libavcodec/eval.c:200: error: Null Dereference
  pointer `d` last assigned on line 195 could be null and is dereferenced at line 200, column 5.

libavcodec/eval.c:194:1: start of procedure parse_primary()
192. }
193. 
194. static AVEvalExpr * parse_primary(Parser *p) {
     ^
195.     AVEvalExpr * d = av_mallocz(sizeof(AVEvalExpr));
196.     char *next= p->s;

libavcodec/eval.c:195:5: 
193. 
194. static AVEvalExpr * parse_primary(Parser *p) {
195.     AVEvalExpr * d = av_mallocz(sizeof(AVEvalExpr));
         ^
196.     char *next= p->s;
197.     int i;

libavutil/mem.c:132:1: start of procedure av_mallocz()
  130. }
  131. 
  132. void *av_mallocz(unsigned int size)
       ^
  133. {
  134.     void *ptr = av_malloc(size);

libavutil/mem.c:134:5: 
  132. void *av_mallocz(unsigned int size)
  133. {
  134.     void *ptr = av_malloc(size);
           ^
  135.     if (ptr)
  136.         memset(ptr, 0, size);

libavutil/mem.c:42:1: start of procedure av_malloc()
    40.    linker will do it automatically */
    41. 
    42. void *av_malloc(unsigned int size)
        ^
    43. {
    44.     void *ptr;

libavutil/mem.c:50:8: Taking false branch
    48. 
    49.     /* let's disallow possible ambiguous cases */
    50.     if(size > (INT_MAX-16) )
               ^
    51.         return NULL;
    52. 

libavutil/mem.c:61:5: Skipping memalign(): method has no implementation
    59.     ((char*)ptr)[-1]= diff;
    60. #elif defined (HAVE_MEMALIGN)
    61.     ptr = memalign(16,size);
            ^
    62.     /* Why 64?
    63.        Indeed, we should align it:

libavutil/mem.c:91:5: 
    89.     ptr = malloc(size);
    90. #endif
    91.     return ptr;
            ^
    92. }
    93. 

libavutil/mem.c:92:1: return from a call to av_malloc
    90. #endif
    91.     return ptr;
    92. }
        ^
    93. 
    94. void *av_realloc(void *ptr, unsigned int size)

libavutil/mem.c:135:9: Taking false branch
  133. {
  134.     void *ptr = av_malloc(size);
  135.     if (ptr)
               ^
  136.         memset(ptr, 0, size);
  137.     return ptr;

libavutil/mem.c:137:5: 
  135.     if (ptr)
  136.         memset(ptr, 0, size);
  137.     return ptr;
           ^
  138. }
  139. 

libavutil/mem.c:138:1: return from a call to av_mallocz
  136.         memset(ptr, 0, size);
  137.     return ptr;
  138. }
       ^
  139. 
  140. char *av_strdup(const char *s)

libavcodec/eval.c:196:5: 
194. static AVEvalExpr * parse_primary(Parser *p) {
195.     AVEvalExpr * d = av_mallocz(sizeof(AVEvalExpr));
196.     char *next= p->s;
         ^
197.     int i;
198. 

libavcodec/eval.c:200:5: 
198. 
199.     /* number */
200.     d->value = av_strtod(p->s, &next);
         ^
201.     if(next != p->s){
202.         d->type = e_value;

libavcodec/eval.c:89:1: start of procedure av_strtod()
  87.  * function assumes that the unit of numbers is bits not bytes.
  88.  */
  89. static double av_strtod(const char *name, char **tail) {
      ^
  90.     double d;
  91.     char *next;

libavcodec/eval.c:92:5: 
  90.     double d;
  91.     char *next;
  92.     d = strtod(name, &next);
          ^
  93.     /* if parsing succeeded, check for and interpret postfixes */
  94.     if (next!=name) {

libavcodec/eval.c:94:9: Taking true branch
  92.     d = strtod(name, &next);
  93.     /* if parsing succeeded, check for and interpret postfixes */
  94.     if (next!=name) {
              ^
  95. 
  96.         if(*next >= 'E' && *next <= 'z'){

libavcodec/eval.c:96:12: Taking true branch
  94.     if (next!=name) {
  95. 
  96.         if(*next >= 'E' && *next <= 'z'){
                 ^
  97.             int e= si_prefixes[*next - 'E'];
  98.             if(e){

libavcodec/eval.c:96:28: Taking true branch
  94.     if (next!=name) {
  95. 
  96.         if(*next >= 'E' && *next <= 'z'){
                                 ^
  97.             int e= si_prefixes[*next - 'E'];
  98.             if(e){

libavcodec/eval.c:97:13: 
  95. 
  96.         if(*next >= 'E' && *next <= 'z'){
  97.             int e= si_prefixes[*next - 'E'];
                  ^
  98.             if(e){
  99.                 if(next[1] == 'i'){

libavcodec/eval.c:98:16: Taking true branch
   96.         if(*next >= 'E' && *next <= 'z'){
   97.             int e= si_prefixes[*next - 'E'];
   98.             if(e){
                      ^
   99.                 if(next[1] == 'i'){
  100.                     d*= pow( 2, e/0.3);

libavcodec/eval.c:99:20: Taking true branch
   97.             int e= si_prefixes[*next - 'E'];
   98.             if(e){
   99.                 if(next[1] == 'i'){
                          ^
  100.                     d*= pow( 2, e/0.3);
  101.                     next+=2;

libavcodec/eval.c:100:21: 
   98.             if(e){
   99.                 if(next[1] == 'i'){
  100.                     d*= pow( 2, e/0.3);
                           ^
  101.                     next+=2;
  102.                 }else{

libavcodec/eval.c:101:21: 
   99.                 if(next[1] == 'i'){
  100.                     d*= pow( 2, e/0.3);
  101.                     next+=2;
                           ^
  102.                 }else{
  103.                     d*= pow(10, e);

libavcodec/eval.c:109:12: Taking false branch
  107.         }
  108. 
  109.         if(*next=='B') {
                  ^
  110.             d*=8;
  111.             next++;

libavcodec/eval.c:116:9: Taking true branch
  114.     /* if requested, fill in tail with the position after the last parsed
  115.        character */
  116.     if (tail)
               ^
  117.         *tail = next;
  118.     return d;

libavcodec/eval.c:117:9: 
  115.        character */
  116.     if (tail)
  117.         *tail = next;
               ^
  118.     return d;
  119. }

libavcodec/eval.c:118:5: 
  116.     if (tail)
  117.         *tail = next;
  118.     return d;
           ^
  119. }
  120. 

libavcodec/eval.c:119:1: return from a call to av_strtod
  117.         *tail = next;
  118.     return d;
  119. }
       ^
  120. 
  121. static int strmatch(const char *s, const char *prefix){

static AVEvalExpr * parse_primary(Parser *p) {
    AVEvalExpr * d = av_mallocz(sizeof(AVEvalExpr));
    char *next= p->s;
    int i;
    d->value = av_strtod(p->s, &next);
    if(next != p->s){
        d->type = e_value;
        p->s= next;
        return d;
    }
    d->value = 1;
    for(i=0; p->const_name && p->const_name[i]; i++){
        if(strmatch(p->s, p->const_name[i])){
            p->s+= strlen(p->const_name[i]);
            d->type = e_const;
            d->a.const_index = i;
            return d;
        }
    }
    p->s= strchr(p->s, '(');
    if(p->s==NULL){
        *p->error = "missing (";
        p->s= next;
        ff_eval_free(d);
        return NULL;
    }
    p->s++;
    if (*next == '(') {
        av_freep(&d);
        d = parse_expr(p);
        if(p->s[0] != ')'){
            *p->error = "missing )";
            ff_eval_free(d);
            return NULL;
        }
        p->s++;
        return d;
    }
    d->param[0] = parse_expr(p);
    if(p->s[0]== ','){
        p->s++;
        d->param[1] = parse_expr(p);
    }
    if(p->s[0] != ')'){
        *p->error = "missing )";
        ff_eval_free(d);
        return NULL;
    }
    p->s++;
    d->type = e_func0;
         if( strmatch(next, "sinh"  ) ) d->a.func0 = sinh;
    else if( strmatch(next, "cosh"  ) ) d->a.func0 = cosh;
    else if( strmatch(next, "tanh"  ) ) d->a.func0 = tanh;
    else if( strmatch(next, "sin"   ) ) d->a.func0 = sin;
    else if( strmatch(next, "cos"   ) ) d->a.func0 = cos;
    else if( strmatch(next, "tan"   ) ) d->a.func0 = tan;
    else if( strmatch(next, "atan"  ) ) d->a.func0 = atan;
    else if( strmatch(next, "asin"  ) ) d->a.func0 = asin;
    else if( strmatch(next, "acos"  ) ) d->a.func0 = acos;
    else if( strmatch(next, "exp"   ) ) d->a.func0 = exp;
    else if( strmatch(next, "log"   ) ) d->a.func0 = log;
    else if( strmatch(next, "abs"   ) ) d->a.func0 = fabs;
    else if( strmatch(next, "squish") ) d->type = e_squish;
    else if( strmatch(next, "gauss" ) ) d->type = e_gauss;
    else if( strmatch(next, "mod"   ) ) d->type = e_mod;
    else if( strmatch(next, "max"   ) ) d->type = e_max;
    else if( strmatch(next, "min"   ) ) d->type = e_min;
    else if( strmatch(next, "eq"    ) ) d->type = e_eq;
    else if( strmatch(next, "gte"   ) ) d->type = e_gte;
    else if( strmatch(next, "gt"    ) ) d->type = e_gt;
    else if( strmatch(next, "lte"   ) ) { AVEvalExpr * tmp = d->param[1]; d->param[1] = d->param[0]; d->param[0] = tmp; d->type = e_gt; }
    else if( strmatch(next, "lt"    ) ) { AVEvalExpr * tmp = d->param[1]; d->param[1] = d->param[0]; d->param[0] = tmp; d->type = e_gte; }
    else if( strmatch(next, "ld"    ) ) d->type = e_ld;
    else if( strmatch(next, "st"    ) ) d->type = e_st;
    else if( strmatch(next, "while" ) ) d->type = e_while;
    else {
        for(i=0; p->func1_name && p->func1_name[i]; i++){
            if(strmatch(next, p->func1_name[i])){
                d->a.func1 = p->func1[i];
                d->type = e_func1;
                return d;
            }
        }
        for(i=0; p->func2_name && p->func2_name[i]; i++){
            if(strmatch(next, p->func2_name[i])){
                d->a.func2 = p->func2[i];
                d->type = e_func2;
                return d;
            }
        }
        *p->error = "unknown function";
        ff_eval_free(d);
        return NULL;
    }
    return d;
}
['static AVEvalExpr * parse_primary(Parser *p) {\n    AVEvalExpr * d = av_mallocz(sizeof(AVEvalExpr));\n    char *next= p->s;\n    int i;\n    d->value = av_strtod(p->s, &next);\n    if(next != p->s){\n        d->type = e_value;\n        p->s= next;\n        return d;\n    }\n    d->value = 1;\n    for(i=0; p->const_name && p->const_name[i]; i++){\n        if(strmatch(p->s, p->const_name[i])){\n            p->s+= strlen(p->const_name[i]);\n            d->type = e_const;\n            d->a.const_index = i;\n            return d;\n        }\n    }\n    p->s= strchr(p->s, \'(\');\n    if(p->s==NULL){\n        *p->error = "missing (";\n        p->s= next;\n        ff_eval_free(d);\n        return NULL;\n    }\n    p->s++;\n    if (*next == \'(\') {\n        av_freep(&d);\n        d = parse_expr(p);\n        if(p->s[0] != \')\'){\n            *p->error = "missing )";\n            ff_eval_free(d);\n            return NULL;\n        }\n        p->s++;\n        return d;\n    }\n    d->param[0] = parse_expr(p);\n    if(p->s[0]== \',\'){\n        p->s++;\n        d->param[1] = parse_expr(p);\n    }\n    if(p->s[0] != \')\'){\n        *p->error = "missing )";\n        ff_eval_free(d);\n        return NULL;\n    }\n    p->s++;\n    d->type = e_func0;\n         if( strmatch(next, "sinh"  ) ) d->a.func0 = sinh;\n    else if( strmatch(next, "cosh"  ) ) d->a.func0 = cosh;\n    else if( strmatch(next, "tanh"  ) ) d->a.func0 = tanh;\n    else if( strmatch(next, "sin"   ) ) d->a.func0 = sin;\n    else if( strmatch(next, "cos"   ) ) d->a.func0 = cos;\n    else if( strmatch(next, "tan"   ) ) d->a.func0 = tan;\n    else if( strmatch(next, "atan"  ) ) d->a.func0 = atan;\n    else if( strmatch(next, "asin"  ) ) d->a.func0 = asin;\n    else if( strmatch(next, "acos"  ) ) d->a.func0 = acos;\n    else if( strmatch(next, "exp"   ) ) d->a.func0 = exp;\n    else if( strmatch(next, "log"   ) ) d->a.func0 = log;\n    else if( strmatch(next, "abs"   ) ) d->a.func0 = fabs;\n    else if( strmatch(next, "squish") ) d->type = e_squish;\n    else if( strmatch(next, "gauss" ) ) d->type = e_gauss;\n    else if( strmatch(next, "mod"   ) ) d->type = e_mod;\n    else if( strmatch(next, "max"   ) ) d->type = e_max;\n    else if( strmatch(next, "min"   ) ) d->type = e_min;\n    else if( strmatch(next, "eq"    ) ) d->type = e_eq;\n    else if( strmatch(next, "gte"   ) ) d->type = e_gte;\n    else if( strmatch(next, "gt"    ) ) d->type = e_gt;\n    else if( strmatch(next, "lte"   ) ) { AVEvalExpr * tmp = d->param[1]; d->param[1] = d->param[0]; d->param[0] = tmp; d->type = e_gt; }\n    else if( strmatch(next, "lt"    ) ) { AVEvalExpr * tmp = d->param[1]; d->param[1] = d->param[0]; d->param[0] = tmp; d->type = e_gte; }\n    else if( strmatch(next, "ld"    ) ) d->type = e_ld;\n    else if( strmatch(next, "st"    ) ) d->type = e_st;\n    else if( strmatch(next, "while" ) ) d->type = e_while;\n    else {\n        for(i=0; p->func1_name && p->func1_name[i]; i++){\n            if(strmatch(next, p->func1_name[i])){\n                d->a.func1 = p->func1[i];\n                d->type = e_func1;\n                return d;\n            }\n        }\n        for(i=0; p->func2_name && p->func2_name[i]; i++){\n            if(strmatch(next, p->func2_name[i])){\n                d->a.func2 = p->func2[i];\n                d->type = e_func2;\n                return d;\n            }\n        }\n        *p->error = "unknown function";\n        ff_eval_free(d);\n        return NULL;\n    }\n    return d;\n}', 'void *av_mallocz(unsigned int size)\n{\n    void *ptr = av_malloc(size);\n    if (ptr)\n        memset(ptr, 0, size);\n    return ptr;\n}', 'void *av_malloc(unsigned int size)\n{\n    void *ptr;\n#ifdef CONFIG_MEMALIGN_HACK\n    long diff;\n#endif\n    if(size > (INT_MAX-16) )\n        return NULL;\n#ifdef CONFIG_MEMALIGN_HACK\n    ptr = malloc(size+16);\n    if(!ptr)\n        return ptr;\n    diff= ((-(long)ptr - 1)&15) + 1;\n    ptr = (char*)ptr + diff;\n    ((char*)ptr)[-1]= diff;\n#elif defined (HAVE_MEMALIGN)\n    ptr = memalign(16,size);\n#else\n    ptr = malloc(size);\n#endif\n    return ptr;\n}', "static double av_strtod(const char *name, char **tail) {\n    double d;\n    char *next;\n    d = strtod(name, &next);\n    if (next!=name) {\n        if(*next >= 'E' && *next <= 'z'){\n            int e= si_prefixes[*next - 'E'];\n            if(e){\n                if(next[1] == 'i'){\n                    d*= pow( 2, e/0.3);\n                    next+=2;\n                }else{\n                    d*= pow(10, e);\n                    next++;\n                }\n            }\n        }\n        if(*next=='B') {\n            d*=8;\n            next++;\n        }\n    }\n    if (tail)\n        *tail = next;\n    return d;\n}"]