libavcodec/indeo3.c:194: error: Null Dereference
  pointer `ctx->planes[p].buffers[1]` last assigned on line 190 could be null and is dereferenced by call to `memset()` at line 194, column 9.

libavcodec/indeo3.c:151:1: start of procedure allocate_frame_buffers()
149. 
150. 
151. static av_cold int allocate_frame_buffers(Indeo3DecodeContext *ctx,
     ^
152.                                           AVCodecContext *avctx)
153. {

libavcodec/indeo3.c:158:5: 
156.     ptrdiff_t luma_pitch, chroma_pitch;
157. 
158.     luma_width  = ctx->width;
         ^
159.     luma_height = ctx->height;
160. 

libavcodec/indeo3.c:159:5: 
157. 
158.     luma_width  = ctx->width;
159.     luma_height = ctx->height;
         ^
160. 
161.     if (luma_width  < 16 || luma_width  > 640 ||

libavcodec/indeo3.c:161:9: Taking false branch
159.     luma_height = ctx->height;
160. 
161.     if (luma_width  < 16 || luma_width  > 640 ||
             ^
162.         luma_height < 16 || luma_height > 480 ||
163.         luma_width  &  3 || luma_height &   3) {

libavcodec/indeo3.c:161:29: Taking false branch
159.     luma_height = ctx->height;
160. 
161.     if (luma_width  < 16 || luma_width  > 640 ||
                                 ^
162.         luma_height < 16 || luma_height > 480 ||
163.         luma_width  &  3 || luma_height &   3) {

libavcodec/indeo3.c:162:9: Taking false branch
160. 
161.     if (luma_width  < 16 || luma_width  > 640 ||
162.         luma_height < 16 || luma_height > 480 ||
             ^
163.         luma_width  &  3 || luma_height &   3) {
164.         av_log(avctx, AV_LOG_ERROR, "Invalid picture dimensions: %d x %d!\n",

libavcodec/indeo3.c:162:29: Taking false branch
160. 
161.     if (luma_width  < 16 || luma_width  > 640 ||
162.         luma_height < 16 || luma_height > 480 ||
                                 ^
163.         luma_width  &  3 || luma_height &   3) {
164.         av_log(avctx, AV_LOG_ERROR, "Invalid picture dimensions: %d x %d!\n",

libavcodec/indeo3.c:163:9: Taking false branch
161.     if (luma_width  < 16 || luma_width  > 640 ||
162.         luma_height < 16 || luma_height > 480 ||
163.         luma_width  &  3 || luma_height &   3) {
             ^
164.         av_log(avctx, AV_LOG_ERROR, "Invalid picture dimensions: %d x %d!\n",
165.                luma_width, luma_height);

libavcodec/indeo3.c:163:29: Taking false branch
161.     if (luma_width  < 16 || luma_width  > 640 ||
162.         luma_height < 16 || luma_height > 480 ||
163.         luma_width  &  3 || luma_height &   3) {
                                 ^
164.         av_log(avctx, AV_LOG_ERROR, "Invalid picture dimensions: %d x %d!\n",
165.                luma_width, luma_height);

libavcodec/indeo3.c:169:5: 
167.     }
168. 
169.     chroma_width  = FFALIGN(luma_width  >> 2, 4);
         ^
170.     chroma_height = FFALIGN(luma_height >> 2, 4);
171. 

libavcodec/indeo3.c:170:5: 
168. 
169.     chroma_width  = FFALIGN(luma_width  >> 2, 4);
170.     chroma_height = FFALIGN(luma_height >> 2, 4);
         ^
171. 
172.     luma_pitch   = FFALIGN(luma_width,   16);

libavcodec/indeo3.c:172:5: 
170.     chroma_height = FFALIGN(luma_height >> 2, 4);
171. 
172.     luma_pitch   = FFALIGN(luma_width,   16);
         ^
173.     chroma_pitch = FFALIGN(chroma_width, 16);
174. 

libavcodec/indeo3.c:173:5: 
171. 
172.     luma_pitch   = FFALIGN(luma_width,   16);
173.     chroma_pitch = FFALIGN(chroma_width, 16);
         ^
174. 
175.     /* Calculate size of the luminance plane.  */

libavcodec/indeo3.c:177:5: 
175.     /* Calculate size of the luminance plane.  */
176.     /* Add one line more for INTRA prediction. */
177.     luma_size = luma_pitch * (luma_height + 1);
         ^
178. 
179.     /* Calculate size of a chrominance planes. */

libavcodec/indeo3.c:181:5: 
179.     /* Calculate size of a chrominance planes. */
180.     /* Add one line more for INTRA prediction. */
181.     chroma_size = chroma_pitch * (chroma_height + 1);
         ^
182. 
183.     /* allocate frame buffers */

libavcodec/indeo3.c:184:10: 
182. 
183.     /* allocate frame buffers */
184.     for (p = 0; p < 3; p++) {
              ^
185.         ctx->planes[p].pitch  = !p ? luma_pitch  : chroma_pitch;
186.         ctx->planes[p].width  = !p ? luma_width  : chroma_width;

libavcodec/indeo3.c:184:17: Loop condition is true. Entering loop body
182. 
183.     /* allocate frame buffers */
184.     for (p = 0; p < 3; p++) {
                     ^
185.         ctx->planes[p].pitch  = !p ? luma_pitch  : chroma_pitch;
186.         ctx->planes[p].width  = !p ? luma_width  : chroma_width;

libavcodec/indeo3.c:185:34: Condition is true
183.     /* allocate frame buffers */
184.     for (p = 0; p < 3; p++) {
185.         ctx->planes[p].pitch  = !p ? luma_pitch  : chroma_pitch;
                                      ^
186.         ctx->planes[p].width  = !p ? luma_width  : chroma_width;
187.         ctx->planes[p].height = !p ? luma_height : chroma_height;

libavcodec/indeo3.c:185:33: 
183.     /* allocate frame buffers */
184.     for (p = 0; p < 3; p++) {
185.         ctx->planes[p].pitch  = !p ? luma_pitch  : chroma_pitch;
                                     ^
186.         ctx->planes[p].width  = !p ? luma_width  : chroma_width;
187.         ctx->planes[p].height = !p ? luma_height : chroma_height;

libavcodec/indeo3.c:185:9: 
183.     /* allocate frame buffers */
184.     for (p = 0; p < 3; p++) {
185.         ctx->planes[p].pitch  = !p ? luma_pitch  : chroma_pitch;
             ^
186.         ctx->planes[p].width  = !p ? luma_width  : chroma_width;
187.         ctx->planes[p].height = !p ? luma_height : chroma_height;

libavcodec/indeo3.c:186:34: Condition is true
184.     for (p = 0; p < 3; p++) {
185.         ctx->planes[p].pitch  = !p ? luma_pitch  : chroma_pitch;
186.         ctx->planes[p].width  = !p ? luma_width  : chroma_width;
                                      ^
187.         ctx->planes[p].height = !p ? luma_height : chroma_height;
188. 

libavcodec/indeo3.c:186:33: 
184.     for (p = 0; p < 3; p++) {
185.         ctx->planes[p].pitch  = !p ? luma_pitch  : chroma_pitch;
186.         ctx->planes[p].width  = !p ? luma_width  : chroma_width;
                                     ^
187.         ctx->planes[p].height = !p ? luma_height : chroma_height;
188. 

libavcodec/indeo3.c:186:9: 
184.     for (p = 0; p < 3; p++) {
185.         ctx->planes[p].pitch  = !p ? luma_pitch  : chroma_pitch;
186.         ctx->planes[p].width  = !p ? luma_width  : chroma_width;
             ^
187.         ctx->planes[p].height = !p ? luma_height : chroma_height;
188. 

libavcodec/indeo3.c:187:34: Condition is true
185.         ctx->planes[p].pitch  = !p ? luma_pitch  : chroma_pitch;
186.         ctx->planes[p].width  = !p ? luma_width  : chroma_width;
187.         ctx->planes[p].height = !p ? luma_height : chroma_height;
                                      ^
188. 
189.         ctx->planes[p].buffers[0] = av_malloc(!p ? luma_size : chroma_size);

libavcodec/indeo3.c:187:33: 
185.         ctx->planes[p].pitch  = !p ? luma_pitch  : chroma_pitch;
186.         ctx->planes[p].width  = !p ? luma_width  : chroma_width;
187.         ctx->planes[p].height = !p ? luma_height : chroma_height;
                                     ^
188. 
189.         ctx->planes[p].buffers[0] = av_malloc(!p ? luma_size : chroma_size);

libavcodec/indeo3.c:187:9: 
185.         ctx->planes[p].pitch  = !p ? luma_pitch  : chroma_pitch;
186.         ctx->planes[p].width  = !p ? luma_width  : chroma_width;
187.         ctx->planes[p].height = !p ? luma_height : chroma_height;
             ^
188. 
189.         ctx->planes[p].buffers[0] = av_malloc(!p ? luma_size : chroma_size);

libavcodec/indeo3.c:189:48: Condition is true
187.         ctx->planes[p].height = !p ? luma_height : chroma_height;
188. 
189.         ctx->planes[p].buffers[0] = av_malloc(!p ? luma_size : chroma_size);
                                                    ^
190.         ctx->planes[p].buffers[1] = av_malloc(!p ? luma_size : chroma_size);
191. 

libavcodec/indeo3.c:189:47: 
187.         ctx->planes[p].height = !p ? luma_height : chroma_height;
188. 
189.         ctx->planes[p].buffers[0] = av_malloc(!p ? luma_size : chroma_size);
                                                   ^
190.         ctx->planes[p].buffers[1] = av_malloc(!p ? luma_size : chroma_size);
191. 

libavcodec/indeo3.c:189:9: 
187.         ctx->planes[p].height = !p ? luma_height : chroma_height;
188. 
189.         ctx->planes[p].buffers[0] = av_malloc(!p ? luma_size : chroma_size);
             ^
190.         ctx->planes[p].buffers[1] = av_malloc(!p ? luma_size : chroma_size);
191. 

libavutil/mem.c:62:1: start of procedure av_malloc()
  60.  * linker will do it automatically. */
  61. 
  62. void *av_malloc(size_t size)
      ^
  63. {
  64.     void *ptr = NULL;

libavutil/mem.c:64:5: 
  62. void *av_malloc(size_t size)
  63. {
  64.     void *ptr = NULL;
          ^
  65. 
  66.     /* let's disallow possibly ambiguous cases */

libavutil/mem.c:67:9: Taking false branch
  65. 
  66.     /* let's disallow possibly ambiguous cases */
  67.     if (size > (INT_MAX - 32) || !size)
              ^
  68.         return NULL;
  69. 

libavutil/mem.c:67:35: Taking true branch
  65. 
  66.     /* let's disallow possibly ambiguous cases */
  67.     if (size > (INT_MAX - 32) || !size)
                                        ^
  68.         return NULL;
  69. 

libavutil/mem.c:68:9: 
  66.     /* let's disallow possibly ambiguous cases */
  67.     if (size > (INT_MAX - 32) || !size)
  68.         return NULL;
              ^
  69. 
  70. #if HAVE_POSIX_MEMALIGN

libavutil/mem.c:105:1: return from a call to av_malloc
  103. #endif
  104.     return ptr;
  105. }
       ^
  106. 
  107. void *av_realloc(void *ptr, size_t size)

libavcodec/indeo3.c:190:48: Condition is true
188. 
189.         ctx->planes[p].buffers[0] = av_malloc(!p ? luma_size : chroma_size);
190.         ctx->planes[p].buffers[1] = av_malloc(!p ? luma_size : chroma_size);
                                                    ^
191. 
192.         /* fill the INTRA prediction lines with the middle pixel value = 64 */

libavcodec/indeo3.c:190:47: 
188. 
189.         ctx->planes[p].buffers[0] = av_malloc(!p ? luma_size : chroma_size);
190.         ctx->planes[p].buffers[1] = av_malloc(!p ? luma_size : chroma_size);
                                                   ^
191. 
192.         /* fill the INTRA prediction lines with the middle pixel value = 64 */

libavcodec/indeo3.c:190:9: 
188. 
189.         ctx->planes[p].buffers[0] = av_malloc(!p ? luma_size : chroma_size);
190.         ctx->planes[p].buffers[1] = av_malloc(!p ? luma_size : chroma_size);
             ^
191. 
192.         /* fill the INTRA prediction lines with the middle pixel value = 64 */

libavutil/mem.c:62:1: start of procedure av_malloc()
  60.  * linker will do it automatically. */
  61. 
  62. void *av_malloc(size_t size)
      ^
  63. {
  64.     void *ptr = NULL;

libavutil/mem.c:64:5: 
  62. void *av_malloc(size_t size)
  63. {
  64.     void *ptr = NULL;
          ^
  65. 
  66.     /* let's disallow possibly ambiguous cases */

libavutil/mem.c:67:9: Taking true branch
  65. 
  66.     /* let's disallow possibly ambiguous cases */
  67.     if (size > (INT_MAX - 32) || !size)
              ^
  68.         return NULL;
  69. 

libavutil/mem.c:68:9: 
  66.     /* let's disallow possibly ambiguous cases */
  67.     if (size > (INT_MAX - 32) || !size)
  68.         return NULL;
              ^
  69. 
  70. #if HAVE_POSIX_MEMALIGN

libavutil/mem.c:105:1: return from a call to av_malloc
  103. #endif
  104.     return ptr;
  105. }
       ^
  106. 
  107. void *av_realloc(void *ptr, size_t size)

libavcodec/indeo3.c:193:9: 
191. 
192.         /* fill the INTRA prediction lines with the middle pixel value = 64 */
193.         memset(ctx->planes[p].buffers[0], 0x40, ctx->planes[p].pitch);
             ^
194.         memset(ctx->planes[p].buffers[1], 0x40, ctx->planes[p].pitch);
195. 

libavcodec/indeo3.c:194:9: 
192.         /* fill the INTRA prediction lines with the middle pixel value = 64 */
193.         memset(ctx->planes[p].buffers[0], 0x40, ctx->planes[p].pitch);
194.         memset(ctx->planes[p].buffers[1], 0x40, ctx->planes[p].pitch);
             ^
195. 
196.         /* set buffer pointers = buf_ptr + pitch and thus skip the INTRA prediction line */

static av_cold int allocate_frame_buffers(Indeo3DecodeContext *ctx,
                                          AVCodecContext *avctx)
{
    int p, luma_width, luma_height, chroma_width, chroma_height;
    int luma_size, chroma_size;
    ptrdiff_t luma_pitch, chroma_pitch;
    luma_width  = ctx->width;
    luma_height = ctx->height;
    if (luma_width  < 16 || luma_width  > 640 ||
        luma_height < 16 || luma_height > 480 ||
        luma_width  &  3 || luma_height &   3) {
        av_log(avctx, AV_LOG_ERROR, "Invalid picture dimensions: %d x %d!\n",
               luma_width, luma_height);
        return AVERROR_INVALIDDATA;
    }
    chroma_width  = FFALIGN(luma_width  >> 2, 4);
    chroma_height = FFALIGN(luma_height >> 2, 4);
    luma_pitch   = FFALIGN(luma_width,   16);
    chroma_pitch = FFALIGN(chroma_width, 16);
    luma_size = luma_pitch * (luma_height + 1);
    chroma_size = chroma_pitch * (chroma_height + 1);
    for (p = 0; p < 3; p++) {
        ctx->planes[p].pitch  = !p ? luma_pitch  : chroma_pitch;
        ctx->planes[p].width  = !p ? luma_width  : chroma_width;
        ctx->planes[p].height = !p ? luma_height : chroma_height;
        ctx->planes[p].buffers[0] = av_malloc(!p ? luma_size : chroma_size);
        ctx->planes[p].buffers[1] = av_malloc(!p ? luma_size : chroma_size);
        memset(ctx->planes[p].buffers[0], 0x40, ctx->planes[p].pitch);
        memset(ctx->planes[p].buffers[1], 0x40, ctx->planes[p].pitch);
        ctx->planes[p].pixels[0] = ctx->planes[p].buffers[0] + ctx->planes[p].pitch;
        ctx->planes[p].pixels[1] = ctx->planes[p].buffers[1] + ctx->planes[p].pitch;
        memset(ctx->planes[p].pixels[0], 0, ctx->planes[p].pitch * ctx->planes[p].height);
        memset(ctx->planes[p].pixels[1], 0, ctx->planes[p].pitch * ctx->planes[p].height);
    }
    return 0;
}
['static av_cold int allocate_frame_buffers(Indeo3DecodeContext *ctx,\n                                          AVCodecContext *avctx)\n{\n    int p, luma_width, luma_height, chroma_width, chroma_height;\n    int luma_size, chroma_size;\n    ptrdiff_t luma_pitch, chroma_pitch;\n    luma_width  = ctx->width;\n    luma_height = ctx->height;\n    if (luma_width  < 16 || luma_width  > 640 ||\n        luma_height < 16 || luma_height > 480 ||\n        luma_width  &  3 || luma_height &   3) {\n        av_log(avctx, AV_LOG_ERROR, "Invalid picture dimensions: %d x %d!\\n",\n               luma_width, luma_height);\n        return AVERROR_INVALIDDATA;\n    }\n    chroma_width  = FFALIGN(luma_width  >> 2, 4);\n    chroma_height = FFALIGN(luma_height >> 2, 4);\n    luma_pitch   = FFALIGN(luma_width,   16);\n    chroma_pitch = FFALIGN(chroma_width, 16);\n    luma_size = luma_pitch * (luma_height + 1);\n    chroma_size = chroma_pitch * (chroma_height + 1);\n    for (p = 0; p < 3; p++) {\n        ctx->planes[p].pitch  = !p ? luma_pitch  : chroma_pitch;\n        ctx->planes[p].width  = !p ? luma_width  : chroma_width;\n        ctx->planes[p].height = !p ? luma_height : chroma_height;\n        ctx->planes[p].buffers[0] = av_malloc(!p ? luma_size : chroma_size);\n        ctx->planes[p].buffers[1] = av_malloc(!p ? luma_size : chroma_size);\n        memset(ctx->planes[p].buffers[0], 0x40, ctx->planes[p].pitch);\n        memset(ctx->planes[p].buffers[1], 0x40, ctx->planes[p].pitch);\n        ctx->planes[p].pixels[0] = ctx->planes[p].buffers[0] + ctx->planes[p].pitch;\n        ctx->planes[p].pixels[1] = ctx->planes[p].buffers[1] + ctx->planes[p].pitch;\n        memset(ctx->planes[p].pixels[0], 0, ctx->planes[p].pitch * ctx->planes[p].height);\n        memset(ctx->planes[p].pixels[1], 0, ctx->planes[p].pitch * ctx->planes[p].height);\n    }\n    return 0;\n}', 'void *av_malloc(size_t size)\n{\n    void *ptr = NULL;\n    if (size > (INT_MAX - 32) || !size)\n        return NULL;\n#if HAVE_POSIX_MEMALIGN\n    if (posix_memalign(&ptr, 32, size))\n        ptr = NULL;\n#elif HAVE_ALIGNED_MALLOC\n    ptr = _aligned_malloc(size, 32);\n#elif HAVE_MEMALIGN\n    ptr = memalign(32, size);\n#else\n    ptr = malloc(size);\n#endif\n    return ptr;\n}']