libavcodec/vp3.c:1994: error: Null Dereference
  pointer `&gb->buffer` last assigned on line 1992 could be null and is dereferenced by call to `get_bits1()` at line 1994, column 22.

libavcodec/vp3.c:1982:1: start of procedure vp3_decode_frame()
1980. }
1981. 
1982. static int vp3_decode_frame(AVCodecContext *avctx,
      ^
1983.                             void *data, int *got_frame,
1984.                             AVPacket *avpkt)

libavcodec/vp3.c:1986:5: 
1984.                             AVPacket *avpkt)
1985. {
1986.     const uint8_t *buf  = avpkt->data;
          ^
1987.     int buf_size        = avpkt->size;
1988.     Vp3DecodeContext *s = avctx->priv_data;

libavcodec/vp3.c:1987:5: 
1985. {
1986.     const uint8_t *buf  = avpkt->data;
1987.     int buf_size        = avpkt->size;
          ^
1988.     Vp3DecodeContext *s = avctx->priv_data;
1989.     GetBitContext gb;

libavcodec/vp3.c:1988:5: 
1986.     const uint8_t *buf  = avpkt->data;
1987.     int buf_size        = avpkt->size;
1988.     Vp3DecodeContext *s = avctx->priv_data;
          ^
1989.     GetBitContext gb;
1990.     int i, ret;

libavcodec/vp3.c:1992:5: 
1990.     int i, ret;
1991. 
1992.     init_get_bits(&gb, buf, buf_size * 8);
          ^
1993. 
1994.     if (s->theora && get_bits1(&gb)) {

libavcodec/get_bits.h:376:1: start of procedure init_get_bits()
  374.  * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
  375.  */
  376. static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
       ^
  377.                                 int bit_size)
  378. {

libavcodec/get_bits.h:380:5: 
  378. {
  379.     int buffer_size;
  380.     int ret = 0;
           ^
  381. 
  382.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {

libavcodec/get_bits.h:382:9: Taking true branch
  380.     int ret = 0;
  381. 
  382.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
               ^
  383.         bit_size    = 0;
  384.         buffer      = NULL;

libavcodec/get_bits.h:383:9: 
  381. 
  382.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
  383.         bit_size    = 0;
               ^
  384.         buffer      = NULL;
  385.         ret         = AVERROR_INVALIDDATA;

libavcodec/get_bits.h:384:9: 
  382.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
  383.         bit_size    = 0;
  384.         buffer      = NULL;
               ^
  385.         ret         = AVERROR_INVALIDDATA;
  386.     }

libavcodec/get_bits.h:385:9: 
  383.         bit_size    = 0;
  384.         buffer      = NULL;
  385.         ret         = AVERROR_INVALIDDATA;
               ^
  386.     }
  387. 

libavcodec/get_bits.h:388:5: 
  386.     }
  387. 
  388.     buffer_size = (bit_size + 7) >> 3;
           ^
  389. 
  390.     s->buffer             = buffer;

libavcodec/get_bits.h:390:5: 
  388.     buffer_size = (bit_size + 7) >> 3;
  389. 
  390.     s->buffer             = buffer;
           ^
  391.     s->size_in_bits       = bit_size;
  392. #if !UNCHECKED_BITSTREAM_READER

libavcodec/get_bits.h:391:5: 
  389. 
  390.     s->buffer             = buffer;
  391.     s->size_in_bits       = bit_size;
           ^
  392. #if !UNCHECKED_BITSTREAM_READER
  393.     s->size_in_bits_plus8 = bit_size + 8;

libavcodec/get_bits.h:393:5: 
  391.     s->size_in_bits       = bit_size;
  392. #if !UNCHECKED_BITSTREAM_READER
  393.     s->size_in_bits_plus8 = bit_size + 8;
           ^
  394. #endif
  395.     s->buffer_end         = buffer + buffer_size;

libavcodec/get_bits.h:395:5: 
  393.     s->size_in_bits_plus8 = bit_size + 8;
  394. #endif
  395.     s->buffer_end         = buffer + buffer_size;
           ^
  396.     s->index              = 0;
  397. 

libavcodec/get_bits.h:396:5: 
  394. #endif
  395.     s->buffer_end         = buffer + buffer_size;
  396.     s->index              = 0;
           ^
  397. 
  398.     return ret;

libavcodec/get_bits.h:398:5: 
  396.     s->index              = 0;
  397. 
  398.     return ret;
           ^
  399. }
  400. 

libavcodec/get_bits.h:399:1: return from a call to init_get_bits
  397. 
  398.     return ret;
  399. }
       ^
  400. 
  401. /**

libavcodec/vp3.c:1994:9: Taking true branch
1992.     init_get_bits(&gb, buf, buf_size * 8);
1993. 
1994.     if (s->theora && get_bits1(&gb)) {
              ^
1995.         av_log(avctx, AV_LOG_ERROR,
1996.                "Header packet passed to frame decoder, skipping\n");

libavcodec/vp3.c:1994:22: 
1992.     init_get_bits(&gb, buf, buf_size * 8);
1993. 
1994.     if (s->theora && get_bits1(&gb)) {
                           ^
1995.         av_log(avctx, AV_LOG_ERROR,
1996.                "Header packet passed to frame decoder, skipping\n");

libavcodec/get_bits.h:272:1: start of procedure get_bits1()
  270. }
  271. 
  272. static inline unsigned int get_bits1(GetBitContext *s)
       ^
  273. {
  274.     unsigned int index = s->index;

libavcodec/get_bits.h:274:5: 
  272. static inline unsigned int get_bits1(GetBitContext *s)
  273. {
  274.     unsigned int index = s->index;
           ^
  275.     uint8_t result     = s->buffer[index >> 3];
  276. #ifdef BITSTREAM_READER_LE

libavcodec/get_bits.h:275:5: 
  273. {
  274.     unsigned int index = s->index;
  275.     uint8_t result     = s->buffer[index >> 3];
           ^
  276. #ifdef BITSTREAM_READER_LE
  277.     result >>= index & 7;

static int vp3_decode_frame(AVCodecContext *avctx,
                            void *data, int *got_frame,
                            AVPacket *avpkt)
{
    const uint8_t *buf  = avpkt->data;
    int buf_size        = avpkt->size;
    Vp3DecodeContext *s = avctx->priv_data;
    GetBitContext gb;
    int i, ret;
    init_get_bits(&gb, buf, buf_size * 8);
    if (s->theora && get_bits1(&gb)) {
        av_log(avctx, AV_LOG_ERROR,
               "Header packet passed to frame decoder, skipping\n");
        return -1;
    }
    s->keyframe = !get_bits1(&gb);
    if (!s->theora)
        skip_bits(&gb, 1);
    for (i = 0; i < 3; i++)
        s->last_qps[i] = s->qps[i];
    s->nqps = 0;
    do {
        s->qps[s->nqps++] = get_bits(&gb, 6);
    } while (s->theora >= 0x030200 && s->nqps < 3 && get_bits1(&gb));
    for (i = s->nqps; i < 3; i++)
        s->qps[i] = -1;
    if (s->avctx->debug & FF_DEBUG_PICT_INFO)
        av_log(s->avctx, AV_LOG_INFO, " VP3 %sframe #%d: Q index = %d\n",
               s->keyframe ? "key" : "", avctx->frame_number + 1, s->qps[0]);
    s->skip_loop_filter = !s->filter_limit_values[s->qps[0]] ||
                          avctx->skip_loop_filter >= (s->keyframe ? AVDISCARD_ALL
                                                                  : AVDISCARD_NONKEY);
    if (s->qps[0] != s->last_qps[0])
        init_loop_filter(s);
    for (i = 0; i < s->nqps; i++)
        if (s->qps[i] != s->last_qps[i] || s->qps[0] != s->last_qps[0])
            init_dequantizer(s, i);
    if (avctx->skip_frame >= AVDISCARD_NONKEY && !s->keyframe)
        return buf_size;
    s->current_frame.f->pict_type = s->keyframe ? AV_PICTURE_TYPE_I
                                                : AV_PICTURE_TYPE_P;
    if (ff_thread_get_buffer(avctx, &s->current_frame, AV_GET_BUFFER_FLAG_REF) < 0) {
        av_log(s->avctx, AV_LOG_ERROR, "get_buffer() failed\n");
        goto error;
    }
    if (!s->edge_emu_buffer)
        s->edge_emu_buffer = av_malloc(9 * FFABS(s->current_frame.f->linesize[0]));
    if (s->keyframe) {
        if (!s->theora) {
            skip_bits(&gb, 4);
            skip_bits(&gb, 4);
            if (s->version) {
                s->version = get_bits(&gb, 5);
                if (avctx->frame_number == 0)
                    av_log(s->avctx, AV_LOG_DEBUG,
                           "VP version: %d\n", s->version);
            }
        }
        if (s->version || s->theora) {
            if (get_bits1(&gb))
                av_log(s->avctx, AV_LOG_ERROR,
                       "Warning, unsupported keyframe coding type?!\n");
            skip_bits(&gb, 2);
        }
    } else {
        if (!s->golden_frame.f->data[0]) {
            av_log(s->avctx, AV_LOG_WARNING,
                   "vp3: first frame not a keyframe\n");
            s->golden_frame.f->pict_type = AV_PICTURE_TYPE_I;
            if (ff_thread_get_buffer(avctx, &s->golden_frame,
                                     AV_GET_BUFFER_FLAG_REF) < 0) {
                av_log(s->avctx, AV_LOG_ERROR, "get_buffer() failed\n");
                goto error;
            }
            ff_thread_release_buffer(avctx, &s->last_frame);
            if ((ret = ff_thread_ref_frame(&s->last_frame,
                                           &s->golden_frame)) < 0)
                goto error;
            ff_thread_report_progress(&s->last_frame, INT_MAX, 0);
        }
    }
    memset(s->all_fragments, 0, s->fragment_count * sizeof(Vp3Fragment));
    ff_thread_finish_setup(avctx);
    if (unpack_superblocks(s, &gb)) {
        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_superblocks\n");
        goto error;
    }
    if (unpack_modes(s, &gb)) {
        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_modes\n");
        goto error;
    }
    if (unpack_vectors(s, &gb)) {
        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_vectors\n");
        goto error;
    }
    if (unpack_block_qpis(s, &gb)) {
        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_block_qpis\n");
        goto error;
    }
    if (unpack_dct_coeffs(s, &gb)) {
        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_dct_coeffs\n");
        goto error;
    }
    for (i = 0; i < 3; i++) {
        int height = s->height >> (i && s->chroma_y_shift);
        if (s->flipped_image)
            s->data_offset[i] = 0;
        else
            s->data_offset[i] = (height - 1) * s->current_frame.f->linesize[i];
    }
    s->last_slice_end = 0;
    for (i = 0; i < s->c_superblock_height; i++)
        render_slice(s, i);
    for (i = 0; i < 3; i++) {
        int row = (s->height >> (3 + (i && s->chroma_y_shift))) - 1;
        apply_loop_filter(s, i, row, row + 1);
    }
    vp3_draw_horiz_band(s, s->height);
    if ((ret = av_frame_ref(data, s->current_frame.f)) < 0)
        return ret;
    for (i = 0; i < 3; i++) {
        AVFrame *dst = data;
        int off = (s->offset_x >> (i && s->chroma_y_shift)) +
                  (s->offset_y >> (i && s->chroma_y_shift)) * dst->linesize[i];
        dst->data[i] += off;
    }
    *got_frame = 1;
    if (!HAVE_THREADS || !(s->avctx->active_thread_type & FF_THREAD_FRAME)) {
        ret = update_frames(avctx);
        if (ret < 0)
            return ret;
    }
    return buf_size;
error:
    ff_thread_report_progress(&s->current_frame, INT_MAX, 0);
    if (!HAVE_THREADS || !(s->avctx->active_thread_type & FF_THREAD_FRAME))
        av_frame_unref(s->current_frame.f);
    return -1;
}
['static int vp3_decode_frame(AVCodecContext *avctx,\n                            void *data, int *got_frame,\n                            AVPacket *avpkt)\n{\n    const uint8_t *buf  = avpkt->data;\n    int buf_size        = avpkt->size;\n    Vp3DecodeContext *s = avctx->priv_data;\n    GetBitContext gb;\n    int i, ret;\n    init_get_bits(&gb, buf, buf_size * 8);\n    if (s->theora && get_bits1(&gb)) {\n        av_log(avctx, AV_LOG_ERROR,\n               "Header packet passed to frame decoder, skipping\\n");\n        return -1;\n    }\n    s->keyframe = !get_bits1(&gb);\n    if (!s->theora)\n        skip_bits(&gb, 1);\n    for (i = 0; i < 3; i++)\n        s->last_qps[i] = s->qps[i];\n    s->nqps = 0;\n    do {\n        s->qps[s->nqps++] = get_bits(&gb, 6);\n    } while (s->theora >= 0x030200 && s->nqps < 3 && get_bits1(&gb));\n    for (i = s->nqps; i < 3; i++)\n        s->qps[i] = -1;\n    if (s->avctx->debug & FF_DEBUG_PICT_INFO)\n        av_log(s->avctx, AV_LOG_INFO, " VP3 %sframe #%d: Q index = %d\\n",\n               s->keyframe ? "key" : "", avctx->frame_number + 1, s->qps[0]);\n    s->skip_loop_filter = !s->filter_limit_values[s->qps[0]] ||\n                          avctx->skip_loop_filter >= (s->keyframe ? AVDISCARD_ALL\n                                                                  : AVDISCARD_NONKEY);\n    if (s->qps[0] != s->last_qps[0])\n        init_loop_filter(s);\n    for (i = 0; i < s->nqps; i++)\n        if (s->qps[i] != s->last_qps[i] || s->qps[0] != s->last_qps[0])\n            init_dequantizer(s, i);\n    if (avctx->skip_frame >= AVDISCARD_NONKEY && !s->keyframe)\n        return buf_size;\n    s->current_frame.f->pict_type = s->keyframe ? AV_PICTURE_TYPE_I\n                                                : AV_PICTURE_TYPE_P;\n    if (ff_thread_get_buffer(avctx, &s->current_frame, AV_GET_BUFFER_FLAG_REF) < 0) {\n        av_log(s->avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        goto error;\n    }\n    if (!s->edge_emu_buffer)\n        s->edge_emu_buffer = av_malloc(9 * FFABS(s->current_frame.f->linesize[0]));\n    if (s->keyframe) {\n        if (!s->theora) {\n            skip_bits(&gb, 4);\n            skip_bits(&gb, 4);\n            if (s->version) {\n                s->version = get_bits(&gb, 5);\n                if (avctx->frame_number == 0)\n                    av_log(s->avctx, AV_LOG_DEBUG,\n                           "VP version: %d\\n", s->version);\n            }\n        }\n        if (s->version || s->theora) {\n            if (get_bits1(&gb))\n                av_log(s->avctx, AV_LOG_ERROR,\n                       "Warning, unsupported keyframe coding type?!\\n");\n            skip_bits(&gb, 2);\n        }\n    } else {\n        if (!s->golden_frame.f->data[0]) {\n            av_log(s->avctx, AV_LOG_WARNING,\n                   "vp3: first frame not a keyframe\\n");\n            s->golden_frame.f->pict_type = AV_PICTURE_TYPE_I;\n            if (ff_thread_get_buffer(avctx, &s->golden_frame,\n                                     AV_GET_BUFFER_FLAG_REF) < 0) {\n                av_log(s->avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n                goto error;\n            }\n            ff_thread_release_buffer(avctx, &s->last_frame);\n            if ((ret = ff_thread_ref_frame(&s->last_frame,\n                                           &s->golden_frame)) < 0)\n                goto error;\n            ff_thread_report_progress(&s->last_frame, INT_MAX, 0);\n        }\n    }\n    memset(s->all_fragments, 0, s->fragment_count * sizeof(Vp3Fragment));\n    ff_thread_finish_setup(avctx);\n    if (unpack_superblocks(s, &gb)) {\n        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_superblocks\\n");\n        goto error;\n    }\n    if (unpack_modes(s, &gb)) {\n        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_modes\\n");\n        goto error;\n    }\n    if (unpack_vectors(s, &gb)) {\n        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_vectors\\n");\n        goto error;\n    }\n    if (unpack_block_qpis(s, &gb)) {\n        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_block_qpis\\n");\n        goto error;\n    }\n    if (unpack_dct_coeffs(s, &gb)) {\n        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_dct_coeffs\\n");\n        goto error;\n    }\n    for (i = 0; i < 3; i++) {\n        int height = s->height >> (i && s->chroma_y_shift);\n        if (s->flipped_image)\n            s->data_offset[i] = 0;\n        else\n            s->data_offset[i] = (height - 1) * s->current_frame.f->linesize[i];\n    }\n    s->last_slice_end = 0;\n    for (i = 0; i < s->c_superblock_height; i++)\n        render_slice(s, i);\n    for (i = 0; i < 3; i++) {\n        int row = (s->height >> (3 + (i && s->chroma_y_shift))) - 1;\n        apply_loop_filter(s, i, row, row + 1);\n    }\n    vp3_draw_horiz_band(s, s->height);\n    if ((ret = av_frame_ref(data, s->current_frame.f)) < 0)\n        return ret;\n    for (i = 0; i < 3; i++) {\n        AVFrame *dst = data;\n        int off = (s->offset_x >> (i && s->chroma_y_shift)) +\n                  (s->offset_y >> (i && s->chroma_y_shift)) * dst->linesize[i];\n        dst->data[i] += off;\n    }\n    *got_frame = 1;\n    if (!HAVE_THREADS || !(s->avctx->active_thread_type & FF_THREAD_FRAME)) {\n        ret = update_frames(avctx);\n        if (ret < 0)\n            return ret;\n    }\n    return buf_size;\nerror:\n    ff_thread_report_progress(&s->current_frame, INT_MAX, 0);\n    if (!HAVE_THREADS || !(s->avctx->active_thread_type & FF_THREAD_FRAME))\n        av_frame_unref(s->current_frame.f);\n    return -1;\n}', 'static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,\n                                int bit_size)\n{\n    int buffer_size;\n    int ret = 0;\n    if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {\n        bit_size    = 0;\n        buffer      = NULL;\n        ret         = AVERROR_INVALIDDATA;\n    }\n    buffer_size = (bit_size + 7) >> 3;\n    s->buffer             = buffer;\n    s->size_in_bits       = bit_size;\n#if !UNCHECKED_BITSTREAM_READER\n    s->size_in_bits_plus8 = bit_size + 8;\n#endif\n    s->buffer_end         = buffer + buffer_size;\n    s->index              = 0;\n    return ret;\n}', 'static inline unsigned int get_bits1(GetBitContext *s)\n{\n    unsigned int index = s->index;\n    uint8_t result     = s->buffer[index >> 3];\n#ifdef BITSTREAM_READER_LE\n    result >>= index & 7;\n    result  &= 1;\n#else\n    result <<= index & 7;\n    result >>= 8 - 1;\n#endif\n#if !UNCHECKED_BITSTREAM_READER\n    if (s->index < s->size_in_bits_plus8)\n#endif\n        index++;\n    s->index = index;\n    return result;\n}']