libavformat/rtmpproto.c:420: error: Null Dereference
  pointer `sha` last assigned on line 408 could be null and is dereferenced by call to `av_sha_init()` at line 420, column 5.

libavformat/rtmpproto.c:401:1: start of procedure rtmp_calc_digest()
399.  * @param dst    buffer where calculated digest will be stored (32 bytes)
400.  */
401. static void rtmp_calc_digest(const uint8_t *src, int len, int gap,
     ^
402.                              const uint8_t *key, int keylen, uint8_t *dst)
403. {

libavformat/rtmpproto.c:405:5: 
403. {
404.     struct AVSHA *sha;
405.     uint8_t hmac_buf[64+32] = {0};
         ^
406.     int i;
407. 

libavformat/rtmpproto.c:408:5: 
406.     int i;
407. 
408.     sha = av_mallocz(av_sha_size);
         ^
409. 
410.     if (keylen < 64) {

libavutil/mem.c:156:1: start of procedure av_mallocz()
  154. }
  155. 
  156. void *av_mallocz(size_t size)
       ^
  157. {
  158.     void *ptr = av_malloc(size);

libavutil/mem.c:158:5: 
  156. void *av_mallocz(size_t size)
  157. {
  158.     void *ptr = av_malloc(size);
           ^
  159.     if (ptr)
  160.         memset(ptr, 0, size);

libavutil/mem.c:64:1: start of procedure av_malloc()
    62.    linker will do it automatically. */
    63. 
    64. void *av_malloc(size_t size)
        ^
    65. {
    66.     void *ptr = NULL;

libavutil/mem.c:66:5: 
    64. void *av_malloc(size_t size)
    65. {
    66.     void *ptr = NULL;
            ^
    67. #if CONFIG_MEMALIGN_HACK
    68.     long diff;

libavutil/mem.c:71:5: 
    69. #endif
    70. 
    71.     assert(size);
            ^
    72. 
    73.     /* let's disallow possible ambiguous cases */

libavutil/mem.c:74:9: Taking true branch
    72. 
    73.     /* let's disallow possible ambiguous cases */
    74.     if (size > (INT_MAX-32) || !size)
                ^
    75.         return NULL;
    76. 

libavutil/mem.c:75:9: 
    73.     /* let's disallow possible ambiguous cases */
    74.     if (size > (INT_MAX-32) || !size)
    75.         return NULL;
                ^
    76. 
    77. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:117:1: return from a call to av_malloc
    115. #endif
    116.     return ptr;
    117. }
         ^
    118. 
    119. void *av_realloc(void *ptr, size_t size)

libavutil/mem.c:159:9: Taking false branch
  157. {
  158.     void *ptr = av_malloc(size);
  159.     if (ptr)
               ^
  160.         memset(ptr, 0, size);
  161.     return ptr;

libavutil/mem.c:161:5: 
  159.     if (ptr)
  160.         memset(ptr, 0, size);
  161.     return ptr;
           ^
  162. }
  163. 

libavutil/mem.c:162:1: return from a call to av_mallocz
  160.         memset(ptr, 0, size);
  161.     return ptr;
  162. }
       ^
  163. 
  164. char *av_strdup(const char *s)

libavformat/rtmpproto.c:410:9: Taking true branch
408.     sha = av_mallocz(av_sha_size);
409. 
410.     if (keylen < 64) {
             ^
411.         memcpy(hmac_buf, key, keylen);
412.     } else {

libavformat/rtmpproto.c:411:9: 
409. 
410.     if (keylen < 64) {
411.         memcpy(hmac_buf, key, keylen);
             ^
412.     } else {
413.         av_sha_init(sha, 256);

libavformat/rtmpproto.c:417:10: 
415.         av_sha_final(sha, hmac_buf);
416.     }
417.     for (i = 0; i < 64; i++)
              ^
418.         hmac_buf[i] ^= HMAC_IPAD_VAL;
419. 

libavformat/rtmpproto.c:417:17: Loop condition is true. Entering loop body
415.         av_sha_final(sha, hmac_buf);
416.     }
417.     for (i = 0; i < 64; i++)
                     ^
418.         hmac_buf[i] ^= HMAC_IPAD_VAL;
419. 

libavformat/rtmpproto.c:418:9: 
416.     }
417.     for (i = 0; i < 64; i++)
418.         hmac_buf[i] ^= HMAC_IPAD_VAL;
             ^
419. 
420.     av_sha_init(sha, 256);

libavformat/rtmpproto.c:417:25: 
415.         av_sha_final(sha, hmac_buf);
416.     }
417.     for (i = 0; i < 64; i++)
                             ^
418.         hmac_buf[i] ^= HMAC_IPAD_VAL;
419. 

libavformat/rtmpproto.c:417:17: Loop condition is false. Leaving loop
415.         av_sha_final(sha, hmac_buf);
416.     }
417.     for (i = 0; i < 64; i++)
                     ^
418.         hmac_buf[i] ^= HMAC_IPAD_VAL;
419. 

libavformat/rtmpproto.c:420:5: 
418.         hmac_buf[i] ^= HMAC_IPAD_VAL;
419. 
420.     av_sha_init(sha, 256);
         ^
421.     av_sha_update(sha, hmac_buf, 64);
422.     if (gap <= 0) {

libavutil/sha.c:246:1: start of procedure av_sha_init()
  244. 
  245. 
  246. int av_sha_init(AVSHA* ctx, int bits)
       ^
  247. {
  248.     ctx->digest_len = bits >> 5;

libavutil/sha.c:248:5: 
  246. int av_sha_init(AVSHA* ctx, int bits)
  247. {
  248.     ctx->digest_len = bits >> 5;
           ^
  249.     switch (bits) {
  250.     case 160: // SHA-1

static void rtmp_calc_digest(const uint8_t *src, int len, int gap,
                             const uint8_t *key, int keylen, uint8_t *dst)
{
    struct AVSHA *sha;
    uint8_t hmac_buf[64+32] = {0};
    int i;
    sha = av_mallocz(av_sha_size);
    if (keylen < 64) {
        memcpy(hmac_buf, key, keylen);
    } else {
        av_sha_init(sha, 256);
        av_sha_update(sha,key, keylen);
        av_sha_final(sha, hmac_buf);
    }
    for (i = 0; i < 64; i++)
        hmac_buf[i] ^= HMAC_IPAD_VAL;
    av_sha_init(sha, 256);
    av_sha_update(sha, hmac_buf, 64);
    if (gap <= 0) {
        av_sha_update(sha, src, len);
    } else {
        av_sha_update(sha, src, gap);
        av_sha_update(sha, src + gap + 32, len - gap - 32);
    }
    av_sha_final(sha, hmac_buf + 64);
    for (i = 0; i < 64; i++)
        hmac_buf[i] ^= HMAC_IPAD_VAL ^ HMAC_OPAD_VAL;
    av_sha_init(sha, 256);
    av_sha_update(sha, hmac_buf, 64+32);
    av_sha_final(sha, dst);
    av_free(sha);
}
['static void rtmp_calc_digest(const uint8_t *src, int len, int gap,\n                             const uint8_t *key, int keylen, uint8_t *dst)\n{\n    struct AVSHA *sha;\n    uint8_t hmac_buf[64+32] = {0};\n    int i;\n    sha = av_mallocz(av_sha_size);\n    if (keylen < 64) {\n        memcpy(hmac_buf, key, keylen);\n    } else {\n        av_sha_init(sha, 256);\n        av_sha_update(sha,key, keylen);\n        av_sha_final(sha, hmac_buf);\n    }\n    for (i = 0; i < 64; i++)\n        hmac_buf[i] ^= HMAC_IPAD_VAL;\n    av_sha_init(sha, 256);\n    av_sha_update(sha, hmac_buf, 64);\n    if (gap <= 0) {\n        av_sha_update(sha, src, len);\n    } else {\n        av_sha_update(sha, src, gap);\n        av_sha_update(sha, src + gap + 32, len - gap - 32);\n    }\n    av_sha_final(sha, hmac_buf + 64);\n    for (i = 0; i < 64; i++)\n        hmac_buf[i] ^= HMAC_IPAD_VAL ^ HMAC_OPAD_VAL;\n    av_sha_init(sha, 256);\n    av_sha_update(sha, hmac_buf, 64+32);\n    av_sha_final(sha, dst);\n    av_free(sha);\n}', 'void *av_mallocz(size_t size)\n{\n    void *ptr = av_malloc(size);\n    if (ptr)\n        memset(ptr, 0, size);\n    return ptr;\n}', 'void *av_malloc(size_t size)\n{\n    void *ptr = NULL;\n#if CONFIG_MEMALIGN_HACK\n    long diff;\n#endif\n    assert(size);\n    if (size > (INT_MAX-32) || !size)\n        return NULL;\n#if CONFIG_MEMALIGN_HACK\n    ptr = malloc(size+32);\n    if(!ptr)\n        return ptr;\n    diff= ((-(long)ptr - 1)&31) + 1;\n    ptr = (char*)ptr + diff;\n    ((char*)ptr)[-1]= diff;\n#elif HAVE_POSIX_MEMALIGN\n    if (posix_memalign(&ptr,32,size))\n        ptr = NULL;\n#elif HAVE_MEMALIGN\n    ptr = memalign(32,size);\n#else\n    ptr = malloc(size);\n#endif\n    return ptr;\n}', 'int av_sha_init(AVSHA* ctx, int bits)\n{\n    ctx->digest_len = bits >> 5;\n    switch (bits) {\n    case 160:\n        ctx->state[0] = 0x67452301;\n        ctx->state[1] = 0xEFCDAB89;\n        ctx->state[2] = 0x98BADCFE;\n        ctx->state[3] = 0x10325476;\n        ctx->state[4] = 0xC3D2E1F0;\n        ctx->transform = sha1_transform;\n        break;\n    case 224:\n        ctx->state[0] = 0xC1059ED8;\n        ctx->state[1] = 0x367CD507;\n        ctx->state[2] = 0x3070DD17;\n        ctx->state[3] = 0xF70E5939;\n        ctx->state[4] = 0xFFC00B31;\n        ctx->state[5] = 0x68581511;\n        ctx->state[6] = 0x64F98FA7;\n        ctx->state[7] = 0xBEFA4FA4;\n        ctx->transform = sha256_transform;\n        break;\n    case 256:\n        ctx->state[0] = 0x6A09E667;\n        ctx->state[1] = 0xBB67AE85;\n        ctx->state[2] = 0x3C6EF372;\n        ctx->state[3] = 0xA54FF53A;\n        ctx->state[4] = 0x510E527F;\n        ctx->state[5] = 0x9B05688C;\n        ctx->state[6] = 0x1F83D9AB;\n        ctx->state[7] = 0x5BE0CD19;\n        ctx->transform = sha256_transform;\n        break;\n    default:\n        return -1;\n    }\n    ctx->count = 0;\n    return 0;\n}']