libavformat/rtpdec_asf.c:115: error: Null Dereference
  pointer `rt->asf_ctx` last assigned on line 110 could be null and is dereferenced at line 115, column 40.

libavformat/rtpdec_asf.c:94:1: start of procedure ff_wms_parse_sdp_a_line()
92. }
93. 
94. int ff_wms_parse_sdp_a_line(AVFormatContext *s, const char *p)
    ^
95. {
96.     int ret = 0;

libavformat/rtpdec_asf.c:96:5: 
94. int ff_wms_parse_sdp_a_line(AVFormatContext *s, const char *p)
95. {
96.     int ret = 0;
        ^
97.     if (av_strstart(p, "pgmpu:data:application/vnd.ms.wms-hdr.asfv1;base64,", &p)) {
98.         ByteIOContext pb;

libavformat/rtpdec_asf.c:97:9: Taking true branch
95. {
96.     int ret = 0;
97.     if (av_strstart(p, "pgmpu:data:application/vnd.ms.wms-hdr.asfv1;base64,", &p)) {
            ^
98.         ByteIOContext pb;
99.         RTSPState *rt = s->priv_data;

libavformat/rtpdec_asf.c:99:9: 
 97.     if (av_strstart(p, "pgmpu:data:application/vnd.ms.wms-hdr.asfv1;base64,", &p)) {
 98.         ByteIOContext pb;
 99.         RTSPState *rt = s->priv_data;
             ^
100.         int len = strlen(p) * 6 / 8;
101.         char *buf = av_mallocz(len);

libavformat/rtpdec_asf.c:100:9: 
 98.         ByteIOContext pb;
 99.         RTSPState *rt = s->priv_data;
100.         int len = strlen(p) * 6 / 8;
             ^
101.         char *buf = av_mallocz(len);
102.         av_base64_decode(buf, p, len);

libavformat/rtpdec_asf.c:101:9: 
 99.         RTSPState *rt = s->priv_data;
100.         int len = strlen(p) * 6 / 8;
101.         char *buf = av_mallocz(len);
             ^
102.         av_base64_decode(buf, p, len);
103. 

libavutil/mem.c:157:1: start of procedure av_mallocz()
  155. }
  156. 
  157. void *av_mallocz(FF_INTERNAL_MEM_TYPE size)
       ^
  158. {
  159.     void *ptr = av_malloc(size);

libavutil/mem.c:159:5: 
  157. void *av_mallocz(FF_INTERNAL_MEM_TYPE size)
  158. {
  159.     void *ptr = av_malloc(size);
           ^
  160.     if (ptr)
  161.         memset(ptr, 0, size);

libavutil/mem.c:64:1: start of procedure av_malloc()
    62.    linker will do it automatically. */
    63. 
    64. void *av_malloc(FF_INTERNAL_MEM_TYPE size)
        ^
    65. {
    66.     void *ptr = NULL;

libavutil/mem.c:66:5: 
    64. void *av_malloc(FF_INTERNAL_MEM_TYPE size)
    65. {
    66.     void *ptr = NULL;
            ^
    67. #if CONFIG_MEMALIGN_HACK
    68.     long diff;

libavutil/mem.c:72:8: Taking true branch
    70. 
    71.     /* let's disallow possible ambiguous cases */
    72.     if(size > (INT_MAX-16) )
               ^
    73.         return NULL;
    74. 

libavutil/mem.c:73:9: 
    71.     /* let's disallow possible ambiguous cases */
    72.     if(size > (INT_MAX-16) )
    73.         return NULL;
                ^
    74. 
    75. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:117:1: return from a call to av_malloc
    115. #endif
    116.     return ptr;
    117. }
         ^
    118. 
    119. void *av_realloc(void *ptr, FF_INTERNAL_MEM_TYPE size)

libavutil/mem.c:160:9: Taking false branch
  158. {
  159.     void *ptr = av_malloc(size);
  160.     if (ptr)
               ^
  161.         memset(ptr, 0, size);
  162.     return ptr;

libavutil/mem.c:162:5: 
  160.     if (ptr)
  161.         memset(ptr, 0, size);
  162.     return ptr;
           ^
  163. }
  164. 

libavutil/mem.c:163:1: return from a call to av_mallocz
  161.         memset(ptr, 0, size);
  162.     return ptr;
  163. }
       ^
  164. 
  165. char *av_strdup(const char *s)

libavformat/rtpdec_asf.c:102:9: Skipping av_base64_decode(): empty list of specs
100.         int len = strlen(p) * 6 / 8;
101.         char *buf = av_mallocz(len);
102.         av_base64_decode(buf, p, len);
             ^
103. 
104.         if (rtp_asf_fix_header(buf, len) < 0)

libavformat/rtpdec_asf.c:104:13: Taking true branch
102.         av_base64_decode(buf, p, len);
103. 
104.         if (rtp_asf_fix_header(buf, len) < 0)
                 ^
105.             av_log(s, AV_LOG_ERROR,
106.                    "Failed to fix invalid RTSP-MS/ASF min_pktsize\n");

libavformat/rtpdec_asf.c:105:13: Skipping av_log(): empty list of specs
103. 
104.         if (rtp_asf_fix_header(buf, len) < 0)
105.             av_log(s, AV_LOG_ERROR,
                 ^
106.                    "Failed to fix invalid RTSP-MS/ASF min_pktsize\n");
107.         init_packetizer(&pb, buf, len);

libavformat/rtpdec_asf.c:107:9: 
105.             av_log(s, AV_LOG_ERROR,
106.                    "Failed to fix invalid RTSP-MS/ASF min_pktsize\n");
107.         init_packetizer(&pb, buf, len);
             ^
108.         if (rt->asf_ctx) {
109.             av_close_input_stream(rt->asf_ctx);

libavformat/rtpdec_asf.c:85:1: start of procedure init_packetizer()
  83. }
  84. 
  85. static void init_packetizer(ByteIOContext *pb, uint8_t *buf, int len)
      ^
  86. {
  87.     init_put_byte(pb, buf, len, 0, NULL, packetizer_read, NULL, NULL);

libavformat/rtpdec_asf.c:87:5: 
  85. static void init_packetizer(ByteIOContext *pb, uint8_t *buf, int len)
  86. {
  87.     init_put_byte(pb, buf, len, 0, NULL, packetizer_read, NULL, NULL);
          ^
  88. 
  89.     /* this "fills" the buffer with its current content */

libavformat/aviobuf.c:43:1: start of procedure init_put_byte()
    41. #endif
    42. 
    43. int init_put_byte(ByteIOContext *s,
        ^
    44.                   unsigned char *buffer,
    45.                   int buffer_size,

libavformat/aviobuf.c:52:5: 
    50.                   int64_t (*seek)(void *opaque, int64_t offset, int whence))
    51. {
    52.     s->buffer = buffer;
            ^
    53.     s->buffer_size = buffer_size;
    54.     s->buf_ptr = buffer;

libavformat/aviobuf.c:53:5: 
    51. {
    52.     s->buffer = buffer;
    53.     s->buffer_size = buffer_size;
            ^
    54.     s->buf_ptr = buffer;
    55.     s->opaque = opaque;

libavformat/aviobuf.c:54:5: 
    52.     s->buffer = buffer;
    53.     s->buffer_size = buffer_size;
    54.     s->buf_ptr = buffer;
            ^
    55.     s->opaque = opaque;
    56.     url_resetbuf(s, write_flag ? URL_WRONLY : URL_RDONLY);

libavformat/aviobuf.c:55:5: 
    53.     s->buffer_size = buffer_size;
    54.     s->buf_ptr = buffer;
    55.     s->opaque = opaque;
            ^
    56.     url_resetbuf(s, write_flag ? URL_WRONLY : URL_RDONLY);
    57.     s->write_packet = write_packet;

libavformat/aviobuf.c:56:21: Condition is false
    54.     s->buf_ptr = buffer;
    55.     s->opaque = opaque;
    56.     url_resetbuf(s, write_flag ? URL_WRONLY : URL_RDONLY);
                            ^
    57.     s->write_packet = write_packet;
    58.     s->read_packet = read_packet;

libavformat/aviobuf.c:56:5: 
    54.     s->buf_ptr = buffer;
    55.     s->opaque = opaque;
    56.     url_resetbuf(s, write_flag ? URL_WRONLY : URL_RDONLY);
            ^
    57.     s->write_packet = write_packet;
    58.     s->read_packet = read_packet;

libavformat/aviobuf.c:699:1: start of procedure url_resetbuf()
      697. 
      698. #if FF_API_URL_RESETBUF
      699. int url_resetbuf(ByteIOContext *s, int flags)
           ^
      700. #else
      701. static int url_resetbuf(ByteIOContext *s, int flags)

libavformat/aviobuf.c:705:9: Taking false branch
      703. {
      704. #if FF_API_URL_RESETBUF
      705.     if (flags & URL_RDWR)
                   ^
      706.         return AVERROR(EINVAL);
      707. #else

libavformat/aviobuf.c:711:9: Taking true branch
      709. #endif
      710. 
      711.     if (flags & URL_WRONLY) {
                   ^
      712.         s->buf_end = s->buffer + s->buffer_size;
      713.         s->write_flag = 1;

libavformat/aviobuf.c:712:9: 
      710. 
      711.     if (flags & URL_WRONLY) {
      712.         s->buf_end = s->buffer + s->buffer_size;
                   ^
      713.         s->write_flag = 1;
      714.     } else {

libavformat/aviobuf.c:713:9: 
      711.     if (flags & URL_WRONLY) {
      712.         s->buf_end = s->buffer + s->buffer_size;
      713.         s->write_flag = 1;
                   ^
      714.     } else {
      715.         s->buf_end = s->buffer;

libavformat/aviobuf.c:718:5: 
      716.         s->write_flag = 0;
      717.     }
      718.     return 0;
               ^
      719. }
      720. 

libavformat/aviobuf.c:719:1: return from a call to url_resetbuf
      717.     }
      718.     return 0;
      719. }
           ^
      720. 
      721. int ff_rewind_with_probe_data(ByteIOContext *s, unsigned char *buf, int buf_size)

libavformat/aviobuf.c:57:5: 
    55.     s->opaque = opaque;
    56.     url_resetbuf(s, write_flag ? URL_WRONLY : URL_RDONLY);
    57.     s->write_packet = write_packet;
            ^
    58.     s->read_packet = read_packet;
    59.     s->seek = seek;

libavformat/aviobuf.c:58:5: 
    56.     url_resetbuf(s, write_flag ? URL_WRONLY : URL_RDONLY);
    57.     s->write_packet = write_packet;
    58.     s->read_packet = read_packet;
            ^
    59.     s->seek = seek;
    60.     s->pos = 0;

libavformat/aviobuf.c:59:5: 
    57.     s->write_packet = write_packet;
    58.     s->read_packet = read_packet;
    59.     s->seek = seek;
            ^
    60.     s->pos = 0;
    61.     s->must_flush = 0;

libavformat/aviobuf.c:60:5: 
    58.     s->read_packet = read_packet;
    59.     s->seek = seek;
    60.     s->pos = 0;
            ^
    61.     s->must_flush = 0;
    62.     s->eof_reached = 0;

libavformat/aviobuf.c:61:5: 
    59.     s->seek = seek;
    60.     s->pos = 0;
    61.     s->must_flush = 0;
            ^
    62.     s->eof_reached = 0;
    63.     s->error = 0;

libavformat/aviobuf.c:62:5: 
    60.     s->pos = 0;
    61.     s->must_flush = 0;
    62.     s->eof_reached = 0;
            ^
    63.     s->error = 0;
    64.     s->is_streamed = 0;

libavformat/aviobuf.c:63:5: 
    61.     s->must_flush = 0;
    62.     s->eof_reached = 0;
    63.     s->error = 0;
            ^
    64.     s->is_streamed = 0;
    65.     s->max_packet_size = 0;

libavformat/aviobuf.c:64:5: 
    62.     s->eof_reached = 0;
    63.     s->error = 0;
    64.     s->is_streamed = 0;
            ^
    65.     s->max_packet_size = 0;
    66.     s->update_checksum= NULL;

libavformat/aviobuf.c:65:5: 
    63.     s->error = 0;
    64.     s->is_streamed = 0;
    65.     s->max_packet_size = 0;
            ^
    66.     s->update_checksum= NULL;
    67.     if(!read_packet && !write_flag){

libavformat/aviobuf.c:66:5: 
    64.     s->is_streamed = 0;
    65.     s->max_packet_size = 0;
    66.     s->update_checksum= NULL;
            ^
    67.     if(!read_packet && !write_flag){
    68.         s->pos = buffer_size;

libavformat/aviobuf.c:67:9: Taking false branch
    65.     s->max_packet_size = 0;
    66.     s->update_checksum= NULL;
    67.     if(!read_packet && !write_flag){
                ^
    68.         s->pos = buffer_size;
    69.         s->buf_end = s->buffer + buffer_size;

libavformat/aviobuf.c:71:5: 
    69.         s->buf_end = s->buffer + buffer_size;
    70.     }
    71.     s->read_pause = NULL;
            ^
    72.     s->read_seek  = NULL;
    73.     return 0;

libavformat/aviobuf.c:72:5: 
    70.     }
    71.     s->read_pause = NULL;
    72.     s->read_seek  = NULL;
            ^
    73.     return 0;
    74. }

libavformat/aviobuf.c:73:5: 
    71.     s->read_pause = NULL;
    72.     s->read_seek  = NULL;
    73.     return 0;
            ^
    74. }
    75. 

libavformat/aviobuf.c:74:1: return from a call to init_put_byte
    72.     s->read_seek  = NULL;
    73.     return 0;
    74. }
        ^
    75. 
    76. ByteIOContext *av_alloc_put_byte(

libavformat/rtpdec_asf.c:90:5: 
  88. 
  89.     /* this "fills" the buffer with its current content */
  90.     pb->pos     = len;
          ^
  91.     pb->buf_end = buf + len;
  92. }

libavformat/rtpdec_asf.c:91:5: 
  89.     /* this "fills" the buffer with its current content */
  90.     pb->pos     = len;
  91.     pb->buf_end = buf + len;
          ^
  92. }
  93. 

libavformat/rtpdec_asf.c:92:1: return from a call to init_packetizer
  90.     pb->pos     = len;
  91.     pb->buf_end = buf + len;
  92. }
      ^
  93. 
  94. int ff_wms_parse_sdp_a_line(AVFormatContext *s, const char *p)

libavformat/rtpdec_asf.c:108:13: Taking true branch
106.                    "Failed to fix invalid RTSP-MS/ASF min_pktsize\n");
107.         init_packetizer(&pb, buf, len);
108.         if (rt->asf_ctx) {
                 ^
109.             av_close_input_stream(rt->asf_ctx);
110.             rt->asf_ctx = NULL;

libavformat/rtpdec_asf.c:109:13: Skipping av_close_input_stream(): empty list of specs
107.         init_packetizer(&pb, buf, len);
108.         if (rt->asf_ctx) {
109.             av_close_input_stream(rt->asf_ctx);
                 ^
110.             rt->asf_ctx = NULL;
111.         }

libavformat/rtpdec_asf.c:110:13: 
108.         if (rt->asf_ctx) {
109.             av_close_input_stream(rt->asf_ctx);
110.             rt->asf_ctx = NULL;
                 ^
111.         }
112.         ret = av_open_input_stream(&rt->asf_ctx, &pb, "", &ff_asf_demuxer, NULL);

libavformat/rtpdec_asf.c:112:9: Skipping av_open_input_stream(): empty list of specs
110.             rt->asf_ctx = NULL;
111.         }
112.         ret = av_open_input_stream(&rt->asf_ctx, &pb, "", &ff_asf_demuxer, NULL);
             ^
113.         if (ret < 0)
114.             return ret;

libavformat/rtpdec_asf.c:113:13: Taking false branch
111.         }
112.         ret = av_open_input_stream(&rt->asf_ctx, &pb, "", &ff_asf_demuxer, NULL);
113.         if (ret < 0)
                 ^
114.             return ret;
115.         av_metadata_copy(&s->metadata, rt->asf_ctx->metadata, 0);

libavformat/rtpdec_asf.c:115:9: 
113.         if (ret < 0)
114.             return ret;
115.         av_metadata_copy(&s->metadata, rt->asf_ctx->metadata, 0);
             ^
116.         rt->asf_pb_pos = url_ftell(&pb);
117.         av_free(buf);

int ff_wms_parse_sdp_a_line(AVFormatContext *s, const char *p)
{
    int ret = 0;
    if (av_strstart(p, "pgmpu:data:application/vnd.ms.wms-hdr.asfv1;base64,", &p)) {
        ByteIOContext pb;
        RTSPState *rt = s->priv_data;
        int len = strlen(p) * 6 / 8;
        char *buf = av_mallocz(len);
        av_base64_decode(buf, p, len);
        if (rtp_asf_fix_header(buf, len) < 0)
            av_log(s, AV_LOG_ERROR,
                   "Failed to fix invalid RTSP-MS/ASF min_pktsize\n");
        init_packetizer(&pb, buf, len);
        if (rt->asf_ctx) {
            av_close_input_stream(rt->asf_ctx);
            rt->asf_ctx = NULL;
        }
        ret = av_open_input_stream(&rt->asf_ctx, &pb, "", &ff_asf_demuxer, NULL);
        if (ret < 0)
            return ret;
        av_metadata_copy(&s->metadata, rt->asf_ctx->metadata, 0);
        rt->asf_pb_pos = url_ftell(&pb);
        av_free(buf);
        rt->asf_ctx->pb = NULL;
    }
    return ret;
}
['int ff_wms_parse_sdp_a_line(AVFormatContext *s, const char *p)\n{\n    int ret = 0;\n    if (av_strstart(p, "pgmpu:data:application/vnd.ms.wms-hdr.asfv1;base64,", &p)) {\n        ByteIOContext pb;\n        RTSPState *rt = s->priv_data;\n        int len = strlen(p) * 6 / 8;\n        char *buf = av_mallocz(len);\n        av_base64_decode(buf, p, len);\n        if (rtp_asf_fix_header(buf, len) < 0)\n            av_log(s, AV_LOG_ERROR,\n                   "Failed to fix invalid RTSP-MS/ASF min_pktsize\\n");\n        init_packetizer(&pb, buf, len);\n        if (rt->asf_ctx) {\n            av_close_input_stream(rt->asf_ctx);\n            rt->asf_ctx = NULL;\n        }\n        ret = av_open_input_stream(&rt->asf_ctx, &pb, "", &ff_asf_demuxer, NULL);\n        if (ret < 0)\n            return ret;\n        av_metadata_copy(&s->metadata, rt->asf_ctx->metadata, 0);\n        rt->asf_pb_pos = url_ftell(&pb);\n        av_free(buf);\n        rt->asf_ctx->pb = NULL;\n    }\n    return ret;\n}', 'void *av_mallocz(FF_INTERNAL_MEM_TYPE size)\n{\n    void *ptr = av_malloc(size);\n    if (ptr)\n        memset(ptr, 0, size);\n    return ptr;\n}', 'void *av_malloc(FF_INTERNAL_MEM_TYPE size)\n{\n    void *ptr = NULL;\n#if CONFIG_MEMALIGN_HACK\n    long diff;\n#endif\n    if(size > (INT_MAX-16) )\n        return NULL;\n#if CONFIG_MEMALIGN_HACK\n    ptr = malloc(size+16);\n    if(!ptr)\n        return ptr;\n    diff= ((-(long)ptr - 1)&15) + 1;\n    ptr = (char*)ptr + diff;\n    ((char*)ptr)[-1]= diff;\n#elif HAVE_POSIX_MEMALIGN\n    if (posix_memalign(&ptr,16,size))\n        ptr = NULL;\n#elif HAVE_MEMALIGN\n    ptr = memalign(16,size);\n#else\n    ptr = malloc(size);\n#endif\n    return ptr;\n}', 'static void init_packetizer(ByteIOContext *pb, uint8_t *buf, int len)\n{\n    init_put_byte(pb, buf, len, 0, NULL, packetizer_read, NULL, NULL);\n    pb->pos     = len;\n    pb->buf_end = buf + len;\n}', 'int init_put_byte(ByteIOContext *s,\n                  unsigned char *buffer,\n                  int buffer_size,\n                  int write_flag,\n                  void *opaque,\n                  int (*read_packet)(void *opaque, uint8_t *buf, int buf_size),\n                  int (*write_packet)(void *opaque, uint8_t *buf, int buf_size),\n                  int64_t (*seek)(void *opaque, int64_t offset, int whence))\n{\n    s->buffer = buffer;\n    s->buffer_size = buffer_size;\n    s->buf_ptr = buffer;\n    s->opaque = opaque;\n    url_resetbuf(s, write_flag ? URL_WRONLY : URL_RDONLY);\n    s->write_packet = write_packet;\n    s->read_packet = read_packet;\n    s->seek = seek;\n    s->pos = 0;\n    s->must_flush = 0;\n    s->eof_reached = 0;\n    s->error = 0;\n    s->is_streamed = 0;\n    s->max_packet_size = 0;\n    s->update_checksum= NULL;\n    if(!read_packet && !write_flag){\n        s->pos = buffer_size;\n        s->buf_end = s->buffer + buffer_size;\n    }\n    s->read_pause = NULL;\n    s->read_seek  = NULL;\n    return 0;\n}', 'int url_resetbuf(ByteIOContext *s, int flags)\n#else\nstatic int url_resetbuf(ByteIOContext *s, int flags)\n#endif\n{\n#if FF_API_URL_RESETBUF\n    if (flags & URL_RDWR)\n        return AVERROR(EINVAL);\n#else\n    assert(flags == URL_WRONLY || flags == URL_RDONLY);\n#endif\n    if (flags & URL_WRONLY) {\n        s->buf_end = s->buffer + s->buffer_size;\n        s->write_flag = 1;\n    } else {\n        s->buf_end = s->buffer;\n        s->write_flag = 0;\n    }\n    return 0;\n}']