libavcodec/faxcompr.c:281: error: Null Dereference
  pointer `ref` last assigned on line 280 could be null and is dereferenced at line 281, column 5.

libavcodec/faxcompr.c:269:1: start of procedure ff_ccitt_unpack()
267. }
268. 
269. int ff_ccitt_unpack(AVCodecContext *avctx,
     ^
270.                        const uint8_t *src, int srcsize,
271.                        uint8_t *dst, int height, int stride, enum TiffCompr compr)

libavcodec/faxcompr.c:277:5: 
275.     int *runs, *ref, *runend;
276.     int ret;
277.     int runsize= avctx->width + 2;
         ^
278. 
279.     runs = av_malloc(runsize * sizeof(runs[0]));

libavcodec/faxcompr.c:279:5: 
277.     int runsize= avctx->width + 2;
278. 
279.     runs = av_malloc(runsize * sizeof(runs[0]));
         ^
280.     ref  = av_malloc(runsize * sizeof(ref[0]));
281.     ref[0] = avctx->width;

libavutil/mem.c:42:1: start of procedure av_malloc()
  40.    linker will do it automatically */
  41. 
  42. void *av_malloc(unsigned int size)
      ^
  43. {
  44.     void *ptr;

libavutil/mem.c:50:8: Taking true branch
  48. 
  49.     /* let's disallow possible ambiguous cases */
  50.     if(size > (INT_MAX-16) )
             ^
  51.         return NULL;
  52. 

libavutil/mem.c:51:9: 
  49.     /* let's disallow possible ambiguous cases */
  50.     if(size > (INT_MAX-16) )
  51.         return NULL;
              ^
  52. 
  53. #ifdef CONFIG_MEMALIGN_HACK

libavutil/mem.c:92:1: return from a call to av_malloc
  90. #endif
  91.     return ptr;
  92. }
      ^
  93. 
  94. void *av_realloc(void *ptr, unsigned int size)

libavcodec/faxcompr.c:280:5: 
278. 
279.     runs = av_malloc(runsize * sizeof(runs[0]));
280.     ref  = av_malloc(runsize * sizeof(ref[0]));
         ^
281.     ref[0] = avctx->width;
282.     ref[1] = 0;

libavutil/mem.c:42:1: start of procedure av_malloc()
  40.    linker will do it automatically */
  41. 
  42. void *av_malloc(unsigned int size)
      ^
  43. {
  44.     void *ptr;

libavutil/mem.c:50:8: Taking true branch
  48. 
  49.     /* let's disallow possible ambiguous cases */
  50.     if(size > (INT_MAX-16) )
             ^
  51.         return NULL;
  52. 

libavutil/mem.c:51:9: 
  49.     /* let's disallow possible ambiguous cases */
  50.     if(size > (INT_MAX-16) )
  51.         return NULL;
              ^
  52. 
  53. #ifdef CONFIG_MEMALIGN_HACK

libavutil/mem.c:92:1: return from a call to av_malloc
  90. #endif
  91.     return ptr;
  92. }
      ^
  93. 
  94. void *av_realloc(void *ptr, unsigned int size)

libavcodec/faxcompr.c:281:5: 
279.     runs = av_malloc(runsize * sizeof(runs[0]));
280.     ref  = av_malloc(runsize * sizeof(ref[0]));
281.     ref[0] = avctx->width;
         ^
282.     ref[1] = 0;
283.     ref[2] = 0;

int ff_ccitt_unpack(AVCodecContext *avctx,
                       const uint8_t *src, int srcsize,
                       uint8_t *dst, int height, int stride, enum TiffCompr compr)
{
    int j;
    GetBitContext gb;
    int *runs, *ref, *runend;
    int ret;
    int runsize= avctx->width + 2;
    runs = av_malloc(runsize * sizeof(runs[0]));
    ref  = av_malloc(runsize * sizeof(ref[0]));
    ref[0] = avctx->width;
    ref[1] = 0;
    ref[2] = 0;
    init_get_bits(&gb, src, srcsize*8);
    for(j = 0; j < height; j++){
        runend = runs + runsize;
        if(compr == TIFF_G4){
            ret = decode_group3_2d_line(avctx, &gb, avctx->width, runs, runend, ref);
            if(ret < 0){
                av_free(runs);
                av_free(ref);
                return -1;
            }
        }else{
            if(find_group3_syncmarker(&gb, srcsize*8) < 0)
                break;
            if(compr==TIFF_CCITT_RLE || get_bits1(&gb))
                ret = decode_group3_1d_line(avctx, &gb, avctx->width, runs, runend);
            else
                ret = decode_group3_2d_line(avctx, &gb, avctx->width, runs, runend, ref);
        }
        if(ret < 0){
            put_line(dst, stride, avctx->width, ref);
        }else{
            put_line(dst, stride, avctx->width, runs);
            FFSWAP(int*, runs, ref);
        }
        dst += stride;
    }
    av_free(runs);
    av_free(ref);
    return 0;
}
['int ff_ccitt_unpack(AVCodecContext *avctx,\n                       const uint8_t *src, int srcsize,\n                       uint8_t *dst, int height, int stride, enum TiffCompr compr)\n{\n    int j;\n    GetBitContext gb;\n    int *runs, *ref, *runend;\n    int ret;\n    int runsize= avctx->width + 2;\n    runs = av_malloc(runsize * sizeof(runs[0]));\n    ref  = av_malloc(runsize * sizeof(ref[0]));\n    ref[0] = avctx->width;\n    ref[1] = 0;\n    ref[2] = 0;\n    init_get_bits(&gb, src, srcsize*8);\n    for(j = 0; j < height; j++){\n        runend = runs + runsize;\n        if(compr == TIFF_G4){\n            ret = decode_group3_2d_line(avctx, &gb, avctx->width, runs, runend, ref);\n            if(ret < 0){\n                av_free(runs);\n                av_free(ref);\n                return -1;\n            }\n        }else{\n            if(find_group3_syncmarker(&gb, srcsize*8) < 0)\n                break;\n            if(compr==TIFF_CCITT_RLE || get_bits1(&gb))\n                ret = decode_group3_1d_line(avctx, &gb, avctx->width, runs, runend);\n            else\n                ret = decode_group3_2d_line(avctx, &gb, avctx->width, runs, runend, ref);\n        }\n        if(ret < 0){\n            put_line(dst, stride, avctx->width, ref);\n        }else{\n            put_line(dst, stride, avctx->width, runs);\n            FFSWAP(int*, runs, ref);\n        }\n        dst += stride;\n    }\n    av_free(runs);\n    av_free(ref);\n    return 0;\n}', 'void *av_malloc(unsigned int size)\n{\n    void *ptr;\n#ifdef CONFIG_MEMALIGN_HACK\n    long diff;\n#endif\n    if(size > (INT_MAX-16) )\n        return NULL;\n#ifdef CONFIG_MEMALIGN_HACK\n    ptr = malloc(size+16);\n    if(!ptr)\n        return ptr;\n    diff= ((-(long)ptr - 1)&15) + 1;\n    ptr = (char*)ptr + diff;\n    ((char*)ptr)[-1]= diff;\n#elif defined (HAVE_MEMALIGN)\n    ptr = memalign(16,size);\n#else\n    ptr = malloc(size);\n#endif\n    return ptr;\n}']