);
    spxp->seq++;
    return 1;
}
['static int speex_header(AVFormatContext *s, int idx) {\n    struct ogg *ogg = s->priv_data;\n    struct ogg_stream *os = ogg->streams + idx;\n    struct speex_params *spxp = os->private;\n    AVStream *st = s->streams[idx];\n    uint8_t *p = os->buf + os->pstart;\n    if (!spxp) {\n        spxp = av_mallocz(sizeof(*spxp));\n        os->private = spxp;\n    }\n    if (spxp->seq > 1)\n        return 0;\n    if (spxp->seq == 0) {\n        int frames_per_packet;\n        st->codec->codec_type = AVMEDIA_TYPE_AUDIO;\n        st->codec->codec_id = CODEC_ID_SPEEX;\n        st->codec->sample_rate = AV_RL32(p + 36);\n        st->codec->channels = AV_RL32(p + 48);\n        st->codec->frame_size = AV_RL32(p + 56);\n        frames_per_packet     = AV_RL32(p + 64);\n        if (frames_per_packet)\n            st->codec->frame_size *= frames_per_packet;\n        st->codec->extradata_size = os->psize;\n        st->codec->extradata = av_malloc(st->codec->extradata_size\n                                         + FF_INPUT_BUFFER_PADDING_SIZE);\n        memcpy(st->codec->extradata, p, st->codec->extradata_size);\n        av_set_pts_info(st, 64, 1, st->codec->sample_rate);\n    } else\n        ff_vorbis_comment(s, &st->metadata, p, os->psize);\n    spxp->seq++;\n    return 1;\n}', 'void *av_malloc(size_t size)\n{\n    void *ptr = NULL;\n#if CONFIG_MEMALIGN_HACK\n    long diff;\n#endif\n    if(size > (INT_MAX-32) )\n        return NULL;\n#if CONFIG_MEMALIGN_HACK\n    ptr = malloc(size+32);\n    if(!ptr)\n        return ptr;\n    diff= ((-(long)ptr - 1)&31) + 1;\n    ptr = (char*)ptr + diff;\n    ((char*)ptr)[-1]= diff;\n#elif HAVE_POSIX_MEMALIGN\n    if (posix_memalign(&ptr,32,size))\n        ptr = NULL;\n#elif HAVE_MEMALIGN\n    ptr = memalign(32,size);\n#else\n    ptr = malloc(size);\n#endif\n    return ptr;\n}']