libavcodec/eatgv.c:197: error: Null Dereference
  pointer `s->mv_codebook` last assigned on line 176 could be null and is dereferenced at line 197, column 9.

libavcodec/eatgv.c:147:1: start of procedure tgv_decode_inter()
145.  * @return 0 on success, -1 on critical buffer underflow
146.  */
147. static int tgv_decode_inter(TgvContext *s, AVFrame *frame,
     ^
148.                             const uint8_t *buf, const uint8_t *buf_end)
149. {

libavcodec/eatgv.c:159:9: Taking false branch
157.     const uint8_t *blocks_raw;
158. 
159.     if (buf + 12 > buf_end)
             ^
160.         return AVERROR_INVALIDDATA;
161. 

libavcodec/eatgv.c:162:5: 
160.         return AVERROR_INVALIDDATA;
161. 
162.     num_mvs           = AV_RL16(&buf[0]);
         ^
163.     num_blocks_raw    = AV_RL16(&buf[2]);
164.     num_blocks_packed = AV_RL16(&buf[4]);

libavcodec/eatgv.c:163:5: 
161. 
162.     num_mvs           = AV_RL16(&buf[0]);
163.     num_blocks_raw    = AV_RL16(&buf[2]);
         ^
164.     num_blocks_packed = AV_RL16(&buf[4]);
165.     vector_bits       = AV_RL16(&buf[6]);

libavcodec/eatgv.c:164:5: 
162.     num_mvs           = AV_RL16(&buf[0]);
163.     num_blocks_raw    = AV_RL16(&buf[2]);
164.     num_blocks_packed = AV_RL16(&buf[4]);
         ^
165.     vector_bits       = AV_RL16(&buf[6]);
166.     buf += 12;

libavcodec/eatgv.c:165:5: 
163.     num_blocks_raw    = AV_RL16(&buf[2]);
164.     num_blocks_packed = AV_RL16(&buf[4]);
165.     vector_bits       = AV_RL16(&buf[6]);
         ^
166.     buf += 12;
167. 

libavcodec/eatgv.c:166:5: 
164.     num_blocks_packed = AV_RL16(&buf[4]);
165.     vector_bits       = AV_RL16(&buf[6]);
166.     buf += 12;
         ^
167. 
168.     if (vector_bits > MIN_CACHE_BITS || !vector_bits) {

libavcodec/eatgv.c:168:9: Taking false branch
166.     buf += 12;
167. 
168.     if (vector_bits > MIN_CACHE_BITS || !vector_bits) {
             ^
169.         av_log(s->avctx, AV_LOG_ERROR,
170.                "Invalid value for motion vector bits: %d\n", vector_bits);

libavcodec/eatgv.c:168:42: Taking false branch
166.     buf += 12;
167. 
168.     if (vector_bits > MIN_CACHE_BITS || !vector_bits) {
                                              ^
169.         av_log(s->avctx, AV_LOG_ERROR,
170.                "Invalid value for motion vector bits: %d\n", vector_bits);

libavcodec/eatgv.c:175:9: Taking true branch
173. 
174.     /* allocate codebook buffers as necessary */
175.     if (num_mvs > s->num_mvs) {
             ^
176.         s->mv_codebook = av_realloc(s->mv_codebook, num_mvs*2*sizeof(int));
177.         s->num_mvs = num_mvs;

libavcodec/eatgv.c:176:9: 
174.     /* allocate codebook buffers as necessary */
175.     if (num_mvs > s->num_mvs) {
176.         s->mv_codebook = av_realloc(s->mv_codebook, num_mvs*2*sizeof(int));
             ^
177.         s->num_mvs = num_mvs;
178.     }

libavutil/mem.c:117:1: start of procedure av_realloc()
  115. }
  116. 
  117. void *av_realloc(void *ptr, size_t size)
       ^
  118. {
  119. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:124:9: Taking false branch
  122. 
  123.     /* let's disallow possibly ambiguous cases */
  124.     if (size > (INT_MAX - 16))
               ^
  125.         return NULL;
  126. 

libavutil/mem.c:136:5: 
  134.     return _aligned_realloc(ptr, size, 32);
  135. #else
  136.     return realloc(ptr, size);
           ^
  137. #endif
  138. }

libavutil/mem.c:138:1: return from a call to av_realloc
  136.     return realloc(ptr, size);
  137. #endif
  138. }
       ^
  139. 
  140. int av_reallocp(void *ptr, size_t size)

libavcodec/eatgv.c:177:9: 
175.     if (num_mvs > s->num_mvs) {
176.         s->mv_codebook = av_realloc(s->mv_codebook, num_mvs*2*sizeof(int));
177.         s->num_mvs = num_mvs;
             ^
178.     }
179. 

libavcodec/eatgv.c:180:9: Taking false branch
178.     }
179. 
180.     if (num_blocks_packed > s->num_blocks_packed) {
             ^
181.         int err;
182.         if ((err = av_reallocp(&s->block_codebook, num_blocks_packed * 16)) < 0) {

libavcodec/eatgv.c:190:5: 
188. 
189.     /* read motion vectors */
190.     mvbits = (num_mvs * 2 * 10 + 31) & ~31;
         ^
191. 
192.     if (buf + (mvbits >> 3) + 16 * num_blocks_raw + 8 * num_blocks_packed > buf_end)

libavcodec/eatgv.c:192:9: Taking false branch
190.     mvbits = (num_mvs * 2 * 10 + 31) & ~31;
191. 
192.     if (buf + (mvbits >> 3) + 16 * num_blocks_raw + 8 * num_blocks_packed > buf_end)
             ^
193.         return AVERROR_INVALIDDATA;
194. 

libavcodec/eatgv.c:195:5: 
193.         return AVERROR_INVALIDDATA;
194. 
195.     init_get_bits(&gb, buf, mvbits);
         ^
196.     for (i = 0; i < num_mvs; i++) {
197.         s->mv_codebook[i][0] = get_sbits(&gb, 10);

libavcodec/get_bits.h:376:1: start of procedure init_get_bits()
  374.  * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
  375.  */
  376. static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
       ^
  377.                                 int bit_size)
  378. {

libavcodec/get_bits.h:380:5: 
  378. {
  379.     int buffer_size;
  380.     int ret = 0;
           ^
  381. 
  382.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {

libavcodec/get_bits.h:382:9: Taking false branch
  380.     int ret = 0;
  381. 
  382.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
               ^
  383.         bit_size    = 0;
  384.         buffer      = NULL;

libavcodec/get_bits.h:382:35: Taking false branch
  380.     int ret = 0;
  381. 
  382.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
                                         ^
  383.         bit_size    = 0;
  384.         buffer      = NULL;

libavcodec/get_bits.h:382:52: Taking false branch
  380.     int ret = 0;
  381. 
  382.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
                                                          ^
  383.         bit_size    = 0;
  384.         buffer      = NULL;

libavcodec/get_bits.h:388:5: 
  386.     }
  387. 
  388.     buffer_size = (bit_size + 7) >> 3;
           ^
  389. 
  390.     s->buffer             = buffer;

libavcodec/get_bits.h:390:5: 
  388.     buffer_size = (bit_size + 7) >> 3;
  389. 
  390.     s->buffer             = buffer;
           ^
  391.     s->size_in_bits       = bit_size;
  392. #if !UNCHECKED_BITSTREAM_READER

libavcodec/get_bits.h:391:5: 
  389. 
  390.     s->buffer             = buffer;
  391.     s->size_in_bits       = bit_size;
           ^
  392. #if !UNCHECKED_BITSTREAM_READER
  393.     s->size_in_bits_plus8 = bit_size + 8;

libavcodec/get_bits.h:393:5: 
  391.     s->size_in_bits       = bit_size;
  392. #if !UNCHECKED_BITSTREAM_READER
  393.     s->size_in_bits_plus8 = bit_size + 8;
           ^
  394. #endif
  395.     s->buffer_end         = buffer + buffer_size;

libavcodec/get_bits.h:395:5: 
  393.     s->size_in_bits_plus8 = bit_size + 8;
  394. #endif
  395.     s->buffer_end         = buffer + buffer_size;
           ^
  396.     s->index              = 0;
  397. 

libavcodec/get_bits.h:396:5: 
  394. #endif
  395.     s->buffer_end         = buffer + buffer_size;
  396.     s->index              = 0;
           ^
  397. 
  398.     return ret;

libavcodec/get_bits.h:398:5: 
  396.     s->index              = 0;
  397. 
  398.     return ret;
           ^
  399. }
  400. 

libavcodec/get_bits.h:399:1: return from a call to init_get_bits
  397. 
  398.     return ret;
  399. }
       ^
  400. 
  401. /**

libavcodec/eatgv.c:196:10: 
194. 
195.     init_get_bits(&gb, buf, mvbits);
196.     for (i = 0; i < num_mvs; i++) {
              ^
197.         s->mv_codebook[i][0] = get_sbits(&gb, 10);
198.         s->mv_codebook[i][1] = get_sbits(&gb, 10);

libavcodec/eatgv.c:196:17: Loop condition is true. Entering loop body
194. 
195.     init_get_bits(&gb, buf, mvbits);
196.     for (i = 0; i < num_mvs; i++) {
                     ^
197.         s->mv_codebook[i][0] = get_sbits(&gb, 10);
198.         s->mv_codebook[i][1] = get_sbits(&gb, 10);

libavcodec/eatgv.c:197:9: Skipping get_sbits(): empty list of specs
195.     init_get_bits(&gb, buf, mvbits);
196.     for (i = 0; i < num_mvs; i++) {
197.         s->mv_codebook[i][0] = get_sbits(&gb, 10);
             ^
198.         s->mv_codebook[i][1] = get_sbits(&gb, 10);
199.     }

static int tgv_decode_inter(TgvContext *s, AVFrame *frame,
                            const uint8_t *buf, const uint8_t *buf_end)
{
    int num_mvs;
    int num_blocks_raw;
    int num_blocks_packed;
    int vector_bits;
    int i,j,x,y;
    GetBitContext gb;
    int mvbits;
    const uint8_t *blocks_raw;
    if (buf + 12 > buf_end)
        return AVERROR_INVALIDDATA;
    num_mvs           = AV_RL16(&buf[0]);
    num_blocks_raw    = AV_RL16(&buf[2]);
    num_blocks_packed = AV_RL16(&buf[4]);
    vector_bits       = AV_RL16(&buf[6]);
    buf += 12;
    if (vector_bits > MIN_CACHE_BITS || !vector_bits) {
        av_log(s->avctx, AV_LOG_ERROR,
               "Invalid value for motion vector bits: %d\n", vector_bits);
        return AVERROR_INVALIDDATA;
    }
    if (num_mvs > s->num_mvs) {
        s->mv_codebook = av_realloc(s->mv_codebook, num_mvs*2*sizeof(int));
        s->num_mvs = num_mvs;
    }
    if (num_blocks_packed > s->num_blocks_packed) {
        int err;
        if ((err = av_reallocp(&s->block_codebook, num_blocks_packed * 16)) < 0) {
            s->num_blocks_packed = 0;
            return err;
        }
        s->num_blocks_packed = num_blocks_packed;
    }
    mvbits = (num_mvs * 2 * 10 + 31) & ~31;
    if (buf + (mvbits >> 3) + 16 * num_blocks_raw + 8 * num_blocks_packed > buf_end)
        return AVERROR_INVALIDDATA;
    init_get_bits(&gb, buf, mvbits);
    for (i = 0; i < num_mvs; i++) {
        s->mv_codebook[i][0] = get_sbits(&gb, 10);
        s->mv_codebook[i][1] = get_sbits(&gb, 10);
    }
    buf += mvbits >> 3;
    blocks_raw = buf;
    buf       += num_blocks_raw * 16;
    init_get_bits(&gb, buf, (buf_end - buf) << 3);
    for (i = 0; i < num_blocks_packed; i++) {
        int tmp[4];
        for (j = 0; j < 4; j++)
            tmp[j] = get_bits(&gb, 8);
        for (j = 0; j < 16; j++)
            s->block_codebook[i][15-j] = tmp[get_bits(&gb, 2)];
    }
    if (get_bits_left(&gb) < vector_bits *
        (s->avctx->height / 4) * (s->avctx->width / 4))
        return AVERROR_INVALIDDATA;
    for (y = 0; y < s->avctx->height / 4; y++)
        for (x = 0; x < s->avctx->width / 4; x++) {
            unsigned int vector = get_bits(&gb, vector_bits);
            const uint8_t *src;
            int src_stride;
            if (vector < num_mvs) {
                int mx = x * 4 + s->mv_codebook[vector][0];
                int my = y * 4 + s->mv_codebook[vector][1];
                if (mx < 0 || mx + 4 > s->avctx->width ||
                    my < 0 || my + 4 > s->avctx->height)
                    continue;
                src = s->last_frame->data[0] + mx + my * s->last_frame->linesize[0];
                src_stride = s->last_frame->linesize[0];
            } else {
                int offset = vector - num_mvs;
                if (offset < num_blocks_raw)
                    src = blocks_raw + 16*offset;
                else if (offset - num_blocks_raw < num_blocks_packed)
                    src = s->block_codebook[offset - num_blocks_raw];
                else
                    continue;
                src_stride = 4;
            }
            for (j = 0; j < 4; j++)
                for (i = 0; i < 4; i++)
                    frame->data[0][(y * 4 + j) * frame->linesize[0] + (x * 4 + i)] =
                        src[j * src_stride + i];
    }
    return 0;
}
['static int tgv_decode_inter(TgvContext *s, AVFrame *frame,\n                            const uint8_t *buf, const uint8_t *buf_end)\n{\n    int num_mvs;\n    int num_blocks_raw;\n    int num_blocks_packed;\n    int vector_bits;\n    int i,j,x,y;\n    GetBitContext gb;\n    int mvbits;\n    const uint8_t *blocks_raw;\n    if (buf + 12 > buf_end)\n        return AVERROR_INVALIDDATA;\n    num_mvs           = AV_RL16(&buf[0]);\n    num_blocks_raw    = AV_RL16(&buf[2]);\n    num_blocks_packed = AV_RL16(&buf[4]);\n    vector_bits       = AV_RL16(&buf[6]);\n    buf += 12;\n    if (vector_bits > MIN_CACHE_BITS || !vector_bits) {\n        av_log(s->avctx, AV_LOG_ERROR,\n               "Invalid value for motion vector bits: %d\\n", vector_bits);\n        return AVERROR_INVALIDDATA;\n    }\n    if (num_mvs > s->num_mvs) {\n        s->mv_codebook = av_realloc(s->mv_codebook, num_mvs*2*sizeof(int));\n        s->num_mvs = num_mvs;\n    }\n    if (num_blocks_packed > s->num_blocks_packed) {\n        int err;\n        if ((err = av_reallocp(&s->block_codebook, num_blocks_packed * 16)) < 0) {\n            s->num_blocks_packed = 0;\n            return err;\n        }\n        s->num_blocks_packed = num_blocks_packed;\n    }\n    mvbits = (num_mvs * 2 * 10 + 31) & ~31;\n    if (buf + (mvbits >> 3) + 16 * num_blocks_raw + 8 * num_blocks_packed > buf_end)\n        return AVERROR_INVALIDDATA;\n    init_get_bits(&gb, buf, mvbits);\n    for (i = 0; i < num_mvs; i++) {\n        s->mv_codebook[i][0] = get_sbits(&gb, 10);\n        s->mv_codebook[i][1] = get_sbits(&gb, 10);\n    }\n    buf += mvbits >> 3;\n    blocks_raw = buf;\n    buf       += num_blocks_raw * 16;\n    init_get_bits(&gb, buf, (buf_end - buf) << 3);\n    for (i = 0; i < num_blocks_packed; i++) {\n        int tmp[4];\n        for (j = 0; j < 4; j++)\n            tmp[j] = get_bits(&gb, 8);\n        for (j = 0; j < 16; j++)\n            s->block_codebook[i][15-j] = tmp[get_bits(&gb, 2)];\n    }\n    if (get_bits_left(&gb) < vector_bits *\n        (s->avctx->height / 4) * (s->avctx->width / 4))\n        return AVERROR_INVALIDDATA;\n    for (y = 0; y < s->avctx->height / 4; y++)\n        for (x = 0; x < s->avctx->width / 4; x++) {\n            unsigned int vector = get_bits(&gb, vector_bits);\n            const uint8_t *src;\n            int src_stride;\n            if (vector < num_mvs) {\n                int mx = x * 4 + s->mv_codebook[vector][0];\n                int my = y * 4 + s->mv_codebook[vector][1];\n                if (mx < 0 || mx + 4 > s->avctx->width ||\n                    my < 0 || my + 4 > s->avctx->height)\n                    continue;\n                src = s->last_frame->data[0] + mx + my * s->last_frame->linesize[0];\n                src_stride = s->last_frame->linesize[0];\n            } else {\n                int offset = vector - num_mvs;\n                if (offset < num_blocks_raw)\n                    src = blocks_raw + 16*offset;\n                else if (offset - num_blocks_raw < num_blocks_packed)\n                    src = s->block_codebook[offset - num_blocks_raw];\n                else\n                    continue;\n                src_stride = 4;\n            }\n            for (j = 0; j < 4; j++)\n                for (i = 0; i < 4; i++)\n                    frame->data[0][(y * 4 + j) * frame->linesize[0] + (x * 4 + i)] =\n                        src[j * src_stride + i];\n    }\n    return 0;\n}', 'void *av_realloc(void *ptr, size_t size)\n{\n#if CONFIG_MEMALIGN_HACK\n    int diff;\n#endif\n    if (size > (INT_MAX - 16))\n        return NULL;\n#if CONFIG_MEMALIGN_HACK\n    if (!ptr)\n        return av_malloc(size);\n    diff = ((char *)ptr)[-1];\n    return (char *)realloc((char *)ptr - diff, size + diff) + diff;\n#elif HAVE_ALIGNED_MALLOC\n    return _aligned_realloc(ptr, size, 32);\n#else\n    return realloc(ptr, size);\n#endif\n}', 'static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,\n                                int bit_size)\n{\n    int buffer_size;\n    int ret = 0;\n    if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {\n        bit_size    = 0;\n        buffer      = NULL;\n        ret         = AVERROR_INVALIDDATA;\n    }\n    buffer_size = (bit_size + 7) >> 3;\n    s->buffer             = buffer;\n    s->size_in_bits       = bit_size;\n#if !UNCHECKED_BITSTREAM_READER\n    s->size_in_bits_plus8 = bit_size + 8;\n#endif\n    s->buffer_end         = buffer + buffer_size;\n    s->index              = 0;\n    return ret;\n}']