libavcodec/svq3.c:1039: error: Null Dereference
  pointer `s->gb_slice.buffer` last assigned on line 1036 could be null and is dereferenced at line 1039, column 31.

libavcodec/svq3.c:1002:1: start of procedure svq3_decode_slice_header()
1000. }
1001. 
1002. static int svq3_decode_slice_header(AVCodecContext *avctx)
      ^
1003. {
1004.     SVQ3Context *s = avctx->priv_data;

libavcodec/svq3.c:1004:5: 
1002. static int svq3_decode_slice_header(AVCodecContext *avctx)
1003. {
1004.     SVQ3Context *s = avctx->priv_data;
          ^
1005.     const int mb_xy   = s->mb_xy;
1006.     int i, header;

libavcodec/svq3.c:1005:5: 
1003. {
1004.     SVQ3Context *s = avctx->priv_data;
1005.     const int mb_xy   = s->mb_xy;
          ^
1006.     int i, header;
1007.     unsigned slice_id;

libavcodec/svq3.c:1009:5: Skipping get_bits(): empty list of specs
1007.     unsigned slice_id;
1008. 
1009.     header = get_bits(&s->gb, 8);
          ^
1010. 
1011.     if (((header & 0x9F) != 1 && (header & 0x9F) != 2) || (header & 0x60) == 0) {

libavcodec/svq3.c:1011:10: Taking false branch
1009.     header = get_bits(&s->gb, 8);
1010. 
1011.     if (((header & 0x9F) != 1 && (header & 0x9F) != 2) || (header & 0x60) == 0) {
               ^
1012.         /* TODO: what? */
1013.         av_log(avctx, AV_LOG_ERROR, "unsupported slice header (%02X)\n", header);

libavcodec/svq3.c:1011:59: Taking false branch
1009.     header = get_bits(&s->gb, 8);
1010. 
1011.     if (((header & 0x9F) != 1 && (header & 0x9F) != 2) || (header & 0x60) == 0) {
                                                                ^
1012.         /* TODO: what? */
1013.         av_log(avctx, AV_LOG_ERROR, "unsupported slice header (%02X)\n", header);

libavcodec/svq3.c:1017:9: 
1015.     } else {
1016.         int slice_bits, slice_bytes, slice_length;
1017.         int length = header >> 5 & 3;
              ^
1018. 
1019.         slice_length = show_bits(&s->gb, 8 * length);

libavcodec/svq3.c:1019:9: Skipping show_bits(): empty list of specs
1017.         int length = header >> 5 & 3;
1018. 
1019.         slice_length = show_bits(&s->gb, 8 * length);
              ^
1020.         slice_bits   = slice_length * 8;
1021.         slice_bytes  = slice_length + length - 1;

libavcodec/svq3.c:1020:9: 
1018. 
1019.         slice_length = show_bits(&s->gb, 8 * length);
1020.         slice_bits   = slice_length * 8;
              ^
1021.         slice_bytes  = slice_length + length - 1;
1022. 

libavcodec/svq3.c:1021:9: 
1019.         slice_length = show_bits(&s->gb, 8 * length);
1020.         slice_bits   = slice_length * 8;
1021.         slice_bytes  = slice_length + length - 1;
              ^
1022. 
1023.         if (slice_bytes > get_bits_left(&s->gb)) {

libavcodec/svq3.c:1023:13: 
1021.         slice_bytes  = slice_length + length - 1;
1022. 
1023.         if (slice_bytes > get_bits_left(&s->gb)) {
                  ^
1024.             av_log(avctx, AV_LOG_ERROR, "slice after bitstream end\n");
1025.             return -1;

libavcodec/get_bits.h:575:1: start of procedure get_bits_left()
  573. }
  574. 
  575. static inline int get_bits_left(GetBitContext *gb)
       ^
  576. {
  577.     return gb->size_in_bits - get_bits_count(gb);

libavcodec/get_bits.h:577:5: 
  575. static inline int get_bits_left(GetBitContext *gb)
  576. {
  577.     return gb->size_in_bits - get_bits_count(gb);
           ^
  578. }
  579. 

libavcodec/get_bits.h:195:1: start of procedure get_bits_count()
    193. #define GET_CACHE(name, gb) ((uint32_t) name ## _cache)
    194. 
    195. static inline int get_bits_count(const GetBitContext *s)
         ^
    196. {
    197.     return s->index;

libavcodec/get_bits.h:197:5: 
    195. static inline int get_bits_count(const GetBitContext *s)
    196. {
    197.     return s->index;
             ^
    198. }
    199. 

libavcodec/get_bits.h:198:1: return from a call to get_bits_count
    196. {
    197.     return s->index;
    198. }
         ^
    199. 
    200. static inline void skip_bits_long(GetBitContext *s, int n)

libavcodec/get_bits.h:578:1: return from a call to get_bits_left
  576. {
  577.     return gb->size_in_bits - get_bits_count(gb);
  578. }
       ^
  579. 
  580. //#define TRACE

libavcodec/svq3.c:1023:13: Taking false branch
1021.         slice_bytes  = slice_length + length - 1;
1022. 
1023.         if (slice_bytes > get_bits_left(&s->gb)) {
                  ^
1024.             av_log(avctx, AV_LOG_ERROR, "slice after bitstream end\n");
1025.             return -1;

libavcodec/svq3.c:1028:9: Skipping skip_bits(): empty list of specs
1026.         }
1027. 
1028.         skip_bits(&s->gb, 8);
              ^
1029. 
1030.         av_fast_malloc(&s->slice_buf, &s->slice_size, slice_bytes + AV_INPUT_BUFFER_PADDING_SIZE);

libavcodec/svq3.c:1030:9: 
1028.         skip_bits(&s->gb, 8);
1029. 
1030.         av_fast_malloc(&s->slice_buf, &s->slice_size, slice_bytes + AV_INPUT_BUFFER_PADDING_SIZE);
              ^
1031.         if (!s->slice_buf)
1032.             return AVERROR(ENOMEM);

libavutil/mem.c:394:1: start of procedure av_fast_malloc()
  392. }
  393. 
  394. void av_fast_malloc(void *ptr, unsigned int *size, size_t min_size)
       ^
  395. {
  396.     void **p = ptr;

libavutil/mem.c:396:5: 
  394. void av_fast_malloc(void *ptr, unsigned int *size, size_t min_size)
  395. {
  396.     void **p = ptr;
           ^
  397.     if (min_size < *size)
  398.         return;

libavutil/mem.c:397:9: Taking true branch
  395. {
  396.     void **p = ptr;
  397.     if (min_size < *size)
               ^
  398.         return;
  399.     min_size = FFMAX(17 * min_size / 16 + 32, min_size);

libavutil/mem.c:398:9: 
  396.     void **p = ptr;
  397.     if (min_size < *size)
  398.         return;
               ^
  399.     min_size = FFMAX(17 * min_size / 16 + 32, min_size);
  400.     av_free(*p);

libavutil/mem.c:405:1: return from a call to av_fast_malloc
  403.         min_size = 0;
  404.     *size = min_size;
  405. }
       ^

libavcodec/svq3.c:1031:14: Taking false branch
1029. 
1030.         av_fast_malloc(&s->slice_buf, &s->slice_size, slice_bytes + AV_INPUT_BUFFER_PADDING_SIZE);
1031.         if (!s->slice_buf)
                   ^
1032.             return AVERROR(ENOMEM);
1033. 

libavcodec/svq3.c:1034:9: 
1032.             return AVERROR(ENOMEM);
1033. 
1034.         memcpy(s->slice_buf, s->gb.buffer + s->gb.index / 8, slice_bytes);
              ^
1035. 
1036.         init_get_bits(&s->gb_slice, s->slice_buf, slice_bits);

libavcodec/svq3.c:1036:9: 
1034.         memcpy(s->slice_buf, s->gb.buffer + s->gb.index / 8, slice_bytes);
1035. 
1036.         init_get_bits(&s->gb_slice, s->slice_buf, slice_bits);
              ^
1037. 
1038.         if (s->watermark_key) {

libavcodec/get_bits.h:384:1: start of procedure init_get_bits()
  382.  * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
  383.  */
  384. static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
       ^
  385.                                 int bit_size)
  386. {

libavcodec/get_bits.h:388:5: 
  386. {
  387.     int buffer_size;
  388.     int ret = 0;
           ^
  389. 
  390.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {

libavcodec/get_bits.h:390:9: Taking true branch
  388.     int ret = 0;
  389. 
  390.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
               ^
  391.         bit_size    = 0;
  392.         buffer      = NULL;

libavcodec/get_bits.h:391:9: 
  389. 
  390.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
  391.         bit_size    = 0;
               ^
  392.         buffer      = NULL;
  393.         ret         = AVERROR_INVALIDDATA;

libavcodec/get_bits.h:392:9: 
  390.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
  391.         bit_size    = 0;
  392.         buffer      = NULL;
               ^
  393.         ret         = AVERROR_INVALIDDATA;
  394.     }

libavcodec/get_bits.h:393:9: 
  391.         bit_size    = 0;
  392.         buffer      = NULL;
  393.         ret         = AVERROR_INVALIDDATA;
               ^
  394.     }
  395. 

libavcodec/get_bits.h:396:5: 
  394.     }
  395. 
  396.     buffer_size = (bit_size + 7) >> 3;
           ^
  397. 
  398.     s->buffer             = buffer;

libavcodec/get_bits.h:398:5: 
  396.     buffer_size = (bit_size + 7) >> 3;
  397. 
  398.     s->buffer             = buffer;
           ^
  399.     s->size_in_bits       = bit_size;
  400. #if !UNCHECKED_BITSTREAM_READER

libavcodec/get_bits.h:399:5: 
  397. 
  398.     s->buffer             = buffer;
  399.     s->size_in_bits       = bit_size;
           ^
  400. #if !UNCHECKED_BITSTREAM_READER
  401.     s->size_in_bits_plus8 = bit_size + 8;

libavcodec/get_bits.h:401:5: 
  399.     s->size_in_bits       = bit_size;
  400. #if !UNCHECKED_BITSTREAM_READER
  401.     s->size_in_bits_plus8 = bit_size + 8;
           ^
  402. #endif
  403.     s->buffer_end         = buffer + buffer_size;

libavcodec/get_bits.h:403:5: 
  401.     s->size_in_bits_plus8 = bit_size + 8;
  402. #endif
  403.     s->buffer_end         = buffer + buffer_size;
           ^
  404.     s->index              = 0;
  405. 

libavcodec/get_bits.h:404:5: 
  402. #endif
  403.     s->buffer_end         = buffer + buffer_size;
  404.     s->index              = 0;
           ^
  405. 
  406.     return ret;

libavcodec/get_bits.h:406:5: 
  404.     s->index              = 0;
  405. 
  406.     return ret;
           ^
  407. }
  408. 

libavcodec/get_bits.h:407:1: return from a call to init_get_bits
  405. 
  406.     return ret;
  407. }
       ^
  408. 
  409. /**

libavcodec/svq3.c:1038:13: Taking true branch
1036.         init_get_bits(&s->gb_slice, s->slice_buf, slice_bits);
1037. 
1038.         if (s->watermark_key) {
                  ^
1039.             uint32_t header = AV_RL32(&s->gb_slice.buffer[1]);
1040.             AV_WL32(&s->gb_slice.buffer[1], header ^ s->watermark_key);

libavcodec/svq3.c:1039:13: 
1037. 
1038.         if (s->watermark_key) {
1039.             uint32_t header = AV_RL32(&s->gb_slice.buffer[1]);
                  ^
1040.             AV_WL32(&s->gb_slice.buffer[1], header ^ s->watermark_key);
1041.         }

static int svq3_decode_slice_header(AVCodecContext *avctx)
{
    SVQ3Context *s = avctx->priv_data;
    const int mb_xy   = s->mb_xy;
    int i, header;
    unsigned slice_id;
    header = get_bits(&s->gb, 8);
    if (((header & 0x9F) != 1 && (header & 0x9F) != 2) || (header & 0x60) == 0) {
        av_log(avctx, AV_LOG_ERROR, "unsupported slice header (%02X)\n", header);
        return -1;
    } else {
        int slice_bits, slice_bytes, slice_length;
        int length = header >> 5 & 3;
        slice_length = show_bits(&s->gb, 8 * length);
        slice_bits   = slice_length * 8;
        slice_bytes  = slice_length + length - 1;
        if (slice_bytes > get_bits_left(&s->gb)) {
            av_log(avctx, AV_LOG_ERROR, "slice after bitstream end\n");
            return -1;
        }
        skip_bits(&s->gb, 8);
        av_fast_malloc(&s->slice_buf, &s->slice_size, slice_bytes + AV_INPUT_BUFFER_PADDING_SIZE);
        if (!s->slice_buf)
            return AVERROR(ENOMEM);
        memcpy(s->slice_buf, s->gb.buffer + s->gb.index / 8, slice_bytes);
        init_get_bits(&s->gb_slice, s->slice_buf, slice_bits);
        if (s->watermark_key) {
            uint32_t header = AV_RL32(&s->gb_slice.buffer[1]);
            AV_WL32(&s->gb_slice.buffer[1], header ^ s->watermark_key);
        }
        if (length > 0) {
            memcpy(s->slice_buf, &s->slice_buf[slice_length], length - 1);
        }
        skip_bits_long(&s->gb, slice_bytes * 8);
    }
    if ((slice_id = svq3_get_ue_golomb(&s->gb_slice)) >= 3) {
        av_log(s->avctx, AV_LOG_ERROR, "illegal slice type %u \n", slice_id);
        return -1;
    }
    s->pict_type = ff_h264_golomb_to_pict_type[slice_id];
    if ((header & 0x9F) == 2) {
        i = (s->mb_num < 64) ? 6 : (1 + av_log2(s->mb_num - 1));
        get_bits(&s->gb_slice, i);
    } else {
        skip_bits1(&s->gb_slice);
    }
    s->slice_num      = get_bits(&s->gb_slice, 8);
    s->qscale         = get_bits(&s->gb_slice, 5);
    s->adaptive_quant = get_bits1(&s->gb_slice);
    skip_bits1(&s->gb_slice);
    if (s->unknown_flag)
        skip_bits1(&s->gb_slice);
    skip_bits1(&s->gb_slice);
    skip_bits(&s->gb_slice, 2);
    while (get_bits1(&s->gb_slice))
        skip_bits(&s->gb_slice, 8);
    if (s->mb_x > 0) {
        memset(s->intra4x4_pred_mode + s->mb2br_xy[mb_xy - 1] + 3,
               -1, 4 * sizeof(int8_t));
        memset(s->intra4x4_pred_mode + s->mb2br_xy[mb_xy - s->mb_x],
               -1, 8 * sizeof(int8_t) * s->mb_x);
    }
    if (s->mb_y > 0) {
        memset(s->intra4x4_pred_mode + s->mb2br_xy[mb_xy - s->mb_stride],
               -1, 8 * sizeof(int8_t) * (s->mb_width - s->mb_x));
        if (s->mb_x > 0)
            s->intra4x4_pred_mode[s->mb2br_xy[mb_xy - s->mb_stride - 1] + 3] = -1;
    }
    return 0;
}
['static int svq3_decode_slice_header(AVCodecContext *avctx)\n{\n    SVQ3Context *s = avctx->priv_data;\n    const int mb_xy   = s->mb_xy;\n    int i, header;\n    unsigned slice_id;\n    header = get_bits(&s->gb, 8);\n    if (((header & 0x9F) != 1 && (header & 0x9F) != 2) || (header & 0x60) == 0) {\n        av_log(avctx, AV_LOG_ERROR, "unsupported slice header (%02X)\\n", header);\n        return -1;\n    } else {\n        int slice_bits, slice_bytes, slice_length;\n        int length = header >> 5 & 3;\n        slice_length = show_bits(&s->gb, 8 * length);\n        slice_bits   = slice_length * 8;\n        slice_bytes  = slice_length + length - 1;\n        if (slice_bytes > get_bits_left(&s->gb)) {\n            av_log(avctx, AV_LOG_ERROR, "slice after bitstream end\\n");\n            return -1;\n        }\n        skip_bits(&s->gb, 8);\n        av_fast_malloc(&s->slice_buf, &s->slice_size, slice_bytes + AV_INPUT_BUFFER_PADDING_SIZE);\n        if (!s->slice_buf)\n            return AVERROR(ENOMEM);\n        memcpy(s->slice_buf, s->gb.buffer + s->gb.index / 8, slice_bytes);\n        init_get_bits(&s->gb_slice, s->slice_buf, slice_bits);\n        if (s->watermark_key) {\n            uint32_t header = AV_RL32(&s->gb_slice.buffer[1]);\n            AV_WL32(&s->gb_slice.buffer[1], header ^ s->watermark_key);\n        }\n        if (length > 0) {\n            memcpy(s->slice_buf, &s->slice_buf[slice_length], length - 1);\n        }\n        skip_bits_long(&s->gb, slice_bytes * 8);\n    }\n    if ((slice_id = svq3_get_ue_golomb(&s->gb_slice)) >= 3) {\n        av_log(s->avctx, AV_LOG_ERROR, "illegal slice type %u \\n", slice_id);\n        return -1;\n    }\n    s->pict_type = ff_h264_golomb_to_pict_type[slice_id];\n    if ((header & 0x9F) == 2) {\n        i = (s->mb_num < 64) ? 6 : (1 + av_log2(s->mb_num - 1));\n        get_bits(&s->gb_slice, i);\n    } else {\n        skip_bits1(&s->gb_slice);\n    }\n    s->slice_num      = get_bits(&s->gb_slice, 8);\n    s->qscale         = get_bits(&s->gb_slice, 5);\n    s->adaptive_quant = get_bits1(&s->gb_slice);\n    skip_bits1(&s->gb_slice);\n    if (s->unknown_flag)\n        skip_bits1(&s->gb_slice);\n    skip_bits1(&s->gb_slice);\n    skip_bits(&s->gb_slice, 2);\n    while (get_bits1(&s->gb_slice))\n        skip_bits(&s->gb_slice, 8);\n    if (s->mb_x > 0) {\n        memset(s->intra4x4_pred_mode + s->mb2br_xy[mb_xy - 1] + 3,\n               -1, 4 * sizeof(int8_t));\n        memset(s->intra4x4_pred_mode + s->mb2br_xy[mb_xy - s->mb_x],\n               -1, 8 * sizeof(int8_t) * s->mb_x);\n    }\n    if (s->mb_y > 0) {\n        memset(s->intra4x4_pred_mode + s->mb2br_xy[mb_xy - s->mb_stride],\n               -1, 8 * sizeof(int8_t) * (s->mb_width - s->mb_x));\n        if (s->mb_x > 0)\n            s->intra4x4_pred_mode[s->mb2br_xy[mb_xy - s->mb_stride - 1] + 3] = -1;\n    }\n    return 0;\n}', 'static inline int get_bits_left(GetBitContext *gb)\n{\n    return gb->size_in_bits - get_bits_count(gb);\n}', 'static inline int get_bits_count(const GetBitContext *s)\n{\n    return s->index;\n}', 'void av_fast_malloc(void *ptr, unsigned int *size, size_t min_size)\n{\n    void **p = ptr;\n    if (min_size < *size)\n        return;\n    min_size = FFMAX(17 * min_size / 16 + 32, min_size);\n    av_free(*p);\n    *p = av_malloc(min_size);\n    if (!*p)\n        min_size = 0;\n    *size = min_size;\n}', 'static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,\n                                int bit_size)\n{\n    int buffer_size;\n    int ret = 0;\n    if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {\n        bit_size    = 0;\n        buffer      = NULL;\n        ret         = AVERROR_INVALIDDATA;\n    }\n    buffer_size = (bit_size + 7) >> 3;\n    s->buffer             = buffer;\n    s->size_in_bits       = bit_size;\n#if !UNCHECKED_BITSTREAM_READER\n    s->size_in_bits_plus8 = bit_size + 8;\n#endif\n    s->buffer_end         = buffer + buffer_size;\n    s->index              = 0;\n    return ret;\n}']