libavcodec/aac.c:1618: error: Null Dereference
  pointer `&gb->buffer` last assigned on line 1616 could be null and is dereferenced by call to `show_bits()` at line 1618, column 9.

libavcodec/aac.c:1607:1: start of procedure aac_decode_frame()
1605. }
1606. 
1607. static int aac_decode_frame(AVCodecContext * avccontext, void * data, int * data_size, AVPacket *avpkt) {
      ^
1608.     const uint8_t *buf = avpkt->data;
1609.     int buf_size = avpkt->size;

libavcodec/aac.c:1608:5: 
1606. 
1607. static int aac_decode_frame(AVCodecContext * avccontext, void * data, int * data_size, AVPacket *avpkt) {
1608.     const uint8_t *buf = avpkt->data;
          ^
1609.     int buf_size = avpkt->size;
1610.     AACContext * ac = avccontext->priv_data;

libavcodec/aac.c:1609:5: 
1607. static int aac_decode_frame(AVCodecContext * avccontext, void * data, int * data_size, AVPacket *avpkt) {
1608.     const uint8_t *buf = avpkt->data;
1609.     int buf_size = avpkt->size;
          ^
1610.     AACContext * ac = avccontext->priv_data;
1611.     ChannelElement * che = NULL;

libavcodec/aac.c:1610:5: 
1608.     const uint8_t *buf = avpkt->data;
1609.     int buf_size = avpkt->size;
1610.     AACContext * ac = avccontext->priv_data;
          ^
1611.     ChannelElement * che = NULL;
1612.     GetBitContext gb;

libavcodec/aac.c:1611:5: 
1609.     int buf_size = avpkt->size;
1610.     AACContext * ac = avccontext->priv_data;
1611.     ChannelElement * che = NULL;
          ^
1612.     GetBitContext gb;
1613.     enum RawDataBlockType elem_type;

libavcodec/aac.c:1616:5: 
1614.     int err, elem_id, data_size_tmp;
1615. 
1616.     init_get_bits(&gb, buf, buf_size*8);
          ^
1617. 
1618.     if (show_bits(&gb, 12) == 0xfff) {

libavcodec/get_bits.h:493:1: start of procedure init_get_bits()
  491.  * @param bit_size the size of the buffer in bits
  492.  */
  493. static inline void init_get_bits(GetBitContext *s,
       ^
  494.                    const uint8_t *buffer, int bit_size)
  495. {

libavcodec/get_bits.h:496:5: 
  494.                    const uint8_t *buffer, int bit_size)
  495. {
  496.     int buffer_size= (bit_size+7)>>3;
           ^
  497.     if(buffer_size < 0 || bit_size < 0) {
  498.         buffer_size = bit_size = 0;

libavcodec/get_bits.h:497:8: Taking true branch
  495. {
  496.     int buffer_size= (bit_size+7)>>3;
  497.     if(buffer_size < 0 || bit_size < 0) {
              ^
  498.         buffer_size = bit_size = 0;
  499.         buffer = NULL;

libavcodec/get_bits.h:498:9: 
  496.     int buffer_size= (bit_size+7)>>3;
  497.     if(buffer_size < 0 || bit_size < 0) {
  498.         buffer_size = bit_size = 0;
               ^
  499.         buffer = NULL;
  500.     }

libavcodec/get_bits.h:499:9: 
  497.     if(buffer_size < 0 || bit_size < 0) {
  498.         buffer_size = bit_size = 0;
  499.         buffer = NULL;
               ^
  500.     }
  501. 

libavcodec/get_bits.h:502:5: 
  500.     }
  501. 
  502.     s->buffer= buffer;
           ^
  503.     s->size_in_bits= bit_size;
  504.     s->buffer_end= buffer + buffer_size;

libavcodec/get_bits.h:503:5: 
  501. 
  502.     s->buffer= buffer;
  503.     s->size_in_bits= bit_size;
           ^
  504.     s->buffer_end= buffer + buffer_size;
  505. #ifdef ALT_BITSTREAM_READER

libavcodec/get_bits.h:504:5: 
  502.     s->buffer= buffer;
  503.     s->size_in_bits= bit_size;
  504.     s->buffer_end= buffer + buffer_size;
           ^
  505. #ifdef ALT_BITSTREAM_READER
  506.     s->index=0;

libavcodec/get_bits.h:506:5: 
  504.     s->buffer_end= buffer + buffer_size;
  505. #ifdef ALT_BITSTREAM_READER
  506.     s->index=0;
           ^
  507. #elif defined LIBMPEG2_BITSTREAM_READER
  508.     s->buffer_ptr = (uint8_t*)((intptr_t)buffer&(~1));

libavcodec/get_bits.h:516:1: return from a call to init_get_bits
  514.     skip_bits_long(s, 0);
  515. #endif
  516. }
       ^
  517. 
  518. static inline void align_get_bits(GetBitContext *s)

libavcodec/aac.c:1618:9: 
1616.     init_get_bits(&gb, buf, buf_size*8);
1617. 
1618.     if (show_bits(&gb, 12) == 0xfff) {
              ^
1619.         if ((err = parse_adts_frame_header(ac, &gb)) < 0) {
1620.             av_log(avccontext, AV_LOG_ERROR, "Error decoding AAC frame header.\n");

libavcodec/get_bits.h:399:1: start of procedure show_bits()
  397.  * Note, the alt bitstream reader can read up to 25 bits, but the libmpeg2 reader can't
  398.  */
  399. static inline unsigned int show_bits(GetBitContext *s, int n){
       ^
  400.     register int tmp;
  401.     OPEN_READER(re, s)

libavcodec/get_bits.h:401:5: 
  399. static inline unsigned int show_bits(GetBitContext *s, int n){
  400.     register int tmp;
  401.     OPEN_READER(re, s)
           ^
  402.     UPDATE_CACHE(re, s)
  403.     tmp= SHOW_UBITS(re, s, n);

libavcodec/get_bits.h:402:5: 
  400.     register int tmp;
  401.     OPEN_READER(re, s)
  402.     UPDATE_CACHE(re, s)
           ^
  403.     tmp= SHOW_UBITS(re, s, n);
  404. //    CLOSE_READER(re, s)

static int aac_decode_frame(AVCodecContext * avccontext, void * data, int * data_size, AVPacket *avpkt) {
    const uint8_t *buf = avpkt->data;
    int buf_size = avpkt->size;
    AACContext * ac = avccontext->priv_data;
    ChannelElement * che = NULL;
    GetBitContext gb;
    enum RawDataBlockType elem_type;
    int err, elem_id, data_size_tmp;
    init_get_bits(&gb, buf, buf_size*8);
    if (show_bits(&gb, 12) == 0xfff) {
        if ((err = parse_adts_frame_header(ac, &gb)) < 0) {
            av_log(avccontext, AV_LOG_ERROR, "Error decoding AAC frame header.\n");
            return -1;
        }
        if (ac->m4ac.sampling_index > 12) {
            av_log(ac->avccontext, AV_LOG_ERROR, "invalid sampling rate index %d\n", ac->m4ac.sampling_index);
            return -1;
        }
    }
    while ((elem_type = get_bits(&gb, 3)) != TYPE_END) {
        elem_id = get_bits(&gb, 4);
        err = -1;
        if(elem_type < TYPE_DSE && !(che=get_che(ac, elem_type, elem_id))) {
            av_log(ac->avccontext, AV_LOG_ERROR, "channel element %d.%d is not allocated\n", elem_type, elem_id);
            return -1;
        }
        switch (elem_type) {
        case TYPE_SCE:
            err = decode_ics(ac, &che->ch[0], &gb, 0, 0);
            break;
        case TYPE_CPE:
            err = decode_cpe(ac, &gb, che);
            break;
        case TYPE_CCE:
            err = decode_cce(ac, &gb, che);
            break;
        case TYPE_LFE:
            err = decode_ics(ac, &che->ch[0], &gb, 0, 0);
            break;
        case TYPE_DSE:
            skip_data_stream_element(&gb);
            err = 0;
            break;
        case TYPE_PCE:
        {
            enum ChannelPosition new_che_pos[4][MAX_ELEM_ID];
            memset(new_che_pos, 0, 4 * MAX_ELEM_ID * sizeof(new_che_pos[0][0]));
            if((err = decode_pce(ac, new_che_pos, &gb)))
                break;
            err = output_configure(ac, ac->che_pos, new_che_pos, 0);
            break;
        }
        case TYPE_FIL:
            if (elem_id == 15)
                elem_id += get_bits(&gb, 8) - 1;
            while (elem_id > 0)
                elem_id -= decode_extension_payload(ac, &gb, elem_id);
            err = 0;
            break;
        default:
            err = -1;
            break;
        }
        if(err)
            return err;
    }
    spectral_to_sample(ac);
    if (!ac->is_saved) {
        ac->is_saved = 1;
        *data_size = 0;
        return buf_size;
    }
    data_size_tmp = 1024 * avccontext->channels * sizeof(int16_t);
    if(*data_size < data_size_tmp) {
        av_log(avccontext, AV_LOG_ERROR,
               "Output buffer too small (%d) or trying to output too many samples (%d) for this frame.\n",
               *data_size, data_size_tmp);
        return -1;
    }
    *data_size = data_size_tmp;
    ac->dsp.float_to_int16_interleave(data, (const float **)ac->output_data, 1024, avccontext->channels);
    return buf_size;
}
['static int aac_decode_frame(AVCodecContext * avccontext, void * data, int * data_size, AVPacket *avpkt) {\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    AACContext * ac = avccontext->priv_data;\n    ChannelElement * che = NULL;\n    GetBitContext gb;\n    enum RawDataBlockType elem_type;\n    int err, elem_id, data_size_tmp;\n    init_get_bits(&gb, buf, buf_size*8);\n    if (show_bits(&gb, 12) == 0xfff) {\n        if ((err = parse_adts_frame_header(ac, &gb)) < 0) {\n            av_log(avccontext, AV_LOG_ERROR, "Error decoding AAC frame header.\\n");\n            return -1;\n        }\n        if (ac->m4ac.sampling_index > 12) {\n            av_log(ac->avccontext, AV_LOG_ERROR, "invalid sampling rate index %d\\n", ac->m4ac.sampling_index);\n            return -1;\n        }\n    }\n    while ((elem_type = get_bits(&gb, 3)) != TYPE_END) {\n        elem_id = get_bits(&gb, 4);\n        err = -1;\n        if(elem_type < TYPE_DSE && !(che=get_che(ac, elem_type, elem_id))) {\n            av_log(ac->avccontext, AV_LOG_ERROR, "channel element %d.%d is not allocated\\n", elem_type, elem_id);\n            return -1;\n        }\n        switch (elem_type) {\n        case TYPE_SCE:\n            err = decode_ics(ac, &che->ch[0], &gb, 0, 0);\n            break;\n        case TYPE_CPE:\n            err = decode_cpe(ac, &gb, che);\n            break;\n        case TYPE_CCE:\n            err = decode_cce(ac, &gb, che);\n            break;\n        case TYPE_LFE:\n            err = decode_ics(ac, &che->ch[0], &gb, 0, 0);\n            break;\n        case TYPE_DSE:\n            skip_data_stream_element(&gb);\n            err = 0;\n            break;\n        case TYPE_PCE:\n        {\n            enum ChannelPosition new_che_pos[4][MAX_ELEM_ID];\n            memset(new_che_pos, 0, 4 * MAX_ELEM_ID * sizeof(new_che_pos[0][0]));\n            if((err = decode_pce(ac, new_che_pos, &gb)))\n                break;\n            err = output_configure(ac, ac->che_pos, new_che_pos, 0);\n            break;\n        }\n        case TYPE_FIL:\n            if (elem_id == 15)\n                elem_id += get_bits(&gb, 8) - 1;\n            while (elem_id > 0)\n                elem_id -= decode_extension_payload(ac, &gb, elem_id);\n            err = 0;\n            break;\n        default:\n            err = -1;\n            break;\n        }\n        if(err)\n            return err;\n    }\n    spectral_to_sample(ac);\n    if (!ac->is_saved) {\n        ac->is_saved = 1;\n        *data_size = 0;\n        return buf_size;\n    }\n    data_size_tmp = 1024 * avccontext->channels * sizeof(int16_t);\n    if(*data_size < data_size_tmp) {\n        av_log(avccontext, AV_LOG_ERROR,\n               "Output buffer too small (%d) or trying to output too many samples (%d) for this frame.\\n",\n               *data_size, data_size_tmp);\n        return -1;\n    }\n    *data_size = data_size_tmp;\n    ac->dsp.float_to_int16_interleave(data, (const float **)ac->output_data, 1024, avccontext->channels);\n    return buf_size;\n}', 'static inline void init_get_bits(GetBitContext *s,\n                   const uint8_t *buffer, int bit_size)\n{\n    int buffer_size= (bit_size+7)>>3;\n    if(buffer_size < 0 || bit_size < 0) {\n        buffer_size = bit_size = 0;\n        buffer = NULL;\n    }\n    s->buffer= buffer;\n    s->size_in_bits= bit_size;\n    s->buffer_end= buffer + buffer_size;\n#ifdef ALT_BITSTREAM_READER\n    s->index=0;\n#elif defined LIBMPEG2_BITSTREAM_READER\n    s->buffer_ptr = (uint8_t*)((intptr_t)buffer&(~1));\n    s->bit_count = 16 + 8*((intptr_t)buffer&1);\n    skip_bits_long(s, 0);\n#elif defined A32_BITSTREAM_READER\n    s->buffer_ptr = (uint32_t*)((intptr_t)buffer&(~3));\n    s->bit_count = 32 + 8*((intptr_t)buffer&3);\n    skip_bits_long(s, 0);\n#endif\n}', 'static inline unsigned int show_bits(GetBitContext *s, int n){\n    register int tmp;\n    OPEN_READER(re, s)\n    UPDATE_CACHE(re, s)\n    tmp= SHOW_UBITS(re, s, n);\n    return tmp;\n}']