libavcodec/xan.c:115: error: Null Dereference
  pointer `&gb->buffer` last assigned on line 112 could be null and is dereferenced by call to `get_bits1()` at line 115, column 37.

libavcodec/xan.c:98:1: start of procedure xan_huffman_decode()
 96. }
 97. 
 98. static int xan_huffman_decode(unsigned char *dest, int dest_len,
     ^
 99.                               const unsigned char *src, int src_len)
100. {

libavcodec/xan.c:101:5: 
 99.                               const unsigned char *src, int src_len)
100. {
101.     unsigned char byte = *src++;
         ^
102.     unsigned char ival = byte + 0x16;
103.     const unsigned char * ptr = src + byte*2;

libavcodec/xan.c:102:5: 
100. {
101.     unsigned char byte = *src++;
102.     unsigned char ival = byte + 0x16;
         ^
103.     const unsigned char * ptr = src + byte*2;
104.     int ptr_len = src_len - 1 - byte*2;

libavcodec/xan.c:103:5: 
101.     unsigned char byte = *src++;
102.     unsigned char ival = byte + 0x16;
103.     const unsigned char * ptr = src + byte*2;
         ^
104.     int ptr_len = src_len - 1 - byte*2;
105.     unsigned char val = ival;

libavcodec/xan.c:104:5: 
102.     unsigned char ival = byte + 0x16;
103.     const unsigned char * ptr = src + byte*2;
104.     int ptr_len = src_len - 1 - byte*2;
         ^
105.     unsigned char val = ival;
106.     unsigned char *dest_end = dest + dest_len;

libavcodec/xan.c:105:5: 
103.     const unsigned char * ptr = src + byte*2;
104.     int ptr_len = src_len - 1 - byte*2;
105.     unsigned char val = ival;
         ^
106.     unsigned char *dest_end = dest + dest_len;
107.     GetBitContext gb;

libavcodec/xan.c:106:5: 
104.     int ptr_len = src_len - 1 - byte*2;
105.     unsigned char val = ival;
106.     unsigned char *dest_end = dest + dest_len;
         ^
107.     GetBitContext gb;
108. 

libavcodec/xan.c:109:9: Taking false branch
107.     GetBitContext gb;
108. 
109.     if (ptr_len < 0)
             ^
110.         return AVERROR_INVALIDDATA;
111. 

libavcodec/xan.c:112:5: 
110.         return AVERROR_INVALIDDATA;
111. 
112.     init_get_bits(&gb, ptr, ptr_len * 8);
         ^
113. 
114.     while (val != 0x16) {

libavcodec/get_bits.h:372:1: start of procedure init_get_bits()
  370.  * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
  371.  */
  372. static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
       ^
  373.                                 int bit_size)
  374. {

libavcodec/get_bits.h:376:5: 
  374. {
  375.     int buffer_size;
  376.     int ret = 0;
           ^
  377. 
  378.     if (bit_size > INT_MAX - 7 || bit_size <= 0) {

libavcodec/get_bits.h:378:9: Taking true branch
  376.     int ret = 0;
  377. 
  378.     if (bit_size > INT_MAX - 7 || bit_size <= 0) {
               ^
  379.         buffer_size = bit_size = 0;
  380.         buffer = NULL;

libavcodec/get_bits.h:379:9: 
  377. 
  378.     if (bit_size > INT_MAX - 7 || bit_size <= 0) {
  379.         buffer_size = bit_size = 0;
               ^
  380.         buffer = NULL;
  381.         ret = AVERROR_INVALIDDATA;

libavcodec/get_bits.h:380:9: 
  378.     if (bit_size > INT_MAX - 7 || bit_size <= 0) {
  379.         buffer_size = bit_size = 0;
  380.         buffer = NULL;
               ^
  381.         ret = AVERROR_INVALIDDATA;
  382.     }

libavcodec/get_bits.h:381:9: 
  379.         buffer_size = bit_size = 0;
  380.         buffer = NULL;
  381.         ret = AVERROR_INVALIDDATA;
               ^
  382.     }
  383. 

libavcodec/get_bits.h:384:5: 
  382.     }
  383. 
  384.     buffer_size = (bit_size + 7) >> 3;
           ^
  385. 
  386.     s->buffer       = buffer;

libavcodec/get_bits.h:386:5: 
  384.     buffer_size = (bit_size + 7) >> 3;
  385. 
  386.     s->buffer       = buffer;
           ^
  387.     s->size_in_bits = bit_size;
  388. #if !UNCHECKED_BITSTREAM_READER

libavcodec/get_bits.h:387:5: 
  385. 
  386.     s->buffer       = buffer;
  387.     s->size_in_bits = bit_size;
           ^
  388. #if !UNCHECKED_BITSTREAM_READER
  389.     s->size_in_bits_plus8 = bit_size + 8;

libavcodec/get_bits.h:389:5: 
  387.     s->size_in_bits = bit_size;
  388. #if !UNCHECKED_BITSTREAM_READER
  389.     s->size_in_bits_plus8 = bit_size + 8;
           ^
  390. #endif
  391.     s->buffer_end   = buffer + buffer_size;

libavcodec/get_bits.h:391:5: 
  389.     s->size_in_bits_plus8 = bit_size + 8;
  390. #endif
  391.     s->buffer_end   = buffer + buffer_size;
           ^
  392.     s->index        = 0;
  393.     return ret;

libavcodec/get_bits.h:392:5: 
  390. #endif
  391.     s->buffer_end   = buffer + buffer_size;
  392.     s->index        = 0;
           ^
  393.     return ret;
  394. }

libavcodec/get_bits.h:393:5: 
  391.     s->buffer_end   = buffer + buffer_size;
  392.     s->index        = 0;
  393.     return ret;
           ^
  394. }
  395. 

libavcodec/get_bits.h:394:1: return from a call to init_get_bits
  392.     s->index        = 0;
  393.     return ret;
  394. }
       ^
  395. 
  396. /**

libavcodec/xan.c:114:12: Loop condition is true. Entering loop body
112.     init_get_bits(&gb, ptr, ptr_len * 8);
113. 
114.     while (val != 0x16) {
                ^
115.         unsigned idx = val - 0x17 + get_bits1(&gb) * byte;
116.         if (idx >= 2 * byte)

libavcodec/xan.c:115:9: 
113. 
114.     while (val != 0x16) {
115.         unsigned idx = val - 0x17 + get_bits1(&gb) * byte;
             ^
116.         if (idx >= 2 * byte)
117.             return AVERROR_INVALIDDATA;

libavcodec/get_bits.h:268:1: start of procedure get_bits1()
  266. }
  267. 
  268. static inline unsigned int get_bits1(GetBitContext *s)
       ^
  269. {
  270.     unsigned int index = s->index;

libavcodec/get_bits.h:270:5: 
  268. static inline unsigned int get_bits1(GetBitContext *s)
  269. {
  270.     unsigned int index = s->index;
           ^
  271.     uint8_t result = s->buffer[index>>3];
  272. #ifdef BITSTREAM_READER_LE

libavcodec/get_bits.h:271:5: 
  269. {
  270.     unsigned int index = s->index;
  271.     uint8_t result = s->buffer[index>>3];
           ^
  272. #ifdef BITSTREAM_READER_LE
  273.     result >>= index & 7;

static int xan_huffman_decode(unsigned char *dest, int dest_len,
                              const unsigned char *src, int src_len)
{
    unsigned char byte = *src++;
    unsigned char ival = byte + 0x16;
    const unsigned char * ptr = src + byte*2;
    int ptr_len = src_len - 1 - byte*2;
    unsigned char val = ival;
    unsigned char *dest_end = dest + dest_len;
    GetBitContext gb;
    if (ptr_len < 0)
        return AVERROR_INVALIDDATA;
    init_get_bits(&gb, ptr, ptr_len * 8);
    while (val != 0x16) {
        unsigned idx = val - 0x17 + get_bits1(&gb) * byte;
        if (idx >= 2 * byte)
            return AVERROR_INVALIDDATA;
        val = src[idx];
        if (val < 0x16) {
            if (dest >= dest_end)
                return 0;
            *dest++ = val;
            val = ival;
        }
    }
    return 0;
}
['static int xan_huffman_decode(unsigned char *dest, int dest_len,\n                              const unsigned char *src, int src_len)\n{\n    unsigned char byte = *src++;\n    unsigned char ival = byte + 0x16;\n    const unsigned char * ptr = src + byte*2;\n    int ptr_len = src_len - 1 - byte*2;\n    unsigned char val = ival;\n    unsigned char *dest_end = dest + dest_len;\n    GetBitContext gb;\n    if (ptr_len < 0)\n        return AVERROR_INVALIDDATA;\n    init_get_bits(&gb, ptr, ptr_len * 8);\n    while (val != 0x16) {\n        unsigned idx = val - 0x17 + get_bits1(&gb) * byte;\n        if (idx >= 2 * byte)\n            return AVERROR_INVALIDDATA;\n        val = src[idx];\n        if (val < 0x16) {\n            if (dest >= dest_end)\n                return 0;\n            *dest++ = val;\n            val = ival;\n        }\n    }\n    return 0;\n}', 'static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,\n                                int bit_size)\n{\n    int buffer_size;\n    int ret = 0;\n    if (bit_size > INT_MAX - 7 || bit_size <= 0) {\n        buffer_size = bit_size = 0;\n        buffer = NULL;\n        ret = AVERROR_INVALIDDATA;\n    }\n    buffer_size = (bit_size + 7) >> 3;\n    s->buffer       = buffer;\n    s->size_in_bits = bit_size;\n#if !UNCHECKED_BITSTREAM_READER\n    s->size_in_bits_plus8 = bit_size + 8;\n#endif\n    s->buffer_end   = buffer + buffer_size;\n    s->index        = 0;\n    return ret;\n}', 'static inline unsigned int get_bits1(GetBitContext *s)\n{\n    unsigned int index = s->index;\n    uint8_t result = s->buffer[index>>3];\n#ifdef BITSTREAM_READER_LE\n    result >>= index & 7;\n    result &= 1;\n#else\n    result <<= index & 7;\n    result >>= 8 - 1;\n#endif\n#if !UNCHECKED_BITSTREAM_READER\n    if (s->index < s->size_in_bits_plus8)\n#endif\n        index++;\n    s->index = index;\n    return result;\n}']