libavformat/oggparsetheora.c:61: error: Null Dereference
  pointer `&gb->buffer` last assigned on line 59 could be null and is dereferenced by call to `skip_bits()` at line 61, column 9.

libavformat/oggparsetheora.c:36:1: start of procedure theora_header()
34. } theora_params_t;
35. 
36. static int
    ^
37. theora_header (AVFormatContext * s, int idx)
38. {

libavformat/oggparsetheora.c:39:5: 
37. theora_header (AVFormatContext * s, int idx)
38. {
39.     ogg_t *ogg = s->priv_data;
        ^
40.     ogg_stream_t *os = ogg->streams + idx;
41.     AVStream *st = s->streams[idx];

libavformat/oggparsetheora.c:40:5: 
38. {
39.     ogg_t *ogg = s->priv_data;
40.     ogg_stream_t *os = ogg->streams + idx;
        ^
41.     AVStream *st = s->streams[idx];
42.     theora_params_t *thp = os->private;

libavformat/oggparsetheora.c:41:5: 
39.     ogg_t *ogg = s->priv_data;
40.     ogg_stream_t *os = ogg->streams + idx;
41.     AVStream *st = s->streams[idx];
        ^
42.     theora_params_t *thp = os->private;
43.     int cds = st->codec->extradata_size + os->psize + 2;

libavformat/oggparsetheora.c:42:5: 
40.     ogg_stream_t *os = ogg->streams + idx;
41.     AVStream *st = s->streams[idx];
42.     theora_params_t *thp = os->private;
        ^
43.     int cds = st->codec->extradata_size + os->psize + 2;
44.     uint8_t *cdp;

libavformat/oggparsetheora.c:43:5: 
41.     AVStream *st = s->streams[idx];
42.     theora_params_t *thp = os->private;
43.     int cds = st->codec->extradata_size + os->psize + 2;
        ^
44.     uint8_t *cdp;
45. 

libavformat/oggparsetheora.c:46:10: Taking false branch
44.     uint8_t *cdp;
45. 
46.     if(!(os->buf[os->pstart] & 0x80))
             ^
47.         return 0;
48. 

libavformat/oggparsetheora.c:49:9: Taking true branch
47.         return 0;
48. 
49.     if(!thp){
            ^
50.         thp = av_mallocz(sizeof(*thp));
51.         os->private = thp;

libavformat/oggparsetheora.c:50:9: 
48. 
49.     if(!thp){
50.         thp = av_mallocz(sizeof(*thp));
            ^
51.         os->private = thp;
52.     }

libavutil/mem.c:132:1: start of procedure av_mallocz()
  130. }
  131. 
  132. void *av_mallocz(unsigned int size)
       ^
  133. {
  134.     void *ptr = av_malloc(size);

libavutil/mem.c:134:5: 
  132. void *av_mallocz(unsigned int size)
  133. {
  134.     void *ptr = av_malloc(size);
           ^
  135.     if (ptr)
  136.         memset(ptr, 0, size);

libavutil/mem.c:42:1: start of procedure av_malloc()
    40.    linker will do it automatically */
    41. 
    42. void *av_malloc(unsigned int size)
        ^
    43. {
    44.     void *ptr;

libavutil/mem.c:50:8: Taking false branch
    48. 
    49.     /* let's disallow possible ambiguous cases */
    50.     if(size > (INT_MAX-16) )
               ^
    51.         return NULL;
    52. 

libavutil/mem.c:61:5: Skipping memalign(): method has no implementation
    59.     ((char*)ptr)[-1]= diff;
    60. #elif defined (HAVE_MEMALIGN)
    61.     ptr = memalign(16,size);
            ^
    62.     /* Why 64?
    63.        Indeed, we should align it:

libavutil/mem.c:91:5: 
    89.     ptr = malloc(size);
    90. #endif
    91.     return ptr;
            ^
    92. }
    93. 

libavutil/mem.c:92:1: return from a call to av_malloc
    90. #endif
    91.     return ptr;
    92. }
        ^
    93. 
    94. void *av_realloc(void *ptr, unsigned int size)

libavutil/mem.c:135:9: Taking true branch
  133. {
  134.     void *ptr = av_malloc(size);
  135.     if (ptr)
               ^
  136.         memset(ptr, 0, size);
  137.     return ptr;

libavutil/mem.c:136:9: 
  134.     void *ptr = av_malloc(size);
  135.     if (ptr)
  136.         memset(ptr, 0, size);
               ^
  137.     return ptr;
  138. }

libavutil/mem.c:137:5: 
  135.     if (ptr)
  136.         memset(ptr, 0, size);
  137.     return ptr;
           ^
  138. }
  139. 

libavutil/mem.c:138:1: return from a call to av_mallocz
  136.         memset(ptr, 0, size);
  137.     return ptr;
  138. }
       ^
  139. 
  140. char *av_strdup(const char *s)

libavformat/oggparsetheora.c:51:9: 
49.     if(!thp){
50.         thp = av_mallocz(sizeof(*thp));
51.         os->private = thp;
            ^
52.     }
53. 

libavformat/oggparsetheora.c:54:9: Taking true branch
52.     }
53. 
54.     if (os->buf[os->pstart] == 0x80) {
            ^
55.         GetBitContext gb;
56.         int width, height;

libavformat/oggparsetheora.c:59:9: 
57.         int version;
58. 
59.         init_get_bits(&gb, os->buf + os->pstart, os->psize*8);
            ^
60. 
61.         skip_bits(&gb, 7*8); /* 0x80"theora" */

libavcodec/bitstream.h:758:1: start of procedure init_get_bits()
  756.  * @param bit_size the size of the buffer in bits
  757.  */
  758. static inline void init_get_bits(GetBitContext *s,
       ^
  759.                    const uint8_t *buffer, int bit_size)
  760. {

libavcodec/bitstream.h:761:5: 
  759.                    const uint8_t *buffer, int bit_size)
  760. {
  761.     int buffer_size= (bit_size+7)>>3;
           ^
  762.     if(buffer_size < 0 || bit_size < 0) {
  763.         buffer_size = bit_size = 0;

libavcodec/bitstream.h:762:8: Taking true branch
  760. {
  761.     int buffer_size= (bit_size+7)>>3;
  762.     if(buffer_size < 0 || bit_size < 0) {
              ^
  763.         buffer_size = bit_size = 0;
  764.         buffer = NULL;

libavcodec/bitstream.h:763:9: 
  761.     int buffer_size= (bit_size+7)>>3;
  762.     if(buffer_size < 0 || bit_size < 0) {
  763.         buffer_size = bit_size = 0;
               ^
  764.         buffer = NULL;
  765.     }

libavcodec/bitstream.h:764:9: 
  762.     if(buffer_size < 0 || bit_size < 0) {
  763.         buffer_size = bit_size = 0;
  764.         buffer = NULL;
               ^
  765.     }
  766. 

libavcodec/bitstream.h:767:5: 
  765.     }
  766. 
  767.     s->buffer= buffer;
           ^
  768.     s->size_in_bits= bit_size;
  769.     s->buffer_end= buffer + buffer_size;

libavcodec/bitstream.h:768:5: 
  766. 
  767.     s->buffer= buffer;
  768.     s->size_in_bits= bit_size;
           ^
  769.     s->buffer_end= buffer + buffer_size;
  770. #ifdef ALT_BITSTREAM_READER

libavcodec/bitstream.h:769:5: 
  767.     s->buffer= buffer;
  768.     s->size_in_bits= bit_size;
  769.     s->buffer_end= buffer + buffer_size;
           ^
  770. #ifdef ALT_BITSTREAM_READER
  771.     s->index=0;

libavcodec/bitstream.h:771:5: 
  769.     s->buffer_end= buffer + buffer_size;
  770. #ifdef ALT_BITSTREAM_READER
  771.     s->index=0;
           ^
  772. #elif defined LIBMPEG2_BITSTREAM_READER
  773.     s->buffer_ptr = (uint8_t*)((intptr_t)buffer&(~1));

libavcodec/bitstream.h:781:1: return from a call to init_get_bits
  779.     skip_bits_long(s, 0);
  780. #endif
  781. }
       ^
  782. 
  783. static inline void align_get_bits(GetBitContext *s)

libavformat/oggparsetheora.c:61:9: 
59.         init_get_bits(&gb, os->buf + os->pstart, os->psize*8);
60. 
61.         skip_bits(&gb, 7*8); /* 0x80"theora" */
            ^
62. 
63.         version = get_bits_long(&gb, 24);

libavcodec/bitstream.h:678:1: start of procedure skip_bits()
  676. }
  677. 
  678. static inline void skip_bits(GetBitContext *s, int n){
       ^
  679.  //Note gcc seems to optimize this to s->index+=n for the ALT_READER :))
  680.     OPEN_READER(re, s)

libavcodec/bitstream.h:680:5: 
  678. static inline void skip_bits(GetBitContext *s, int n){
  679.  //Note gcc seems to optimize this to s->index+=n for the ALT_READER :))
  680.     OPEN_READER(re, s)
           ^
  681.     UPDATE_CACHE(re, s)
  682.     LAST_SKIP_BITS(re, s, n)

libavcodec/bitstream.h:681:5: 
  679.  //Note gcc seems to optimize this to s->index+=n for the ALT_READER :))
  680.     OPEN_READER(re, s)
  681.     UPDATE_CACHE(re, s)
           ^
  682.     LAST_SKIP_BITS(re, s, n)
  683.     CLOSE_READER(re, s)

static int
theora_header (AVFormatContext * s, int idx)
{
    ogg_t *ogg = s->priv_data;
    ogg_stream_t *os = ogg->streams + idx;
    AVStream *st = s->streams[idx];
    theora_params_t *thp = os->private;
    int cds = st->codec->extradata_size + os->psize + 2;
    uint8_t *cdp;
    if(!(os->buf[os->pstart] & 0x80))
        return 0;
    if(!thp){
        thp = av_mallocz(sizeof(*thp));
        os->private = thp;
    }
    if (os->buf[os->pstart] == 0x80) {
        GetBitContext gb;
        int width, height;
        int version;
        init_get_bits(&gb, os->buf + os->pstart, os->psize*8);
        skip_bits(&gb, 7*8);
        version = get_bits_long(&gb, 24);
        if (version < 0x030100)
        {
            av_log(s, AV_LOG_ERROR,
                "Too old or unsupported Theora (%x)\n", version);
            return -1;
        }
        width  = get_bits(&gb, 16) << 4;
        height = get_bits(&gb, 16) << 4;
        avcodec_set_dimensions(st->codec, width, height);
        if (version >= 0x030400)
            skip_bits(&gb, 100);
        width  = get_bits_long(&gb, 24);
        height = get_bits_long(&gb, 24);
        if (   width  <= st->codec->width  && width  > st->codec->width-16
            && height <= st->codec->height && height > st->codec->height-16)
            avcodec_set_dimensions(st->codec, width, height);
        if (version >= 0x030200)
            skip_bits(&gb, 16);
        st->codec->time_base.den = get_bits_long(&gb, 32);
        st->codec->time_base.num = get_bits_long(&gb, 32);
        st->time_base = st->codec->time_base;
        st->codec->sample_aspect_ratio.num = get_bits_long(&gb, 24);
        st->codec->sample_aspect_ratio.den = get_bits_long(&gb, 24);
        if (version >= 0x030200)
            skip_bits(&gb, 38);
        if (version >= 0x304000)
            skip_bits(&gb, 2);
        thp->gpshift = get_bits(&gb, 5);
        thp->gpmask = (1 << thp->gpshift) - 1;
        st->codec->codec_type = CODEC_TYPE_VIDEO;
        st->codec->codec_id = CODEC_ID_THEORA;
    } else if (os->buf[os->pstart] == 0x83) {
        vorbis_comment (s, os->buf + os->pstart + 7, os->psize - 8);
    }
    st->codec->extradata = av_realloc (st->codec->extradata, cds);
    cdp = st->codec->extradata + st->codec->extradata_size;
    *cdp++ = os->psize >> 8;
    *cdp++ = os->psize & 0xff;
    memcpy (cdp, os->buf + os->pstart, os->psize);
    st->codec->extradata_size = cds;
    return 1;
}
['static int\ntheora_header (AVFormatContext * s, int idx)\n{\n    ogg_t *ogg = s->priv_data;\n    ogg_stream_t *os = ogg->streams + idx;\n    AVStream *st = s->streams[idx];\n    theora_params_t *thp = os->private;\n    int cds = st->codec->extradata_size + os->psize + 2;\n    uint8_t *cdp;\n    if(!(os->buf[os->pstart] & 0x80))\n        return 0;\n    if(!thp){\n        thp = av_mallocz(sizeof(*thp));\n        os->private = thp;\n    }\n    if (os->buf[os->pstart] == 0x80) {\n        GetBitContext gb;\n        int width, height;\n        int version;\n        init_get_bits(&gb, os->buf + os->pstart, os->psize*8);\n        skip_bits(&gb, 7*8);\n        version = get_bits_long(&gb, 24);\n        if (version < 0x030100)\n        {\n            av_log(s, AV_LOG_ERROR,\n                "Too old or unsupported Theora (%x)\\n", version);\n            return -1;\n        }\n        width  = get_bits(&gb, 16) << 4;\n        height = get_bits(&gb, 16) << 4;\n        avcodec_set_dimensions(st->codec, width, height);\n        if (version >= 0x030400)\n            skip_bits(&gb, 100);\n        width  = get_bits_long(&gb, 24);\n        height = get_bits_long(&gb, 24);\n        if (   width  <= st->codec->width  && width  > st->codec->width-16\n            && height <= st->codec->height && height > st->codec->height-16)\n            avcodec_set_dimensions(st->codec, width, height);\n        if (version >= 0x030200)\n            skip_bits(&gb, 16);\n        st->codec->time_base.den = get_bits_long(&gb, 32);\n        st->codec->time_base.num = get_bits_long(&gb, 32);\n        st->time_base = st->codec->time_base;\n        st->codec->sample_aspect_ratio.num = get_bits_long(&gb, 24);\n        st->codec->sample_aspect_ratio.den = get_bits_long(&gb, 24);\n        if (version >= 0x030200)\n            skip_bits(&gb, 38);\n        if (version >= 0x304000)\n            skip_bits(&gb, 2);\n        thp->gpshift = get_bits(&gb, 5);\n        thp->gpmask = (1 << thp->gpshift) - 1;\n        st->codec->codec_type = CODEC_TYPE_VIDEO;\n        st->codec->codec_id = CODEC_ID_THEORA;\n    } else if (os->buf[os->pstart] == 0x83) {\n        vorbis_comment (s, os->buf + os->pstart + 7, os->psize - 8);\n    }\n    st->codec->extradata = av_realloc (st->codec->extradata, cds);\n    cdp = st->codec->extradata + st->codec->extradata_size;\n    *cdp++ = os->psize >> 8;\n    *cdp++ = os->psize & 0xff;\n    memcpy (cdp, os->buf + os->pstart, os->psize);\n    st->codec->extradata_size = cds;\n    return 1;\n}', 'void *av_mallocz(unsigned int size)\n{\n    void *ptr = av_malloc(size);\n    if (ptr)\n        memset(ptr, 0, size);\n    return ptr;\n}', 'void *av_malloc(unsigned int size)\n{\n    void *ptr;\n#ifdef CONFIG_MEMALIGN_HACK\n    long diff;\n#endif\n    if(size > (INT_MAX-16) )\n        return NULL;\n#ifdef CONFIG_MEMALIGN_HACK\n    ptr = malloc(size+16);\n    if(!ptr)\n        return ptr;\n    diff= ((-(long)ptr - 1)&15) + 1;\n    ptr = (char*)ptr + diff;\n    ((char*)ptr)[-1]= diff;\n#elif defined (HAVE_MEMALIGN)\n    ptr = memalign(16,size);\n#else\n    ptr = malloc(size);\n#endif\n    return ptr;\n}', 'static inline void init_get_bits(GetBitContext *s,\n                   const uint8_t *buffer, int bit_size)\n{\n    int buffer_size= (bit_size+7)>>3;\n    if(buffer_size < 0 || bit_size < 0) {\n        buffer_size = bit_size = 0;\n        buffer = NULL;\n    }\n    s->buffer= buffer;\n    s->size_in_bits= bit_size;\n    s->buffer_end= buffer + buffer_size;\n#ifdef ALT_BITSTREAM_READER\n    s->index=0;\n#elif defined LIBMPEG2_BITSTREAM_READER\n    s->buffer_ptr = (uint8_t*)((intptr_t)buffer&(~1));\n    s->bit_count = 16 + 8*((intptr_t)buffer&1);\n    skip_bits_long(s, 0);\n#elif defined A32_BITSTREAM_READER\n    s->buffer_ptr = (uint32_t*)((intptr_t)buffer&(~3));\n    s->bit_count = 32 + 8*((intptr_t)buffer&3);\n    skip_bits_long(s, 0);\n#endif\n}', 'static inline void skip_bits(GetBitContext *s, int n){\n    OPEN_READER(re, s)\n    UPDATE_CACHE(re, s)\n    LAST_SKIP_BITS(re, s, n)\n    CLOSE_READER(re, s)\n}']