libavformat/cutils.c:39: error: Null Dereference
  pointer `tab` last assigned on line 36 could be null and is dereferenced at line 39, column 5.

libavformat/cutils.c:24:1: start of procedure ff_dynarray_add()
22. 
23. /* add one element to a dynamic array */
24. void ff_dynarray_add(intptr_t **tab_ptr, int *nb_ptr, intptr_t elem)
    ^
25. {
26.     int nb, nb_alloc;

libavformat/cutils.c:29:5: 
27.     intptr_t *tab;
28. 
29.     nb = *nb_ptr;
        ^
30.     tab = *tab_ptr;
31.     if ((nb & (nb - 1)) == 0) {

libavformat/cutils.c:30:5: 
28. 
29.     nb = *nb_ptr;
30.     tab = *tab_ptr;
        ^
31.     if ((nb & (nb - 1)) == 0) {
32.         if (nb == 0)

libavformat/cutils.c:31:9: Taking true branch
29.     nb = *nb_ptr;
30.     tab = *tab_ptr;
31.     if ((nb & (nb - 1)) == 0) {
            ^
32.         if (nb == 0)
33.             nb_alloc = 1;

libavformat/cutils.c:32:13: Taking false branch
30.     tab = *tab_ptr;
31.     if ((nb & (nb - 1)) == 0) {
32.         if (nb == 0)
                ^
33.             nb_alloc = 1;
34.         else

libavformat/cutils.c:35:13: 
33.             nb_alloc = 1;
34.         else
35.             nb_alloc = nb * 2;
                ^
36.         tab = av_realloc(tab, nb_alloc * sizeof(intptr_t));
37.         *tab_ptr = tab;

libavformat/cutils.c:36:9: 
34.         else
35.             nb_alloc = nb * 2;
36.         tab = av_realloc(tab, nb_alloc * sizeof(intptr_t));
            ^
37.         *tab_ptr = tab;
38.     }

libavutil/mem.c:101:1: start of procedure av_realloc()
   99. }
  100. 
  101. void *av_realloc(void *ptr, unsigned int size)
       ^
  102. {
  103. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:108:8: Taking false branch
  106. 
  107.     /* let's disallow possible ambiguous cases */
  108.     if(size > (INT_MAX-16) )
              ^
  109.         return NULL;
  110. 

libavutil/mem.c:117:5: 
  115.     return (char*)realloc((char*)ptr - diff, size + diff) + diff;
  116. #else
  117.     return realloc(ptr, size);
           ^
  118. #endif
  119. }

libavutil/mem.c:119:1: return from a call to av_realloc
  117.     return realloc(ptr, size);
  118. #endif
  119. }
       ^
  120. 
  121. void av_free(void *ptr)

libavformat/cutils.c:37:9: 
35.             nb_alloc = nb * 2;
36.         tab = av_realloc(tab, nb_alloc * sizeof(intptr_t));
37.         *tab_ptr = tab;
            ^
38.     }
39.     tab[nb++] = elem;

libavformat/cutils.c:39:5: 
37.         *tab_ptr = tab;
38.     }
39.     tab[nb++] = elem;
        ^
40.     *nb_ptr = nb;
41. }

void ff_dynarray_add(intptr_t **tab_ptr, int *nb_ptr, intptr_t elem)
{
    int nb, nb_alloc;
    intptr_t *tab;
    nb = *nb_ptr;
    tab = *tab_ptr;
    if ((nb & (nb - 1)) == 0) {
        if (nb == 0)
            nb_alloc = 1;
        else
            nb_alloc = nb * 2;
        tab = av_realloc(tab, nb_alloc * sizeof(intptr_t));
        *tab_ptr = tab;
    }
    tab[nb++] = elem;
    *nb_ptr = nb;
}
['void ff_dynarray_add(intptr_t **tab_ptr, int *nb_ptr, intptr_t elem)\n{\n    int nb, nb_alloc;\n    intptr_t *tab;\n    nb = *nb_ptr;\n    tab = *tab_ptr;\n    if ((nb & (nb - 1)) == 0) {\n        if (nb == 0)\n            nb_alloc = 1;\n        else\n            nb_alloc = nb * 2;\n        tab = av_realloc(tab, nb_alloc * sizeof(intptr_t));\n        *tab_ptr = tab;\n    }\n    tab[nb++] = elem;\n    *nb_ptr = nb;\n}', 'void *av_realloc(void *ptr, unsigned int size)\n{\n#if CONFIG_MEMALIGN_HACK\n    int diff;\n#endif\n    if(size > (INT_MAX-16) )\n        return NULL;\n#if CONFIG_MEMALIGN_HACK\n    if(!ptr) return av_malloc(size);\n    diff= ((char*)ptr)[-1];\n    return (char*)realloc((char*)ptr - diff, size + diff) + diff;\n#else\n    return realloc(ptr, size);\n#endif\n}']