libavcodec/aac.c:1366: error: Null Dereference
  pointer `&gb->buffer` last assigned on line 1363 could be null and is dereferenced by call to `get_bits()` at line 1366, column 25.

libavcodec/aac.c:1357:1: start of procedure aac_decode_frame()
1355. }
1356. 
1357. static int aac_decode_frame(AVCodecContext * avccontext, void * data, int * data_size, const uint8_t * buf, int buf_size) {
      ^
1358.     AACContext * ac = avccontext->priv_data;
1359.     GetBitContext gb;

libavcodec/aac.c:1358:5: 
1356. 
1357. static int aac_decode_frame(AVCodecContext * avccontext, void * data, int * data_size, const uint8_t * buf, int buf_size) {
1358.     AACContext * ac = avccontext->priv_data;
          ^
1359.     GetBitContext gb;
1360.     enum RawDataBlockType elem_type;

libavcodec/aac.c:1363:5: 
1361.     int err, elem_id, data_size_tmp;
1362. 
1363.     init_get_bits(&gb, buf, buf_size*8);
          ^
1364. 
1365.     // parse

libavcodec/bitstream.h:745:1: start of procedure init_get_bits()
  743.  * @param bit_size the size of the buffer in bits
  744.  */
  745. static inline void init_get_bits(GetBitContext *s,
       ^
  746.                    const uint8_t *buffer, int bit_size)
  747. {

libavcodec/bitstream.h:748:5: 
  746.                    const uint8_t *buffer, int bit_size)
  747. {
  748.     int buffer_size= (bit_size+7)>>3;
           ^
  749.     if(buffer_size < 0 || bit_size < 0) {
  750.         buffer_size = bit_size = 0;

libavcodec/bitstream.h:749:8: Taking true branch
  747. {
  748.     int buffer_size= (bit_size+7)>>3;
  749.     if(buffer_size < 0 || bit_size < 0) {
              ^
  750.         buffer_size = bit_size = 0;
  751.         buffer = NULL;

libavcodec/bitstream.h:750:9: 
  748.     int buffer_size= (bit_size+7)>>3;
  749.     if(buffer_size < 0 || bit_size < 0) {
  750.         buffer_size = bit_size = 0;
               ^
  751.         buffer = NULL;
  752.     }

libavcodec/bitstream.h:751:9: 
  749.     if(buffer_size < 0 || bit_size < 0) {
  750.         buffer_size = bit_size = 0;
  751.         buffer = NULL;
               ^
  752.     }
  753. 

libavcodec/bitstream.h:754:5: 
  752.     }
  753. 
  754.     s->buffer= buffer;
           ^
  755.     s->size_in_bits= bit_size;
  756.     s->buffer_end= buffer + buffer_size;

libavcodec/bitstream.h:755:5: 
  753. 
  754.     s->buffer= buffer;
  755.     s->size_in_bits= bit_size;
           ^
  756.     s->buffer_end= buffer + buffer_size;
  757. #ifdef ALT_BITSTREAM_READER

libavcodec/bitstream.h:756:5: 
  754.     s->buffer= buffer;
  755.     s->size_in_bits= bit_size;
  756.     s->buffer_end= buffer + buffer_size;
           ^
  757. #ifdef ALT_BITSTREAM_READER
  758.     s->index=0;

libavcodec/bitstream.h:758:5: 
  756.     s->buffer_end= buffer + buffer_size;
  757. #ifdef ALT_BITSTREAM_READER
  758.     s->index=0;
           ^
  759. #elif defined LIBMPEG2_BITSTREAM_READER
  760.     s->buffer_ptr = (uint8_t*)((intptr_t)buffer&(~1));

libavcodec/bitstream.h:768:1: return from a call to init_get_bits
  766.     skip_bits_long(s, 0);
  767. #endif
  768. }
       ^
  769. 
  770. static inline void align_get_bits(GetBitContext *s)

libavcodec/aac.c:1366:12: 
1364. 
1365.     // parse
1366.     while ((elem_type = get_bits(&gb, 3)) != TYPE_END) {
                 ^
1367.         elem_id = get_bits(&gb, 4);
1368.         err = -1;

libavcodec/bitstream.h:642:1: start of procedure get_bits()
  640.  * Note, the alt bitstream reader can read up to 25 bits, but the libmpeg2 reader can't
  641.  */
  642. static inline unsigned int get_bits(GetBitContext *s, int n){
       ^
  643.     register int tmp;
  644.     OPEN_READER(re, s)

libavcodec/bitstream.h:644:5: 
  642. static inline unsigned int get_bits(GetBitContext *s, int n){
  643.     register int tmp;
  644.     OPEN_READER(re, s)
           ^
  645.     UPDATE_CACHE(re, s)
  646.     tmp= SHOW_UBITS(re, s, n);

libavcodec/bitstream.h:645:5: 
  643.     register int tmp;
  644.     OPEN_READER(re, s)
  645.     UPDATE_CACHE(re, s)
           ^
  646.     tmp= SHOW_UBITS(re, s, n);
  647.     LAST_SKIP_BITS(re, s, n)

static int aac_decode_frame(AVCodecContext * avccontext, void * data, int * data_size, const uint8_t * buf, int buf_size) {
    AACContext * ac = avccontext->priv_data;
    GetBitContext gb;
    enum RawDataBlockType elem_type;
    int err, elem_id, data_size_tmp;
    init_get_bits(&gb, buf, buf_size*8);
    while ((elem_type = get_bits(&gb, 3)) != TYPE_END) {
        elem_id = get_bits(&gb, 4);
        err = -1;
        if(elem_type == TYPE_SCE && elem_id == 1 &&
                !ac->che[TYPE_SCE][elem_id] && ac->che[TYPE_LFE][0]) {
            ac->che[TYPE_SCE][elem_id] = ac->che[TYPE_LFE][0];
            ac->che[TYPE_LFE][0] = NULL;
        }
        if(elem_type < TYPE_DSE) {
            if(!ac->che[elem_type][elem_id])
                return -1;
            if(elem_type != TYPE_CCE)
                ac->che[elem_type][elem_id]->coup.coupling_point = 4;
        }
        switch (elem_type) {
        case TYPE_SCE:
            err = decode_ics(ac, &ac->che[TYPE_SCE][elem_id]->ch[0], &gb, 0, 0);
            break;
        case TYPE_CPE:
            err = decode_cpe(ac, &gb, elem_id);
            break;
        case TYPE_CCE:
            err = decode_cce(ac, &gb, ac->che[TYPE_CCE][elem_id]);
            break;
        case TYPE_LFE:
            err = decode_ics(ac, &ac->che[TYPE_LFE][elem_id]->ch[0], &gb, 0, 0);
            break;
        case TYPE_DSE:
            skip_data_stream_element(&gb);
            err = 0;
            break;
        case TYPE_PCE:
        {
            enum ChannelPosition new_che_pos[4][MAX_ELEM_ID];
            memset(new_che_pos, 0, 4 * MAX_ELEM_ID * sizeof(new_che_pos[0][0]));
            if((err = decode_pce(ac, new_che_pos, &gb)))
                break;
            err = output_configure(ac, ac->che_pos, new_che_pos);
            break;
        }
        case TYPE_FIL:
            if (elem_id == 15)
                elem_id += get_bits(&gb, 8) - 1;
            while (elem_id > 0)
                elem_id -= decode_extension_payload(ac, &gb, elem_id);
            err = 0;
            break;
        default:
            err = -1;
            break;
        }
        if(err)
            return err;
    }
    spectral_to_sample(ac);
    if (!ac->is_saved) {
        ac->is_saved = 1;
        *data_size = 0;
        return buf_size;
    }
    data_size_tmp = 1024 * avccontext->channels * sizeof(int16_t);
    if(*data_size < data_size_tmp) {
        av_log(avccontext, AV_LOG_ERROR,
               "Output buffer too small (%d) or trying to output too many samples (%d) for this frame.\n",
               *data_size, data_size_tmp);
        return -1;
    }
    *data_size = data_size_tmp;
    ac->dsp.float_to_int16_interleave(data, (const float **)ac->output_data, 1024, avccontext->channels);
    return buf_size;
}
['static int aac_decode_frame(AVCodecContext * avccontext, void * data, int * data_size, const uint8_t * buf, int buf_size) {\n    AACContext * ac = avccontext->priv_data;\n    GetBitContext gb;\n    enum RawDataBlockType elem_type;\n    int err, elem_id, data_size_tmp;\n    init_get_bits(&gb, buf, buf_size*8);\n    while ((elem_type = get_bits(&gb, 3)) != TYPE_END) {\n        elem_id = get_bits(&gb, 4);\n        err = -1;\n        if(elem_type == TYPE_SCE && elem_id == 1 &&\n                !ac->che[TYPE_SCE][elem_id] && ac->che[TYPE_LFE][0]) {\n            ac->che[TYPE_SCE][elem_id] = ac->che[TYPE_LFE][0];\n            ac->che[TYPE_LFE][0] = NULL;\n        }\n        if(elem_type < TYPE_DSE) {\n            if(!ac->che[elem_type][elem_id])\n                return -1;\n            if(elem_type != TYPE_CCE)\n                ac->che[elem_type][elem_id]->coup.coupling_point = 4;\n        }\n        switch (elem_type) {\n        case TYPE_SCE:\n            err = decode_ics(ac, &ac->che[TYPE_SCE][elem_id]->ch[0], &gb, 0, 0);\n            break;\n        case TYPE_CPE:\n            err = decode_cpe(ac, &gb, elem_id);\n            break;\n        case TYPE_CCE:\n            err = decode_cce(ac, &gb, ac->che[TYPE_CCE][elem_id]);\n            break;\n        case TYPE_LFE:\n            err = decode_ics(ac, &ac->che[TYPE_LFE][elem_id]->ch[0], &gb, 0, 0);\n            break;\n        case TYPE_DSE:\n            skip_data_stream_element(&gb);\n            err = 0;\n            break;\n        case TYPE_PCE:\n        {\n            enum ChannelPosition new_che_pos[4][MAX_ELEM_ID];\n            memset(new_che_pos, 0, 4 * MAX_ELEM_ID * sizeof(new_che_pos[0][0]));\n            if((err = decode_pce(ac, new_che_pos, &gb)))\n                break;\n            err = output_configure(ac, ac->che_pos, new_che_pos);\n            break;\n        }\n        case TYPE_FIL:\n            if (elem_id == 15)\n                elem_id += get_bits(&gb, 8) - 1;\n            while (elem_id > 0)\n                elem_id -= decode_extension_payload(ac, &gb, elem_id);\n            err = 0;\n            break;\n        default:\n            err = -1;\n            break;\n        }\n        if(err)\n            return err;\n    }\n    spectral_to_sample(ac);\n    if (!ac->is_saved) {\n        ac->is_saved = 1;\n        *data_size = 0;\n        return buf_size;\n    }\n    data_size_tmp = 1024 * avccontext->channels * sizeof(int16_t);\n    if(*data_size < data_size_tmp) {\n        av_log(avccontext, AV_LOG_ERROR,\n               "Output buffer too small (%d) or trying to output too many samples (%d) for this frame.\\n",\n               *data_size, data_size_tmp);\n        return -1;\n    }\n    *data_size = data_size_tmp;\n    ac->dsp.float_to_int16_interleave(data, (const float **)ac->output_data, 1024, avccontext->channels);\n    return buf_size;\n}', 'static inline void init_get_bits(GetBitContext *s,\n                   const uint8_t *buffer, int bit_size)\n{\n    int buffer_size= (bit_size+7)>>3;\n    if(buffer_size < 0 || bit_size < 0) {\n        buffer_size = bit_size = 0;\n        buffer = NULL;\n    }\n    s->buffer= buffer;\n    s->size_in_bits= bit_size;\n    s->buffer_end= buffer + buffer_size;\n#ifdef ALT_BITSTREAM_READER\n    s->index=0;\n#elif defined LIBMPEG2_BITSTREAM_READER\n    s->buffer_ptr = (uint8_t*)((intptr_t)buffer&(~1));\n    s->bit_count = 16 + 8*((intptr_t)buffer&1);\n    skip_bits_long(s, 0);\n#elif defined A32_BITSTREAM_READER\n    s->buffer_ptr = (uint32_t*)((intptr_t)buffer&(~3));\n    s->bit_count = 32 + 8*((intptr_t)buffer&3);\n    skip_bits_long(s, 0);\n#endif\n}', 'static inline unsigned int get_bits(GetBitContext *s, int n){\n    register int tmp;\n    OPEN_READER(re, s)\n    UPDATE_CACHE(re, s)\n    tmp= SHOW_UBITS(re, s, n);\n    LAST_SKIP_BITS(re, s, n)\n    CLOSE_READER(re, s)\n    return tmp;\n}']