libavformat/4xm.c:239: error: Null Dereference
  pointer `fourxm->tracks` last assigned on line 200 could be null and is dereferenced by call to `parse_strk()` at line 239, column 24.

libavformat/4xm.c:189:1: start of procedure fourxm_read_header()
187. }
188. 
189. static int fourxm_read_header(AVFormatContext *s)
     ^
190. {
191.     AVIOContext *pb = s->pb;

libavformat/4xm.c:191:5: 
189. static int fourxm_read_header(AVFormatContext *s)
190. {
191.     AVIOContext *pb = s->pb;
         ^
192.     unsigned int fourcc_tag;
193.     unsigned int size;

libavformat/4xm.c:195:5: 
193.     unsigned int size;
194.     int header_size;
195.     FourxmDemuxContext *fourxm = s->priv_data;
         ^
196.     unsigned char *header;
197.     int i, ret;

libavformat/4xm.c:199:5: 
197.     int i, ret;
198. 
199.     fourxm->track_count = 0;
         ^
200.     fourxm->tracks      = NULL;
201.     fourxm->fps         = 1.0;

libavformat/4xm.c:200:5: 
198. 
199.     fourxm->track_count = 0;
200.     fourxm->tracks      = NULL;
         ^
201.     fourxm->fps         = 1.0;
202. 

libavformat/4xm.c:201:5: 
199.     fourxm->track_count = 0;
200.     fourxm->tracks      = NULL;
201.     fourxm->fps         = 1.0;
         ^
202. 
203.     /* skip the first 3 32-bit numbers */

libavformat/4xm.c:204:5: 
202. 
203.     /* skip the first 3 32-bit numbers */
204.     avio_skip(pb, 12);
         ^
205. 
206.     /* check for LIST-HEAD */

libavformat/avio.h:293:1: start of procedure avio_skip()
  291.  * @return new position or AVERROR.
  292.  */
  293. static av_always_inline int64_t avio_skip(AVIOContext *s, int64_t offset)
       ^
  294. {
  295.     return avio_seek(s, offset, SEEK_CUR);

libavformat/avio.h:295:5: Skipping avio_seek(): empty list of specs
  293. static av_always_inline int64_t avio_skip(AVIOContext *s, int64_t offset)
  294. {
  295.     return avio_seek(s, offset, SEEK_CUR);
           ^
  296. }
  297. 

libavformat/avio.h:296:1: return from a call to avio_skip
  294. {
  295.     return avio_seek(s, offset, SEEK_CUR);
  296. }
       ^
  297. 
  298. /**

libavformat/4xm.c:207:5: 
205. 
206.     /* check for LIST-HEAD */
207.     GET_LIST_HEADER();
         ^
208.     header_size = size - 4;
209.     if (fourcc_tag != HEAD_TAG || header_size < 0)

libavformat/aviobuf.c:665:1: start of procedure avio_rl32()
  663. }
  664. 
  665. unsigned int avio_rl32(AVIOContext *s)
       ^
  666. {
  667.     unsigned int val;

libavformat/aviobuf.c:668:5: 
  666. {
  667.     unsigned int val;
  668.     val = avio_rl16(s);
           ^
  669.     val |= avio_rl16(s) << 16;
  670.     return val;

libavformat/aviobuf.c:649:1: start of procedure avio_rl16()
    647. }
    648. 
    649. unsigned int avio_rl16(AVIOContext *s)
         ^
    650. {
    651.     unsigned int val;

libavformat/aviobuf.c:652:5: 
    650. {
    651.     unsigned int val;
    652.     val = avio_r8(s);
             ^
    653.     val |= avio_r8(s) << 8;
    654.     return val;

libavformat/aviobuf.c:536:1: start of procedure avio_r8()
      534. 
      535. /* XXX: put an inline version */
      536. int avio_r8(AVIOContext *s)
           ^
      537. {
      538.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:538:9: Taking false branch
      536. int avio_r8(AVIOContext *s)
      537. {
      538.     if (s->buf_ptr >= s->buf_end)
                   ^
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:540:9: Taking true branch
      538.     if (s->buf_ptr >= s->buf_end)
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
                   ^
      541.         return *s->buf_ptr++;
      542.     return 0;

libavformat/aviobuf.c:541:9: 
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
      541.         return *s->buf_ptr++;
                   ^
      542.     return 0;
      543. }

libavformat/aviobuf.c:543:1: return from a call to avio_r8
      541.         return *s->buf_ptr++;
      542.     return 0;
      543. }
           ^
      544. 
      545. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:653:5: 
    651.     unsigned int val;
    652.     val = avio_r8(s);
    653.     val |= avio_r8(s) << 8;
             ^
    654.     return val;
    655. }

libavformat/aviobuf.c:536:1: start of procedure avio_r8()
      534. 
      535. /* XXX: put an inline version */
      536. int avio_r8(AVIOContext *s)
           ^
      537. {
      538.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:538:9: Taking false branch
      536. int avio_r8(AVIOContext *s)
      537. {
      538.     if (s->buf_ptr >= s->buf_end)
                   ^
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:540:9: Taking true branch
      538.     if (s->buf_ptr >= s->buf_end)
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
                   ^
      541.         return *s->buf_ptr++;
      542.     return 0;

libavformat/aviobuf.c:541:9: 
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
      541.         return *s->buf_ptr++;
                   ^
      542.     return 0;
      543. }

libavformat/aviobuf.c:543:1: return from a call to avio_r8
      541.         return *s->buf_ptr++;
      542.     return 0;
      543. }
           ^
      544. 
      545. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:654:5: 
    652.     val = avio_r8(s);
    653.     val |= avio_r8(s) << 8;
    654.     return val;
             ^
    655. }
    656. 

libavformat/aviobuf.c:655:1: return from a call to avio_rl16
    653.     val |= avio_r8(s) << 8;
    654.     return val;
    655. }
         ^
    656. 
    657. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:669:5: 
  667.     unsigned int val;
  668.     val = avio_rl16(s);
  669.     val |= avio_rl16(s) << 16;
           ^
  670.     return val;
  671. }

libavformat/aviobuf.c:649:1: start of procedure avio_rl16()
    647. }
    648. 
    649. unsigned int avio_rl16(AVIOContext *s)
         ^
    650. {
    651.     unsigned int val;

libavformat/aviobuf.c:652:5: 
    650. {
    651.     unsigned int val;
    652.     val = avio_r8(s);
             ^
    653.     val |= avio_r8(s) << 8;
    654.     return val;

libavformat/aviobuf.c:536:1: start of procedure avio_r8()
      534. 
      535. /* XXX: put an inline version */
      536. int avio_r8(AVIOContext *s)
           ^
      537. {
      538.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:538:9: Taking false branch
      536. int avio_r8(AVIOContext *s)
      537. {
      538.     if (s->buf_ptr >= s->buf_end)
                   ^
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:540:9: Taking true branch
      538.     if (s->buf_ptr >= s->buf_end)
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
                   ^
      541.         return *s->buf_ptr++;
      542.     return 0;

libavformat/aviobuf.c:541:9: 
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
      541.         return *s->buf_ptr++;
                   ^
      542.     return 0;
      543. }

libavformat/aviobuf.c:543:1: return from a call to avio_r8
      541.         return *s->buf_ptr++;
      542.     return 0;
      543. }
           ^
      544. 
      545. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:653:5: 
    651.     unsigned int val;
    652.     val = avio_r8(s);
    653.     val |= avio_r8(s) << 8;
             ^
    654.     return val;
    655. }

libavformat/aviobuf.c:536:1: start of procedure avio_r8()
      534. 
      535. /* XXX: put an inline version */
      536. int avio_r8(AVIOContext *s)
           ^
      537. {
      538.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:538:9: Taking false branch
      536. int avio_r8(AVIOContext *s)
      537. {
      538.     if (s->buf_ptr >= s->buf_end)
                   ^
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:540:9: Taking true branch
      538.     if (s->buf_ptr >= s->buf_end)
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
                   ^
      541.         return *s->buf_ptr++;
      542.     return 0;

libavformat/aviobuf.c:541:9: 
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
      541.         return *s->buf_ptr++;
                   ^
      542.     return 0;
      543. }

libavformat/aviobuf.c:543:1: return from a call to avio_r8
      541.         return *s->buf_ptr++;
      542.     return 0;
      543. }
           ^
      544. 
      545. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:654:5: 
    652.     val = avio_r8(s);
    653.     val |= avio_r8(s) << 8;
    654.     return val;
             ^
    655. }
    656. 

libavformat/aviobuf.c:655:1: return from a call to avio_rl16
    653.     val |= avio_r8(s) << 8;
    654.     return val;
    655. }
         ^
    656. 
    657. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:670:5: 
  668.     val = avio_rl16(s);
  669.     val |= avio_rl16(s) << 16;
  670.     return val;
           ^
  671. }
  672. 

libavformat/aviobuf.c:671:1: return from a call to avio_rl32
  669.     val |= avio_rl16(s) << 16;
  670.     return val;
  671. }
       ^
  672. 
  673. uint64_t avio_rl64(AVIOContext *s)

libavformat/4xm.c:207:5: 
205. 
206.     /* check for LIST-HEAD */
207.     GET_LIST_HEADER();
         ^
208.     header_size = size - 4;
209.     if (fourcc_tag != HEAD_TAG || header_size < 0)

libavformat/aviobuf.c:665:1: start of procedure avio_rl32()
  663. }
  664. 
  665. unsigned int avio_rl32(AVIOContext *s)
       ^
  666. {
  667.     unsigned int val;

libavformat/aviobuf.c:668:5: 
  666. {
  667.     unsigned int val;
  668.     val = avio_rl16(s);
           ^
  669.     val |= avio_rl16(s) << 16;
  670.     return val;

libavformat/aviobuf.c:649:1: start of procedure avio_rl16()
    647. }
    648. 
    649. unsigned int avio_rl16(AVIOContext *s)
         ^
    650. {
    651.     unsigned int val;

libavformat/aviobuf.c:652:5: 
    650. {
    651.     unsigned int val;
    652.     val = avio_r8(s);
             ^
    653.     val |= avio_r8(s) << 8;
    654.     return val;

libavformat/aviobuf.c:536:1: start of procedure avio_r8()
      534. 
      535. /* XXX: put an inline version */
      536. int avio_r8(AVIOContext *s)
           ^
      537. {
      538.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:538:9: Taking false branch
      536. int avio_r8(AVIOContext *s)
      537. {
      538.     if (s->buf_ptr >= s->buf_end)
                   ^
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:540:9: Taking true branch
      538.     if (s->buf_ptr >= s->buf_end)
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
                   ^
      541.         return *s->buf_ptr++;
      542.     return 0;

libavformat/aviobuf.c:541:9: 
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
      541.         return *s->buf_ptr++;
                   ^
      542.     return 0;
      543. }

libavformat/aviobuf.c:543:1: return from a call to avio_r8
      541.         return *s->buf_ptr++;
      542.     return 0;
      543. }
           ^
      544. 
      545. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:653:5: 
    651.     unsigned int val;
    652.     val = avio_r8(s);
    653.     val |= avio_r8(s) << 8;
             ^
    654.     return val;
    655. }

libavformat/aviobuf.c:536:1: start of procedure avio_r8()
      534. 
      535. /* XXX: put an inline version */
      536. int avio_r8(AVIOContext *s)
           ^
      537. {
      538.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:538:9: Taking false branch
      536. int avio_r8(AVIOContext *s)
      537. {
      538.     if (s->buf_ptr >= s->buf_end)
                   ^
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:540:9: Taking true branch
      538.     if (s->buf_ptr >= s->buf_end)
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
                   ^
      541.         return *s->buf_ptr++;
      542.     return 0;

libavformat/aviobuf.c:541:9: 
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
      541.         return *s->buf_ptr++;
                   ^
      542.     return 0;
      543. }

libavformat/aviobuf.c:543:1: return from a call to avio_r8
      541.         return *s->buf_ptr++;
      542.     return 0;
      543. }
           ^
      544. 
      545. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:654:5: 
    652.     val = avio_r8(s);
    653.     val |= avio_r8(s) << 8;
    654.     return val;
             ^
    655. }
    656. 

libavformat/aviobuf.c:655:1: return from a call to avio_rl16
    653.     val |= avio_r8(s) << 8;
    654.     return val;
    655. }
         ^
    656. 
    657. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:669:5: 
  667.     unsigned int val;
  668.     val = avio_rl16(s);
  669.     val |= avio_rl16(s) << 16;
           ^
  670.     return val;
  671. }

libavformat/aviobuf.c:649:1: start of procedure avio_rl16()
    647. }
    648. 
    649. unsigned int avio_rl16(AVIOContext *s)
         ^
    650. {
    651.     unsigned int val;

libavformat/aviobuf.c:652:5: 
    650. {
    651.     unsigned int val;
    652.     val = avio_r8(s);
             ^
    653.     val |= avio_r8(s) << 8;
    654.     return val;

libavformat/aviobuf.c:536:1: start of procedure avio_r8()
      534. 
      535. /* XXX: put an inline version */
      536. int avio_r8(AVIOContext *s)
           ^
      537. {
      538.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:538:9: Taking false branch
      536. int avio_r8(AVIOContext *s)
      537. {
      538.     if (s->buf_ptr >= s->buf_end)
                   ^
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:540:9: Taking true branch
      538.     if (s->buf_ptr >= s->buf_end)
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
                   ^
      541.         return *s->buf_ptr++;
      542.     return 0;

libavformat/aviobuf.c:541:9: 
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
      541.         return *s->buf_ptr++;
                   ^
      542.     return 0;
      543. }

libavformat/aviobuf.c:543:1: return from a call to avio_r8
      541.         return *s->buf_ptr++;
      542.     return 0;
      543. }
           ^
      544. 
      545. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:653:5: 
    651.     unsigned int val;
    652.     val = avio_r8(s);
    653.     val |= avio_r8(s) << 8;
             ^
    654.     return val;
    655. }

libavformat/aviobuf.c:536:1: start of procedure avio_r8()
      534. 
      535. /* XXX: put an inline version */
      536. int avio_r8(AVIOContext *s)
           ^
      537. {
      538.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:538:9: Taking false branch
      536. int avio_r8(AVIOContext *s)
      537. {
      538.     if (s->buf_ptr >= s->buf_end)
                   ^
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:540:9: Taking true branch
      538.     if (s->buf_ptr >= s->buf_end)
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
                   ^
      541.         return *s->buf_ptr++;
      542.     return 0;

libavformat/aviobuf.c:541:9: 
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
      541.         return *s->buf_ptr++;
                   ^
      542.     return 0;
      543. }

libavformat/aviobuf.c:543:1: return from a call to avio_r8
      541.         return *s->buf_ptr++;
      542.     return 0;
      543. }
           ^
      544. 
      545. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:654:5: 
    652.     val = avio_r8(s);
    653.     val |= avio_r8(s) << 8;
    654.     return val;
             ^
    655. }
    656. 

libavformat/aviobuf.c:655:1: return from a call to avio_rl16
    653.     val |= avio_r8(s) << 8;
    654.     return val;
    655. }
         ^
    656. 
    657. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:670:5: 
  668.     val = avio_rl16(s);
  669.     val |= avio_rl16(s) << 16;
  670.     return val;
           ^
  671. }
  672. 

libavformat/aviobuf.c:671:1: return from a call to avio_rl32
  669.     val |= avio_rl16(s) << 16;
  670.     return val;
  671. }
       ^
  672. 
  673. uint64_t avio_rl64(AVIOContext *s)

libavformat/4xm.c:207:5: Taking false branch
205. 
206.     /* check for LIST-HEAD */
207.     GET_LIST_HEADER();
         ^
208.     header_size = size - 4;
209.     if (fourcc_tag != HEAD_TAG || header_size < 0)

libavformat/aviobuf.c:665:1: start of procedure avio_rl32()
  663. }
  664. 
  665. unsigned int avio_rl32(AVIOContext *s)
       ^
  666. {
  667.     unsigned int val;

libavformat/aviobuf.c:668:5: 
  666. {
  667.     unsigned int val;
  668.     val = avio_rl16(s);
           ^
  669.     val |= avio_rl16(s) << 16;
  670.     return val;

libavformat/aviobuf.c:649:1: start of procedure avio_rl16()
    647. }
    648. 
    649. unsigned int avio_rl16(AVIOContext *s)
         ^
    650. {
    651.     unsigned int val;

libavformat/aviobuf.c:652:5: 
    650. {
    651.     unsigned int val;
    652.     val = avio_r8(s);
             ^
    653.     val |= avio_r8(s) << 8;
    654.     return val;

libavformat/aviobuf.c:536:1: start of procedure avio_r8()
      534. 
      535. /* XXX: put an inline version */
      536. int avio_r8(AVIOContext *s)
           ^
      537. {
      538.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:538:9: Taking false branch
      536. int avio_r8(AVIOContext *s)
      537. {
      538.     if (s->buf_ptr >= s->buf_end)
                   ^
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:540:9: Taking true branch
      538.     if (s->buf_ptr >= s->buf_end)
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
                   ^
      541.         return *s->buf_ptr++;
      542.     return 0;

libavformat/aviobuf.c:541:9: 
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
      541.         return *s->buf_ptr++;
                   ^
      542.     return 0;
      543. }

libavformat/aviobuf.c:543:1: return from a call to avio_r8
      541.         return *s->buf_ptr++;
      542.     return 0;
      543. }
           ^
      544. 
      545. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:653:5: 
    651.     unsigned int val;
    652.     val = avio_r8(s);
    653.     val |= avio_r8(s) << 8;
             ^
    654.     return val;
    655. }

libavformat/aviobuf.c:536:1: start of procedure avio_r8()
      534. 
      535. /* XXX: put an inline version */
      536. int avio_r8(AVIOContext *s)
           ^
      537. {
      538.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:538:9: Taking false branch
      536. int avio_r8(AVIOContext *s)
      537. {
      538.     if (s->buf_ptr >= s->buf_end)
                   ^
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:540:9: Taking true branch
      538.     if (s->buf_ptr >= s->buf_end)
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
                   ^
      541.         return *s->buf_ptr++;
      542.     return 0;

libavformat/aviobuf.c:541:9: 
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
      541.         return *s->buf_ptr++;
                   ^
      542.     return 0;
      543. }

libavformat/aviobuf.c:543:1: return from a call to avio_r8
      541.         return *s->buf_ptr++;
      542.     return 0;
      543. }
           ^
      544. 
      545. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:654:5: 
    652.     val = avio_r8(s);
    653.     val |= avio_r8(s) << 8;
    654.     return val;
             ^
    655. }
    656. 

libavformat/aviobuf.c:655:1: return from a call to avio_rl16
    653.     val |= avio_r8(s) << 8;
    654.     return val;
    655. }
         ^
    656. 
    657. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:669:5: 
  667.     unsigned int val;
  668.     val = avio_rl16(s);
  669.     val |= avio_rl16(s) << 16;
           ^
  670.     return val;
  671. }

libavformat/aviobuf.c:649:1: start of procedure avio_rl16()
    647. }
    648. 
    649. unsigned int avio_rl16(AVIOContext *s)
         ^
    650. {
    651.     unsigned int val;

libavformat/aviobuf.c:652:5: 
    650. {
    651.     unsigned int val;
    652.     val = avio_r8(s);
             ^
    653.     val |= avio_r8(s) << 8;
    654.     return val;

libavformat/aviobuf.c:536:1: start of procedure avio_r8()
      534. 
      535. /* XXX: put an inline version */
      536. int avio_r8(AVIOContext *s)
           ^
      537. {
      538.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:538:9: Taking false branch
      536. int avio_r8(AVIOContext *s)
      537. {
      538.     if (s->buf_ptr >= s->buf_end)
                   ^
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:540:9: Taking true branch
      538.     if (s->buf_ptr >= s->buf_end)
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
                   ^
      541.         return *s->buf_ptr++;
      542.     return 0;

libavformat/aviobuf.c:541:9: 
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
      541.         return *s->buf_ptr++;
                   ^
      542.     return 0;
      543. }

libavformat/aviobuf.c:543:1: return from a call to avio_r8
      541.         return *s->buf_ptr++;
      542.     return 0;
      543. }
           ^
      544. 
      545. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:653:5: 
    651.     unsigned int val;
    652.     val = avio_r8(s);
    653.     val |= avio_r8(s) << 8;
             ^
    654.     return val;
    655. }

libavformat/aviobuf.c:536:1: start of procedure avio_r8()
      534. 
      535. /* XXX: put an inline version */
      536. int avio_r8(AVIOContext *s)
           ^
      537. {
      538.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:538:9: Taking false branch
      536. int avio_r8(AVIOContext *s)
      537. {
      538.     if (s->buf_ptr >= s->buf_end)
                   ^
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:540:9: Taking true branch
      538.     if (s->buf_ptr >= s->buf_end)
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
                   ^
      541.         return *s->buf_ptr++;
      542.     return 0;

libavformat/aviobuf.c:541:9: 
      539.         fill_buffer(s);
      540.     if (s->buf_ptr < s->buf_end)
      541.         return *s->buf_ptr++;
                   ^
      542.     return 0;
      543. }

libavformat/aviobuf.c:543:1: return from a call to avio_r8
      541.         return *s->buf_ptr++;
      542.     return 0;
      543. }
           ^
      544. 
      545. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:654:5: 
    652.     val = avio_r8(s);
    653.     val |= avio_r8(s) << 8;
    654.     return val;
             ^
    655. }
    656. 

libavformat/aviobuf.c:655:1: return from a call to avio_rl16
    653.     val |= avio_r8(s) << 8;
    654.     return val;
    655. }
         ^
    656. 
    657. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:670:5: 
  668.     val = avio_rl16(s);
  669.     val |= avio_rl16(s) << 16;
  670.     return val;
           ^
  671. }
  672. 

libavformat/aviobuf.c:671:1: return from a call to avio_rl32
  669.     val |= avio_rl16(s) << 16;
  670.     return val;
  671. }
       ^
  672. 
  673. uint64_t avio_rl64(AVIOContext *s)

libavformat/4xm.c:208:5: 
206.     /* check for LIST-HEAD */
207.     GET_LIST_HEADER();
208.     header_size = size - 4;
         ^
209.     if (fourcc_tag != HEAD_TAG || header_size < 0)
210.         return AVERROR_INVALIDDATA;

libavformat/4xm.c:209:9: Taking false branch
207.     GET_LIST_HEADER();
208.     header_size = size - 4;
209.     if (fourcc_tag != HEAD_TAG || header_size < 0)
             ^
210.         return AVERROR_INVALIDDATA;
211. 

libavformat/4xm.c:209:35: Taking false branch
207.     GET_LIST_HEADER();
208.     header_size = size - 4;
209.     if (fourcc_tag != HEAD_TAG || header_size < 0)
                                       ^
210.         return AVERROR_INVALIDDATA;
211. 

libavformat/4xm.c:213:5: 
211. 
212.     /* allocate space for the header and load the whole thing */
213.     header = av_malloc(header_size);
         ^
214.     if (!header)
215.         return AVERROR(ENOMEM);

libavutil/mem.c:62:1: start of procedure av_malloc()
  60.  * linker will do it automatically. */
  61. 
  62. void *av_malloc(size_t size)
      ^
  63. {
  64.     void *ptr = NULL;

libavutil/mem.c:64:5: 
  62. void *av_malloc(size_t size)
  63. {
  64.     void *ptr = NULL;
          ^
  65. 
  66.     /* let's disallow possibly ambiguous cases */

libavutil/mem.c:67:9: Taking false branch
  65. 
  66.     /* let's disallow possibly ambiguous cases */
  67.     if (size > (INT_MAX - 32) || !size)
              ^
  68.         return NULL;
  69. 

libavutil/mem.c:67:35: Taking false branch
  65. 
  66.     /* let's disallow possibly ambiguous cases */
  67.     if (size > (INT_MAX - 32) || !size)
                                        ^
  68.         return NULL;
  69. 

libavutil/mem.c:71:9: Taking false branch
  69. 
  70. #if HAVE_POSIX_MEMALIGN
  71.     if (posix_memalign(&ptr, 32, size))
              ^
  72.         ptr = NULL;
  73. #elif HAVE_ALIGNED_MALLOC

libavutil/mem.c:104:5: 
  102.     ptr = malloc(size);
  103. #endif
  104.     return ptr;
           ^
  105. }
  106. 

libavutil/mem.c:105:1: return from a call to av_malloc
  103. #endif
  104.     return ptr;
  105. }
       ^
  106. 
  107. void *av_realloc(void *ptr, size_t size)

libavformat/4xm.c:214:10: Taking false branch
212.     /* allocate space for the header and load the whole thing */
213.     header = av_malloc(header_size);
214.     if (!header)
              ^
215.         return AVERROR(ENOMEM);
216.     if (avio_read(pb, header, header_size) != header_size) {

libavformat/4xm.c:216:9: Taking false branch
214.     if (!header)
215.         return AVERROR(ENOMEM);
216.     if (avio_read(pb, header, header_size) != header_size) {
             ^
217.         av_free(header);
218.         return AVERROR(EIO);

libavformat/4xm.c:222:10: 
220. 
221.     /* take the lazy approach and search for any and all vtrk and strk chunks */
222.     for (i = 0; i < header_size - 8; i++) {
              ^
223.         fourcc_tag = AV_RL32(&header[i]);
224.         size       = AV_RL32(&header[i + 4]);

libavformat/4xm.c:222:17: Loop condition is true. Entering loop body
220. 
221.     /* take the lazy approach and search for any and all vtrk and strk chunks */
222.     for (i = 0; i < header_size - 8; i++) {
                     ^
223.         fourcc_tag = AV_RL32(&header[i]);
224.         size       = AV_RL32(&header[i + 4]);

libavformat/4xm.c:223:9: 
221.     /* take the lazy approach and search for any and all vtrk and strk chunks */
222.     for (i = 0; i < header_size - 8; i++) {
223.         fourcc_tag = AV_RL32(&header[i]);
             ^
224.         size       = AV_RL32(&header[i + 4]);
225. 

libavformat/4xm.c:224:9: 
222.     for (i = 0; i < header_size - 8; i++) {
223.         fourcc_tag = AV_RL32(&header[i]);
224.         size       = AV_RL32(&header[i + 4]);
             ^
225. 
226.         if (fourcc_tag == std__TAG) {

libavformat/4xm.c:226:13: Taking false branch
224.         size       = AV_RL32(&header[i + 4]);
225. 
226.         if (fourcc_tag == std__TAG) {
                 ^
227.             if (header_size - i < 16) {
228.                 ret = AVERROR_INVALIDDATA;

libavformat/4xm.c:232:20: Taking false branch
230.             }
231.             fourxm->fps = av_int2float(AV_RL32(&header[i + 12]));
232.         } else if (fourcc_tag == vtrk_TAG) {
                        ^
233.             if ((ret = parse_vtrk(s, fourxm, header + i, size,
234.                                   header_size - i)) < 0)

libavformat/4xm.c:238:20: Taking true branch
236. 
237.             i += 8 + size;
238.         } else if (fourcc_tag == strk_TAG) {
                        ^
239.             if ((ret = parse_strk(s, fourxm, header + i, size,
240.                                   header_size - i)) < 0)

libavformat/4xm.c:239:17: 
237.             i += 8 + size;
238.         } else if (fourcc_tag == strk_TAG) {
239.             if ((ret = parse_strk(s, fourxm, header + i, size,
                     ^
240.                                   header_size - i)) < 0)
241.                 goto fail;

libavformat/4xm.c:126:1: start of procedure parse_strk()
  124. 
  125. 
  126. static int parse_strk(AVFormatContext *s,
       ^
  127.                       FourxmDemuxContext *fourxm, uint8_t *buf, int size,
  128.                       int left)

libavformat/4xm.c:133:9: Taking false branch
  131.     int track;
  132.     /* check that there is enough data */
  133.     if (size != strk_SIZE || left < size + 8)
               ^
  134.         return AVERROR_INVALIDDATA;
  135. 

libavformat/4xm.c:133:30: Taking false branch
  131.     int track;
  132.     /* check that there is enough data */
  133.     if (size != strk_SIZE || left < size + 8)
                                    ^
  134.         return AVERROR_INVALIDDATA;
  135. 

libavformat/4xm.c:136:5: 
  134.         return AVERROR_INVALIDDATA;
  135. 
  136.     track = AV_RL32(buf + 8);
           ^
  137.     if (track < 0)
  138.         return AVERROR_INVALIDDATA;

libavformat/4xm.c:137:9: Taking false branch
  135. 
  136.     track = AV_RL32(buf + 8);
  137.     if (track < 0)
               ^
  138.         return AVERROR_INVALIDDATA;
  139.     if (track + 1 > fourxm->track_count) {

libavformat/4xm.c:139:9: Taking false branch
  137.     if (track < 0)
  138.         return AVERROR_INVALIDDATA;
  139.     if (track + 1 > fourxm->track_count) {
               ^
  140.         if (av_reallocp_array(&fourxm->tracks, track + 1, sizeof(AudioTrack)))
  141.             return AVERROR(ENOMEM);

libavformat/4xm.c:146:5: 
  144.         fourxm->track_count = track + 1;
  145.     }
  146.     fourxm->tracks[track].adpcm       = AV_RL32(buf + 12);
           ^
  147.     fourxm->tracks[track].channels    = AV_RL32(buf + 36);
  148.     fourxm->tracks[track].sample_rate = AV_RL32(buf + 40);

static int fourxm_read_header(AVFormatContext *s)
{
    AVIOContext *pb = s->pb;
    unsigned int fourcc_tag;
    unsigned int size;
    int header_size;
    FourxmDemuxContext *fourxm = s->priv_data;
    unsigned char *header;
    int i, ret;
    fourxm->track_count = 0;
    fourxm->tracks      = NULL;
    fourxm->fps         = 1.0;
    avio_skip(pb, 12);
    GET_LIST_HEADER();
    header_size = size - 4;
    if (fourcc_tag != HEAD_TAG || header_size < 0)
        return AVERROR_INVALIDDATA;
    header = av_malloc(header_size);
    if (!header)
        return AVERROR(ENOMEM);
    if (avio_read(pb, header, header_size) != header_size) {
        av_free(header);
        return AVERROR(EIO);
    }
    for (i = 0; i < header_size - 8; i++) {
        fourcc_tag = AV_RL32(&header[i]);
        size       = AV_RL32(&header[i + 4]);
        if (fourcc_tag == std__TAG) {
            if (header_size - i < 16) {
                ret = AVERROR_INVALIDDATA;
                goto fail;
            }
            fourxm->fps = av_int2float(AV_RL32(&header[i + 12]));
        } else if (fourcc_tag == vtrk_TAG) {
            if ((ret = parse_vtrk(s, fourxm, header + i, size,
                                  header_size - i)) < 0)
                goto fail;
            i += 8 + size;
        } else if (fourcc_tag == strk_TAG) {
            if ((ret = parse_strk(s, fourxm, header + i, size,
                                  header_size - i)) < 0)
                goto fail;
            i += 8 + size;
        }
    }
    GET_LIST_HEADER();
    if (fourcc_tag != MOVI_TAG) {
        ret = AVERROR_INVALIDDATA;
        goto fail;
    }
    av_free(header);
    fourxm->video_pts = -1;
    return 0;
fail:
    av_freep(&fourxm->tracks);
    av_free(header);
    return ret;
}
['static int fourxm_read_header(AVFormatContext *s)\n{\n    AVIOContext *pb = s->pb;\n    unsigned int fourcc_tag;\n    unsigned int size;\n    int header_size;\n    FourxmDemuxContext *fourxm = s->priv_data;\n    unsigned char *header;\n    int i, ret;\n    fourxm->track_count = 0;\n    fourxm->tracks      = NULL;\n    fourxm->fps         = 1.0;\n    avio_skip(pb, 12);\n    GET_LIST_HEADER();\n    header_size = size - 4;\n    if (fourcc_tag != HEAD_TAG || header_size < 0)\n        return AVERROR_INVALIDDATA;\n    header = av_malloc(header_size);\n    if (!header)\n        return AVERROR(ENOMEM);\n    if (avio_read(pb, header, header_size) != header_size) {\n        av_free(header);\n        return AVERROR(EIO);\n    }\n    for (i = 0; i < header_size - 8; i++) {\n        fourcc_tag = AV_RL32(&header[i]);\n        size       = AV_RL32(&header[i + 4]);\n        if (fourcc_tag == std__TAG) {\n            if (header_size - i < 16) {\n                ret = AVERROR_INVALIDDATA;\n                goto fail;\n            }\n            fourxm->fps = av_int2float(AV_RL32(&header[i + 12]));\n        } else if (fourcc_tag == vtrk_TAG) {\n            if ((ret = parse_vtrk(s, fourxm, header + i, size,\n                                  header_size - i)) < 0)\n                goto fail;\n            i += 8 + size;\n        } else if (fourcc_tag == strk_TAG) {\n            if ((ret = parse_strk(s, fourxm, header + i, size,\n                                  header_size - i)) < 0)\n                goto fail;\n            i += 8 + size;\n        }\n    }\n    GET_LIST_HEADER();\n    if (fourcc_tag != MOVI_TAG) {\n        ret = AVERROR_INVALIDDATA;\n        goto fail;\n    }\n    av_free(header);\n    fourxm->video_pts = -1;\n    return 0;\nfail:\n    av_freep(&fourxm->tracks);\n    av_free(header);\n    return ret;\n}', 'static av_always_inline int64_t avio_skip(AVIOContext *s, int64_t offset)\n{\n    return avio_seek(s, offset, SEEK_CUR);\n}', 'unsigned int avio_rl32(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_rl16(s);\n    val |= avio_rl16(s) << 16;\n    return val;\n}', 'unsigned int avio_rl16(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_r8(s);\n    val |= avio_r8(s) << 8;\n    return val;\n}', 'int avio_r8(AVIOContext *s)\n{\n    if (s->buf_ptr >= s->buf_end)\n        fill_buffer(s);\n    if (s->buf_ptr < s->buf_end)\n        return *s->buf_ptr++;\n    return 0;\n}', 'void *av_malloc(size_t size)\n{\n    void *ptr = NULL;\n    if (size > (INT_MAX - 32) || !size)\n        return NULL;\n#if HAVE_POSIX_MEMALIGN\n    if (posix_memalign(&ptr, 32, size))\n        ptr = NULL;\n#elif HAVE_ALIGNED_MALLOC\n    ptr = _aligned_malloc(size, 32);\n#elif HAVE_MEMALIGN\n    ptr = memalign(32, size);\n#else\n    ptr = malloc(size);\n#endif\n    return ptr;\n}', 'static int parse_strk(AVFormatContext *s,\n                      FourxmDemuxContext *fourxm, uint8_t *buf, int size,\n                      int left)\n{\n    AVStream *st;\n    int track;\n    if (size != strk_SIZE || left < size + 8)\n        return AVERROR_INVALIDDATA;\n    track = AV_RL32(buf + 8);\n    if (track < 0)\n        return AVERROR_INVALIDDATA;\n    if (track + 1 > fourxm->track_count) {\n        if (av_reallocp_array(&fourxm->tracks, track + 1, sizeof(AudioTrack)))\n            return AVERROR(ENOMEM);\n        memset(&fourxm->tracks[fourxm->track_count], 0,\n               sizeof(AudioTrack) * (track + 1 - fourxm->track_count));\n        fourxm->track_count = track + 1;\n    }\n    fourxm->tracks[track].adpcm       = AV_RL32(buf + 12);\n    fourxm->tracks[track].channels    = AV_RL32(buf + 36);\n    fourxm->tracks[track].sample_rate = AV_RL32(buf + 40);\n    fourxm->tracks[track].bits        = AV_RL32(buf + 44);\n    fourxm->tracks[track].audio_pts   = 0;\n    if (fourxm->tracks[track].channels    <= 0 ||\n        fourxm->tracks[track].sample_rate <= 0 ||\n        fourxm->tracks[track].bits        <= 0) {\n        av_log(s, AV_LOG_ERROR, "audio header invalid\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    st = avformat_new_stream(s, NULL);\n    if (!st)\n        return AVERROR(ENOMEM);\n    st->id = track;\n    avpriv_set_pts_info(st, 60, 1, fourxm->tracks[track].sample_rate);\n    fourxm->tracks[track].stream_index = st->index;\n    st->codecpar->codec_type            = AVMEDIA_TYPE_AUDIO;\n    st->codecpar->codec_tag             = 0;\n    st->codecpar->channels              = fourxm->tracks[track].channels;\n    st->codecpar->sample_rate           = fourxm->tracks[track].sample_rate;\n    st->codecpar->bits_per_coded_sample = fourxm->tracks[track].bits;\n    st->codecpar->bit_rate              = st->codecpar->channels *\n                                          st->codecpar->sample_rate *\n                                          st->codecpar->bits_per_coded_sample;\n    st->codecpar->block_align           = st->codecpar->channels *\n                                          st->codecpar->bits_per_coded_sample;\n    if (fourxm->tracks[track].adpcm){\n        st->codecpar->codec_id = AV_CODEC_ID_ADPCM_4XM;\n    } else if (st->codecpar->bits_per_coded_sample == 8) {\n        st->codecpar->codec_id = AV_CODEC_ID_PCM_U8;\n    } else\n        st->codecpar->codec_id = AV_CODEC_ID_PCM_S16LE;\n    return 0;\n}']