libavcodec/faxcompr.c:282: error: Null Dereference
  pointer `ref` last assigned on line 281 could be null and is dereferenced at line 282, column 5.

libavcodec/faxcompr.c:270:1: start of procedure ff_ccitt_unpack()
268. }
269. 
270. int ff_ccitt_unpack(AVCodecContext *avctx,
     ^
271.                        const uint8_t *src, int srcsize,
272.                        uint8_t *dst, int height, int stride, enum TiffCompr compr)

libavcodec/faxcompr.c:278:5: 
276.     int *runs, *ref, *runend;
277.     int ret;
278.     int runsize= avctx->width + 2;
         ^
279. 
280.     runs = av_malloc(runsize * sizeof(runs[0]));

libavcodec/faxcompr.c:280:5: 
278.     int runsize= avctx->width + 2;
279. 
280.     runs = av_malloc(runsize * sizeof(runs[0]));
         ^
281.     ref  = av_malloc(runsize * sizeof(ref[0]));
282.     ref[0] = avctx->width;

libavutil/mem.c:47:1: start of procedure av_malloc()
  45.    linker will do it automatically. */
  46. 
  47. void *av_malloc(unsigned int size)
      ^
  48. {
  49.     void *ptr = NULL;

libavutil/mem.c:49:5: 
  47. void *av_malloc(unsigned int size)
  48. {
  49.     void *ptr = NULL;
          ^
  50. #if CONFIG_MEMALIGN_HACK
  51.     long diff;

libavutil/mem.c:55:8: Taking false branch
  53. 
  54.     /* let's disallow possible ambiguous cases */
  55.     if(size > (INT_MAX-16) )
             ^
  56.         return NULL;
  57. 

libavutil/mem.c:66:9: Taking false branch
  64.     ((char*)ptr)[-1]= diff;
  65. #elif HAVE_POSIX_MEMALIGN
  66.     if (posix_memalign(&ptr,16,size))
              ^
  67.         ptr = NULL;
  68. #elif HAVE_MEMALIGN

libavutil/mem.c:99:5: 
   97.     ptr = malloc(size);
   98. #endif
   99.     return ptr;
           ^
  100. }
  101. 

libavutil/mem.c:100:1: return from a call to av_malloc
   98. #endif
   99.     return ptr;
  100. }
       ^
  101. 
  102. void *av_realloc(void *ptr, unsigned int size)

libavcodec/faxcompr.c:281:5: 
279. 
280.     runs = av_malloc(runsize * sizeof(runs[0]));
281.     ref  = av_malloc(runsize * sizeof(ref[0]));
         ^
282.     ref[0] = avctx->width;
283.     ref[1] = 0;

libavutil/mem.c:47:1: start of procedure av_malloc()
  45.    linker will do it automatically. */
  46. 
  47. void *av_malloc(unsigned int size)
      ^
  48. {
  49.     void *ptr = NULL;

libavutil/mem.c:49:5: 
  47. void *av_malloc(unsigned int size)
  48. {
  49.     void *ptr = NULL;
          ^
  50. #if CONFIG_MEMALIGN_HACK
  51.     long diff;

libavutil/mem.c:55:8: Taking false branch
  53. 
  54.     /* let's disallow possible ambiguous cases */
  55.     if(size > (INT_MAX-16) )
             ^
  56.         return NULL;
  57. 

libavutil/mem.c:66:9: Taking true branch
  64.     ((char*)ptr)[-1]= diff;
  65. #elif HAVE_POSIX_MEMALIGN
  66.     if (posix_memalign(&ptr,16,size))
              ^
  67.         ptr = NULL;
  68. #elif HAVE_MEMALIGN

libavutil/mem.c:67:9: 
  65. #elif HAVE_POSIX_MEMALIGN
  66.     if (posix_memalign(&ptr,16,size))
  67.         ptr = NULL;
              ^
  68. #elif HAVE_MEMALIGN
  69.     ptr = memalign(16,size);

libavutil/mem.c:99:5: 
   97.     ptr = malloc(size);
   98. #endif
   99.     return ptr;
           ^
  100. }
  101. 

libavutil/mem.c:100:1: return from a call to av_malloc
   98. #endif
   99.     return ptr;
  100. }
       ^
  101. 
  102. void *av_realloc(void *ptr, unsigned int size)

libavcodec/faxcompr.c:282:5: 
280.     runs = av_malloc(runsize * sizeof(runs[0]));
281.     ref  = av_malloc(runsize * sizeof(ref[0]));
282.     ref[0] = avctx->width;
         ^
283.     ref[1] = 0;
284.     ref[2] = 0;

int ff_ccitt_unpack(AVCodecContext *avctx,
                       const uint8_t *src, int srcsize,
                       uint8_t *dst, int height, int stride, enum TiffCompr compr)
{
    int j;
    GetBitContext gb;
    int *runs, *ref, *runend;
    int ret;
    int runsize= avctx->width + 2;
    runs = av_malloc(runsize * sizeof(runs[0]));
    ref  = av_malloc(runsize * sizeof(ref[0]));
    ref[0] = avctx->width;
    ref[1] = 0;
    ref[2] = 0;
    init_get_bits(&gb, src, srcsize*8);
    for(j = 0; j < height; j++){
        runend = runs + runsize;
        if(compr == TIFF_G4){
            ret = decode_group3_2d_line(avctx, &gb, avctx->width, runs, runend, ref);
            if(ret < 0){
                av_free(runs);
                av_free(ref);
                return -1;
            }
        }else{
            if(find_group3_syncmarker(&gb, srcsize*8) < 0)
                break;
            if(compr==TIFF_CCITT_RLE || get_bits1(&gb))
                ret = decode_group3_1d_line(avctx, &gb, avctx->width, runs, runend);
            else
                ret = decode_group3_2d_line(avctx, &gb, avctx->width, runs, runend, ref);
        }
        if(ret < 0){
            put_line(dst, stride, avctx->width, ref);
        }else{
            put_line(dst, stride, avctx->width, runs);
            FFSWAP(int*, runs, ref);
        }
        dst += stride;
    }
    av_free(runs);
    av_free(ref);
    return 0;
}
['int ff_ccitt_unpack(AVCodecContext *avctx,\n                       const uint8_t *src, int srcsize,\n                       uint8_t *dst, int height, int stride, enum TiffCompr compr)\n{\n    int j;\n    GetBitContext gb;\n    int *runs, *ref, *runend;\n    int ret;\n    int runsize= avctx->width + 2;\n    runs = av_malloc(runsize * sizeof(runs[0]));\n    ref  = av_malloc(runsize * sizeof(ref[0]));\n    ref[0] = avctx->width;\n    ref[1] = 0;\n    ref[2] = 0;\n    init_get_bits(&gb, src, srcsize*8);\n    for(j = 0; j < height; j++){\n        runend = runs + runsize;\n        if(compr == TIFF_G4){\n            ret = decode_group3_2d_line(avctx, &gb, avctx->width, runs, runend, ref);\n            if(ret < 0){\n                av_free(runs);\n                av_free(ref);\n                return -1;\n            }\n        }else{\n            if(find_group3_syncmarker(&gb, srcsize*8) < 0)\n                break;\n            if(compr==TIFF_CCITT_RLE || get_bits1(&gb))\n                ret = decode_group3_1d_line(avctx, &gb, avctx->width, runs, runend);\n            else\n                ret = decode_group3_2d_line(avctx, &gb, avctx->width, runs, runend, ref);\n        }\n        if(ret < 0){\n            put_line(dst, stride, avctx->width, ref);\n        }else{\n            put_line(dst, stride, avctx->width, runs);\n            FFSWAP(int*, runs, ref);\n        }\n        dst += stride;\n    }\n    av_free(runs);\n    av_free(ref);\n    return 0;\n}', 'void *av_malloc(unsigned int size)\n{\n    void *ptr = NULL;\n#if CONFIG_MEMALIGN_HACK\n    long diff;\n#endif\n    if(size > (INT_MAX-16) )\n        return NULL;\n#if CONFIG_MEMALIGN_HACK\n    ptr = malloc(size+16);\n    if(!ptr)\n        return ptr;\n    diff= ((-(long)ptr - 1)&15) + 1;\n    ptr = (char*)ptr + diff;\n    ((char*)ptr)[-1]= diff;\n#elif HAVE_POSIX_MEMALIGN\n    if (posix_memalign(&ptr,16,size))\n        ptr = NULL;\n#elif HAVE_MEMALIGN\n    ptr = memalign(16,size);\n#else\n    ptr = malloc(size);\n#endif\n    return ptr;\n}']