libavcodec/mpc7.c:181: error: Null Dereference
  pointer `&gb->buffer` last assigned on line 180 could be null and is dereferenced by call to `skip_bits()` at line 181, column 5.

libavcodec/mpc7.c:160:1: start of procedure mpc7_decode_frame()
158. }
159. 
160. static int mpc7_decode_frame(AVCodecContext * avctx,
     ^
161.                             void *data, int *data_size,
162.                             const uint8_t * buf, int buf_size)

libavcodec/mpc7.c:164:5: 
162.                             const uint8_t * buf, int buf_size)
163. {
164.     MPCContext *c = avctx->priv_data;
         ^
165.     GetBitContext gb;
166.     uint8_t *bits;

libavcodec/mpc7.c:168:5: 
166.     uint8_t *bits;
167.     int i, ch, t;
168.     int mb = -1;
         ^
169.     Band *bands = c->bands;
170.     int off;

libavcodec/mpc7.c:169:5: 
167.     int i, ch, t;
168.     int mb = -1;
169.     Band *bands = c->bands;
         ^
170.     int off;
171.     int bits_used, bits_avail;

libavcodec/mpc7.c:173:5: 
171.     int bits_used, bits_avail;
172. 
173.     memset(bands, 0, sizeof(bands));
         ^
174.     if(buf_size <= 4){
175.         av_log(avctx, AV_LOG_ERROR, "Too small buffer passed (%i bytes)\n", buf_size);

libavcodec/mpc7.c:174:8: Taking true branch
172. 
173.     memset(bands, 0, sizeof(bands));
174.     if(buf_size <= 4){
            ^
175.         av_log(avctx, AV_LOG_ERROR, "Too small buffer passed (%i bytes)\n", buf_size);
176.     }

libavcodec/mpc7.c:175:9: Skipping av_log(): empty list of specs
173.     memset(bands, 0, sizeof(bands));
174.     if(buf_size <= 4){
175.         av_log(avctx, AV_LOG_ERROR, "Too small buffer passed (%i bytes)\n", buf_size);
             ^
176.     }
177. 

libavcodec/mpc7.c:178:5: 
176.     }
177. 
178.     bits = av_malloc(((buf_size - 1) & ~3) + FF_INPUT_BUFFER_PADDING_SIZE);
         ^
179.     c->dsp.bswap_buf((uint32_t*)bits, (const uint32_t*)(buf + 4), (buf_size - 4) >> 2);
180.     init_get_bits(&gb, bits, (buf_size - 4)* 8);

libavutil/mem.c:42:1: start of procedure av_malloc()
  40.    linker will do it automatically */
  41. 
  42. void *av_malloc(unsigned int size)
      ^
  43. {
  44.     void *ptr;

libavutil/mem.c:50:8: Taking true branch
  48. 
  49.     /* let's disallow possible ambiguous cases */
  50.     if(size > (INT_MAX-16) )
             ^
  51.         return NULL;
  52. 

libavutil/mem.c:51:9: 
  49.     /* let's disallow possible ambiguous cases */
  50.     if(size > (INT_MAX-16) )
  51.         return NULL;
              ^
  52. 
  53. #ifdef CONFIG_MEMALIGN_HACK

libavutil/mem.c:92:1: return from a call to av_malloc
  90. #endif
  91.     return ptr;
  92. }
      ^
  93. 
  94. void *av_realloc(void *ptr, unsigned int size)

libavcodec/mpc7.c:179:5: Skipping __function_pointer__(): unresolved function pointer
177. 
178.     bits = av_malloc(((buf_size - 1) & ~3) + FF_INPUT_BUFFER_PADDING_SIZE);
179.     c->dsp.bswap_buf((uint32_t*)bits, (const uint32_t*)(buf + 4), (buf_size - 4) >> 2);
         ^
180.     init_get_bits(&gb, bits, (buf_size - 4)* 8);
181.     skip_bits(&gb, buf[0]);

libavcodec/mpc7.c:180:5: 
178.     bits = av_malloc(((buf_size - 1) & ~3) + FF_INPUT_BUFFER_PADDING_SIZE);
179.     c->dsp.bswap_buf((uint32_t*)bits, (const uint32_t*)(buf + 4), (buf_size - 4) >> 2);
180.     init_get_bits(&gb, bits, (buf_size - 4)* 8);
         ^
181.     skip_bits(&gb, buf[0]);
182. 

libavcodec/bitstream.h:719:1: start of procedure init_get_bits()
  717.  * @param bit_size the size of the buffer in bits
  718.  */
  719. static inline void init_get_bits(GetBitContext *s,
       ^
  720.                    const uint8_t *buffer, int bit_size)
  721. {

libavcodec/bitstream.h:722:5: 
  720.                    const uint8_t *buffer, int bit_size)
  721. {
  722.     int buffer_size= (bit_size+7)>>3;
           ^
  723.     if(buffer_size < 0 || bit_size < 0) {
  724.         buffer_size = bit_size = 0;

libavcodec/bitstream.h:723:8: Taking false branch
  721. {
  722.     int buffer_size= (bit_size+7)>>3;
  723.     if(buffer_size < 0 || bit_size < 0) {
              ^
  724.         buffer_size = bit_size = 0;
  725.         buffer = NULL;

libavcodec/bitstream.h:723:27: Taking false branch
  721. {
  722.     int buffer_size= (bit_size+7)>>3;
  723.     if(buffer_size < 0 || bit_size < 0) {
                                 ^
  724.         buffer_size = bit_size = 0;
  725.         buffer = NULL;

libavcodec/bitstream.h:728:5: 
  726.     }
  727. 
  728.     s->buffer= buffer;
           ^
  729.     s->size_in_bits= bit_size;
  730.     s->buffer_end= buffer + buffer_size;

libavcodec/bitstream.h:729:5: 
  727. 
  728.     s->buffer= buffer;
  729.     s->size_in_bits= bit_size;
           ^
  730.     s->buffer_end= buffer + buffer_size;
  731. #ifdef ALT_BITSTREAM_READER

libavcodec/bitstream.h:730:5: 
  728.     s->buffer= buffer;
  729.     s->size_in_bits= bit_size;
  730.     s->buffer_end= buffer + buffer_size;
           ^
  731. #ifdef ALT_BITSTREAM_READER
  732.     s->index=0;

libavcodec/bitstream.h:732:5: 
  730.     s->buffer_end= buffer + buffer_size;
  731. #ifdef ALT_BITSTREAM_READER
  732.     s->index=0;
           ^
  733. #elif defined LIBMPEG2_BITSTREAM_READER
  734.     s->buffer_ptr = (uint8_t*)((intptr_t)buffer&(~1));

libavcodec/bitstream.h:742:1: return from a call to init_get_bits
  740.     skip_bits_long(s, 0);
  741. #endif
  742. }
       ^
  743. 
  744. static inline void align_get_bits(GetBitContext *s)

libavcodec/mpc7.c:181:5: 
179.     c->dsp.bswap_buf((uint32_t*)bits, (const uint32_t*)(buf + 4), (buf_size - 4) >> 2);
180.     init_get_bits(&gb, bits, (buf_size - 4)* 8);
181.     skip_bits(&gb, buf[0]);
         ^
182. 
183.     /* read subband indexes */

libavcodec/bitstream.h:639:1: start of procedure skip_bits()
  637. }
  638. 
  639. static inline void skip_bits(GetBitContext *s, int n){
       ^
  640.  //Note gcc seems to optimize this to s->index+=n for the ALT_READER :))
  641.     OPEN_READER(re, s)

libavcodec/bitstream.h:641:5: 
  639. static inline void skip_bits(GetBitContext *s, int n){
  640.  //Note gcc seems to optimize this to s->index+=n for the ALT_READER :))
  641.     OPEN_READER(re, s)
           ^
  642.     UPDATE_CACHE(re, s)
  643.     LAST_SKIP_BITS(re, s, n)

libavcodec/bitstream.h:642:5: 
  640.  //Note gcc seems to optimize this to s->index+=n for the ALT_READER :))
  641.     OPEN_READER(re, s)
  642.     UPDATE_CACHE(re, s)
           ^
  643.     LAST_SKIP_BITS(re, s, n)
  644.     CLOSE_READER(re, s)

static int mpc7_decode_frame(AVCodecContext * avctx,
                            void *data, int *data_size,
                            const uint8_t * buf, int buf_size)
{
    MPCContext *c = avctx->priv_data;
    GetBitContext gb;
    uint8_t *bits;
    int i, ch, t;
    int mb = -1;
    Band *bands = c->bands;
    int off;
    int bits_used, bits_avail;
    memset(bands, 0, sizeof(bands));
    if(buf_size <= 4){
        av_log(avctx, AV_LOG_ERROR, "Too small buffer passed (%i bytes)\n", buf_size);
    }
    bits = av_malloc(((buf_size - 1) & ~3) + FF_INPUT_BUFFER_PADDING_SIZE);
    c->dsp.bswap_buf((uint32_t*)bits, (const uint32_t*)(buf + 4), (buf_size - 4) >> 2);
    init_get_bits(&gb, bits, (buf_size - 4)* 8);
    skip_bits(&gb, buf[0]);
    for(i = 0; i <= c->maxbands; i++){
        for(ch = 0; ch < 2; ch++){
            if(i) t = get_vlc2(&gb, hdr_vlc.table, MPC7_HDR_BITS, 1) - 5;
            if(!i || (t == 4)) bands[i].res[ch] = get_bits(&gb, 4);
            else bands[i].res[ch] = bands[i-1].res[ch] + t;
        }
        if(bands[i].res[0] || bands[i].res[1]){
            mb = i;
            if(c->MSS) bands[i].msf = get_bits1(&gb);
        }
    }
    for(i = 0; i <= mb; i++)
        for(ch = 0; ch < 2; ch++)
            if(bands[i].res[ch]) bands[i].scfi[ch] = get_vlc2(&gb, scfi_vlc.table, MPC7_SCFI_BITS, 1);
    for(i = 0; i <= mb; i++){
        for(ch = 0; ch < 2; ch++){
            if(bands[i].res[ch]){
                bands[i].scf_idx[ch][2] = c->oldDSCF[ch][i];
                t = get_vlc2(&gb, dscf_vlc.table, MPC7_DSCF_BITS, 1) - 7;
                bands[i].scf_idx[ch][0] = (t == 8) ? get_bits(&gb, 6) : (bands[i].scf_idx[ch][2] + t);
                switch(bands[i].scfi[ch]){
                case 0:
                    t = get_vlc2(&gb, dscf_vlc.table, MPC7_DSCF_BITS, 1) - 7;
                    bands[i].scf_idx[ch][1] = (t == 8) ? get_bits(&gb, 6) : (bands[i].scf_idx[ch][0] + t);
                    t = get_vlc2(&gb, dscf_vlc.table, MPC7_DSCF_BITS, 1) - 7;
                    bands[i].scf_idx[ch][2] = (t == 8) ? get_bits(&gb, 6) : (bands[i].scf_idx[ch][1] + t);
                    break;
                case 1:
                    t = get_vlc2(&gb, dscf_vlc.table, MPC7_DSCF_BITS, 1) - 7;
                    bands[i].scf_idx[ch][1] = (t == 8) ? get_bits(&gb, 6) : (bands[i].scf_idx[ch][0] + t);
                    bands[i].scf_idx[ch][2] = bands[i].scf_idx[ch][1];
                    break;
                case 2:
                    bands[i].scf_idx[ch][1] = bands[i].scf_idx[ch][0];
                    t = get_vlc2(&gb, dscf_vlc.table, MPC7_DSCF_BITS, 1) - 7;
                    bands[i].scf_idx[ch][2] = (t == 8) ? get_bits(&gb, 6) : (bands[i].scf_idx[ch][1] + t);
                    break;
                case 3:
                    bands[i].scf_idx[ch][2] = bands[i].scf_idx[ch][1] = bands[i].scf_idx[ch][0];
                    break;
                }
                c->oldDSCF[ch][i] = bands[i].scf_idx[ch][2];
            }
        }
    }
    memset(c->Q, 0, sizeof(c->Q));
    off = 0;
    for(i = 0; i < BANDS; i++, off += SAMPLES_PER_BAND)
        for(ch = 0; ch < 2; ch++)
            idx_to_quant(c, &gb, bands[i].res[ch], c->Q[ch] + off);
    ff_mpc_dequantize_and_synth(c, mb, data);
    av_free(bits);
    bits_used = get_bits_count(&gb);
    bits_avail = (buf_size - 4) * 8;
    if(!buf[1] && ((bits_avail < bits_used) || (bits_used + 32 <= bits_avail))){
        av_log(NULL,0, "Error decoding frame: used %i of %i bits\n", bits_used, bits_avail);
        return -1;
    }
    if(c->frames_to_skip){
        c->frames_to_skip--;
        *data_size = 0;
        return buf_size;
    }
    *data_size = (buf[1] ? c->lastframelen : MPC_FRAME_SIZE) * 4;
    return buf_size;
}
['static int mpc7_decode_frame(AVCodecContext * avctx,\n                            void *data, int *data_size,\n                            const uint8_t * buf, int buf_size)\n{\n    MPCContext *c = avctx->priv_data;\n    GetBitContext gb;\n    uint8_t *bits;\n    int i, ch, t;\n    int mb = -1;\n    Band *bands = c->bands;\n    int off;\n    int bits_used, bits_avail;\n    memset(bands, 0, sizeof(bands));\n    if(buf_size <= 4){\n        av_log(avctx, AV_LOG_ERROR, "Too small buffer passed (%i bytes)\\n", buf_size);\n    }\n    bits = av_malloc(((buf_size - 1) & ~3) + FF_INPUT_BUFFER_PADDING_SIZE);\n    c->dsp.bswap_buf((uint32_t*)bits, (const uint32_t*)(buf + 4), (buf_size - 4) >> 2);\n    init_get_bits(&gb, bits, (buf_size - 4)* 8);\n    skip_bits(&gb, buf[0]);\n    for(i = 0; i <= c->maxbands; i++){\n        for(ch = 0; ch < 2; ch++){\n            if(i) t = get_vlc2(&gb, hdr_vlc.table, MPC7_HDR_BITS, 1) - 5;\n            if(!i || (t == 4)) bands[i].res[ch] = get_bits(&gb, 4);\n            else bands[i].res[ch] = bands[i-1].res[ch] + t;\n        }\n        if(bands[i].res[0] || bands[i].res[1]){\n            mb = i;\n            if(c->MSS) bands[i].msf = get_bits1(&gb);\n        }\n    }\n    for(i = 0; i <= mb; i++)\n        for(ch = 0; ch < 2; ch++)\n            if(bands[i].res[ch]) bands[i].scfi[ch] = get_vlc2(&gb, scfi_vlc.table, MPC7_SCFI_BITS, 1);\n    for(i = 0; i <= mb; i++){\n        for(ch = 0; ch < 2; ch++){\n            if(bands[i].res[ch]){\n                bands[i].scf_idx[ch][2] = c->oldDSCF[ch][i];\n                t = get_vlc2(&gb, dscf_vlc.table, MPC7_DSCF_BITS, 1) - 7;\n                bands[i].scf_idx[ch][0] = (t == 8) ? get_bits(&gb, 6) : (bands[i].scf_idx[ch][2] + t);\n                switch(bands[i].scfi[ch]){\n                case 0:\n                    t = get_vlc2(&gb, dscf_vlc.table, MPC7_DSCF_BITS, 1) - 7;\n                    bands[i].scf_idx[ch][1] = (t == 8) ? get_bits(&gb, 6) : (bands[i].scf_idx[ch][0] + t);\n                    t = get_vlc2(&gb, dscf_vlc.table, MPC7_DSCF_BITS, 1) - 7;\n                    bands[i].scf_idx[ch][2] = (t == 8) ? get_bits(&gb, 6) : (bands[i].scf_idx[ch][1] + t);\n                    break;\n                case 1:\n                    t = get_vlc2(&gb, dscf_vlc.table, MPC7_DSCF_BITS, 1) - 7;\n                    bands[i].scf_idx[ch][1] = (t == 8) ? get_bits(&gb, 6) : (bands[i].scf_idx[ch][0] + t);\n                    bands[i].scf_idx[ch][2] = bands[i].scf_idx[ch][1];\n                    break;\n                case 2:\n                    bands[i].scf_idx[ch][1] = bands[i].scf_idx[ch][0];\n                    t = get_vlc2(&gb, dscf_vlc.table, MPC7_DSCF_BITS, 1) - 7;\n                    bands[i].scf_idx[ch][2] = (t == 8) ? get_bits(&gb, 6) : (bands[i].scf_idx[ch][1] + t);\n                    break;\n                case 3:\n                    bands[i].scf_idx[ch][2] = bands[i].scf_idx[ch][1] = bands[i].scf_idx[ch][0];\n                    break;\n                }\n                c->oldDSCF[ch][i] = bands[i].scf_idx[ch][2];\n            }\n        }\n    }\n    memset(c->Q, 0, sizeof(c->Q));\n    off = 0;\n    for(i = 0; i < BANDS; i++, off += SAMPLES_PER_BAND)\n        for(ch = 0; ch < 2; ch++)\n            idx_to_quant(c, &gb, bands[i].res[ch], c->Q[ch] + off);\n    ff_mpc_dequantize_and_synth(c, mb, data);\n    av_free(bits);\n    bits_used = get_bits_count(&gb);\n    bits_avail = (buf_size - 4) * 8;\n    if(!buf[1] && ((bits_avail < bits_used) || (bits_used + 32 <= bits_avail))){\n        av_log(NULL,0, "Error decoding frame: used %i of %i bits\\n", bits_used, bits_avail);\n        return -1;\n    }\n    if(c->frames_to_skip){\n        c->frames_to_skip--;\n        *data_size = 0;\n        return buf_size;\n    }\n    *data_size = (buf[1] ? c->lastframelen : MPC_FRAME_SIZE) * 4;\n    return buf_size;\n}', 'void *av_malloc(unsigned int size)\n{\n    void *ptr;\n#ifdef CONFIG_MEMALIGN_HACK\n    long diff;\n#endif\n    if(size > (INT_MAX-16) )\n        return NULL;\n#ifdef CONFIG_MEMALIGN_HACK\n    ptr = malloc(size+16);\n    if(!ptr)\n        return ptr;\n    diff= ((-(long)ptr - 1)&15) + 1;\n    ptr = (char*)ptr + diff;\n    ((char*)ptr)[-1]= diff;\n#elif defined (HAVE_MEMALIGN)\n    ptr = memalign(16,size);\n#else\n    ptr = malloc(size);\n#endif\n    return ptr;\n}', 'static inline void init_get_bits(GetBitContext *s,\n                   const uint8_t *buffer, int bit_size)\n{\n    int buffer_size= (bit_size+7)>>3;\n    if(buffer_size < 0 || bit_size < 0) {\n        buffer_size = bit_size = 0;\n        buffer = NULL;\n    }\n    s->buffer= buffer;\n    s->size_in_bits= bit_size;\n    s->buffer_end= buffer + buffer_size;\n#ifdef ALT_BITSTREAM_READER\n    s->index=0;\n#elif defined LIBMPEG2_BITSTREAM_READER\n    s->buffer_ptr = (uint8_t*)((intptr_t)buffer&(~1));\n    s->bit_count = 16 + 8*((intptr_t)buffer&1);\n    skip_bits_long(s, 0);\n#elif defined A32_BITSTREAM_READER\n    s->buffer_ptr = (uint32_t*)((intptr_t)buffer&(~3));\n    s->bit_count = 32 + 8*((intptr_t)buffer&3);\n    skip_bits_long(s, 0);\n#endif\n}', 'static inline void skip_bits(GetBitContext *s, int n){\n    OPEN_READER(re, s)\n    UPDATE_CACHE(re, s)\n    LAST_SKIP_BITS(re, s, n)\n    CLOSE_READER(re, s)\n}']