libavcodec/flacdec.c:579: error: Null Dereference
  pointer `s->bitstream` last assigned on line 575 could be null and is dereferenced at line 579, column 38.

libavcodec/flacdec.c:561:1: start of procedure flac_decode_frame()
559. }
560. 
561. static int flac_decode_frame(AVCodecContext *avctx,
     ^
562.                             void *data, int *data_size,
563.                             const uint8_t *buf, int buf_size)

libavcodec/flacdec.c:565:5: 
563.                             const uint8_t *buf, int buf_size)
564. {
565.     FLACContext *s = avctx->priv_data;
         ^
566.     int tmp = 0, i, j = 0, input_buf_size = 0;
567.     int16_t *samples_16 = data;

libavcodec/flacdec.c:566:5: 
564. {
565.     FLACContext *s = avctx->priv_data;
566.     int tmp = 0, i, j = 0, input_buf_size = 0;
         ^
567.     int16_t *samples_16 = data;
568.     int32_t *samples_32 = data;

libavcodec/flacdec.c:567:5: 
565.     FLACContext *s = avctx->priv_data;
566.     int tmp = 0, i, j = 0, input_buf_size = 0;
567.     int16_t *samples_16 = data;
         ^
568.     int32_t *samples_32 = data;
569.     int alloc_data_size= *data_size;

libavcodec/flacdec.c:568:5: 
566.     int tmp = 0, i, j = 0, input_buf_size = 0;
567.     int16_t *samples_16 = data;
568.     int32_t *samples_32 = data;
         ^
569.     int alloc_data_size= *data_size;
570. 

libavcodec/flacdec.c:569:5: 
567.     int16_t *samples_16 = data;
568.     int32_t *samples_32 = data;
569.     int alloc_data_size= *data_size;
         ^
570. 
571.     *data_size=0;

libavcodec/flacdec.c:571:5: 
569.     int alloc_data_size= *data_size;
570. 
571.     *data_size=0;
         ^
572. 
573.     if (s->max_framesize == 0) {

libavcodec/flacdec.c:573:9: Taking true branch
571.     *data_size=0;
572. 
573.     if (s->max_framesize == 0) {
             ^
574.         s->max_framesize= FFMAX(4, buf_size); // should hopefully be enough for the first header
575.         s->bitstream= av_fast_realloc(s->bitstream, &s->allocated_bitstream_size, s->max_framesize);

libavcodec/flacdec.c:574:27: Condition is false
572. 
573.     if (s->max_framesize == 0) {
574.         s->max_framesize= FFMAX(4, buf_size); // should hopefully be enough for the first header
                               ^
575.         s->bitstream= av_fast_realloc(s->bitstream, &s->allocated_bitstream_size, s->max_framesize);
576.     }

libavcodec/flacdec.c:574:9: 
572. 
573.     if (s->max_framesize == 0) {
574.         s->max_framesize= FFMAX(4, buf_size); // should hopefully be enough for the first header
             ^
575.         s->bitstream= av_fast_realloc(s->bitstream, &s->allocated_bitstream_size, s->max_framesize);
576.     }

libavcodec/flacdec.c:575:9: 
573.     if (s->max_framesize == 0) {
574.         s->max_framesize= FFMAX(4, buf_size); // should hopefully be enough for the first header
575.         s->bitstream= av_fast_realloc(s->bitstream, &s->allocated_bitstream_size, s->max_framesize);
             ^
576.     }
577. 

libavcodec/utils.c:69:1: start of procedure av_fast_realloc()
  67. static int volatile entangled_thread_counter=0;
  68. 
  69. void *av_fast_realloc(void *ptr, unsigned int *size, unsigned int min_size)
      ^
  70. {
  71.     if(min_size < *size)

libavcodec/utils.c:71:8: Taking false branch
  69. void *av_fast_realloc(void *ptr, unsigned int *size, unsigned int min_size)
  70. {
  71.     if(min_size < *size)
             ^
  72.         return ptr;
  73. 

libavcodec/utils.c:74:12: Condition is false
  72.         return ptr;
  73. 
  74.     *size= FFMAX(17*min_size/16 + 32, min_size);
                 ^
  75. 
  76.     ptr= av_realloc(ptr, *size);

libavcodec/utils.c:74:5: 
  72.         return ptr;
  73. 
  74.     *size= FFMAX(17*min_size/16 + 32, min_size);
          ^
  75. 
  76.     ptr= av_realloc(ptr, *size);

libavcodec/utils.c:76:5: 
  74.     *size= FFMAX(17*min_size/16 + 32, min_size);
  75. 
  76.     ptr= av_realloc(ptr, *size);
          ^
  77.     if(!ptr) //we could set this to the unmodified min_size but this is safer if the user lost the ptr and uses NULL now
  78.         *size= 0;

libavutil/mem.c:101:1: start of procedure av_realloc()
     99. }
    100. 
    101. void *av_realloc(void *ptr, unsigned int size)
         ^
    102. {
    103. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:108:8: Taking true branch
    106. 
    107.     /* let's disallow possible ambiguous cases */
    108.     if(size > (INT_MAX-16) )
                ^
    109.         return NULL;
    110. 

libavutil/mem.c:109:9: 
    107.     /* let's disallow possible ambiguous cases */
    108.     if(size > (INT_MAX-16) )
    109.         return NULL;
                 ^
    110. 
    111. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:119:1: return from a call to av_realloc
    117.     return realloc(ptr, size);
    118. #endif
    119. }
         ^
    120. 
    121. void av_free(void *ptr)

libavcodec/utils.c:77:9: Taking true branch
  75. 
  76.     ptr= av_realloc(ptr, *size);
  77.     if(!ptr) //we could set this to the unmodified min_size but this is safer if the user lost the ptr and uses NULL now
              ^
  78.         *size= 0;
  79. 

libavcodec/utils.c:78:9: 
  76.     ptr= av_realloc(ptr, *size);
  77.     if(!ptr) //we could set this to the unmodified min_size but this is safer if the user lost the ptr and uses NULL now
  78.         *size= 0;
              ^
  79. 
  80.     return ptr;

libavcodec/utils.c:80:5: 
  78.         *size= 0;
  79. 
  80.     return ptr;
          ^
  81. }
  82. 

libavcodec/utils.c:81:1: return from a call to av_fast_realloc
  79. 
  80.     return ptr;
  81. }
      ^
  82. 
  83. /* encoder management */

libavcodec/flacdec.c:578:9: Taking true branch
576.     }
577. 
578.     if (1 && s->max_framesize) { //FIXME truncated
             ^
579.         if (s->bitstream_size < 4 || AV_RL32(s->bitstream) != MKTAG('f','L','a','C'))
580.             buf_size= FFMIN(buf_size, s->max_framesize - FFMIN(s->bitstream_size, s->max_framesize));

libavcodec/flacdec.c:578:14: Taking true branch
576.     }
577. 
578.     if (1 && s->max_framesize) { //FIXME truncated
                  ^
579.         if (s->bitstream_size < 4 || AV_RL32(s->bitstream) != MKTAG('f','L','a','C'))
580.             buf_size= FFMIN(buf_size, s->max_framesize - FFMIN(s->bitstream_size, s->max_framesize));

libavcodec/flacdec.c:579:13: Taking false branch
577. 
578.     if (1 && s->max_framesize) { //FIXME truncated
579.         if (s->bitstream_size < 4 || AV_RL32(s->bitstream) != MKTAG('f','L','a','C'))
                 ^
580.             buf_size= FFMIN(buf_size, s->max_framesize - FFMIN(s->bitstream_size, s->max_framesize));
581.         input_buf_size= buf_size;

libavcodec/flacdec.c:579:38: 
577. 
578.     if (1 && s->max_framesize) { //FIXME truncated
579.         if (s->bitstream_size < 4 || AV_RL32(s->bitstream) != MKTAG('f','L','a','C'))
                                          ^
580.             buf_size= FFMIN(buf_size, s->max_framesize - FFMIN(s->bitstream_size, s->max_framesize));
581.         input_buf_size= buf_size;

static int flac_decode_frame(AVCodecContext *avctx,
                            void *data, int *data_size,
                            const uint8_t *buf, int buf_size)
{
    FLACContext *s = avctx->priv_data;
    int tmp = 0, i, j = 0, input_buf_size = 0;
    int16_t *samples_16 = data;
    int32_t *samples_32 = data;
    int alloc_data_size= *data_size;
    *data_size=0;
    if (s->max_framesize == 0) {
        s->max_framesize= FFMAX(4, buf_size);
        s->bitstream= av_fast_realloc(s->bitstream, &s->allocated_bitstream_size, s->max_framesize);
    }
    if (1 && s->max_framesize) {
        if (s->bitstream_size < 4 || AV_RL32(s->bitstream) != MKTAG('f','L','a','C'))
            buf_size= FFMIN(buf_size, s->max_framesize - FFMIN(s->bitstream_size, s->max_framesize));
        input_buf_size= buf_size;
        if (s->bitstream_size + buf_size < buf_size || s->bitstream_index + s->bitstream_size + buf_size < s->bitstream_index)
            return -1;
        if (s->allocated_bitstream_size < s->bitstream_size + buf_size)
            s->bitstream= av_fast_realloc(s->bitstream, &s->allocated_bitstream_size, s->bitstream_size + buf_size);
        if (s->bitstream_index + s->bitstream_size + buf_size > s->allocated_bitstream_size) {
            memmove(s->bitstream, &s->bitstream[s->bitstream_index],
                    s->bitstream_size);
            s->bitstream_index=0;
        }
        memcpy(&s->bitstream[s->bitstream_index + s->bitstream_size],
               buf, buf_size);
        buf= &s->bitstream[s->bitstream_index];
        buf_size += s->bitstream_size;
        s->bitstream_size= buf_size;
        if (buf_size < s->max_framesize && input_buf_size) {
            return input_buf_size;
        }
    }
    init_get_bits(&s->gb, buf, buf_size*8);
    if (metadata_parse(s))
        goto end;
    tmp = show_bits(&s->gb, 16);
    if ((tmp & 0xFFFE) != 0xFFF8) {
        av_log(s->avctx, AV_LOG_ERROR, "FRAME HEADER not here\n");
        while (get_bits_count(&s->gb)/8+2 < buf_size && (show_bits(&s->gb, 16) & 0xFFFE) != 0xFFF8)
            skip_bits(&s->gb, 8);
        goto end;
    }
    skip_bits(&s->gb, 16);
    if (decode_frame(s, alloc_data_size) < 0) {
        av_log(s->avctx, AV_LOG_ERROR, "decode_frame() failed\n");
        s->bitstream_size=0;
        s->bitstream_index=0;
        return -1;
    }
#define DECORRELATE(left, right)\
            assert(s->channels == 2);\
            for (i = 0; i < s->blocksize; i++) {\
                int a= s->decoded[0][i];\
                int b= s->decoded[1][i];\
                if (s->is32) {\
                    *samples_32++ = (left)  << s->sample_shift;\
                    *samples_32++ = (right) << s->sample_shift;\
                } else {\
                    *samples_16++ = (left)  << s->sample_shift;\
                    *samples_16++ = (right) << s->sample_shift;\
                }\
            }\
            break;
    switch (s->decorrelation) {
    case INDEPENDENT:
        for (j = 0; j < s->blocksize; j++) {
            for (i = 0; i < s->channels; i++) {
                if (s->is32)
                    *samples_32++ = s->decoded[i][j] << s->sample_shift;
                else
                    *samples_16++ = s->decoded[i][j] << s->sample_shift;
            }
        }
        break;
    case LEFT_SIDE:
        DECORRELATE(a,a-b)
    case RIGHT_SIDE:
        DECORRELATE(a+b,b)
    case MID_SIDE:
        DECORRELATE( (a-=b>>1) + b, a)
    }
    *data_size = s->blocksize * s->channels * (s->is32 ? 4 : 2);
end:
    i= (get_bits_count(&s->gb)+7)/8;
    if (i > buf_size) {
        av_log(s->avctx, AV_LOG_ERROR, "overread: %d\n", i - buf_size);
        s->bitstream_size=0;
        s->bitstream_index=0;
        return -1;
    }
    if (s->bitstream_size) {
        s->bitstream_index += i;
        s->bitstream_size  -= i;
        return input_buf_size;
    } else
        return i;
}
['static int flac_decode_frame(AVCodecContext *avctx,\n                            void *data, int *data_size,\n                            const uint8_t *buf, int buf_size)\n{\n    FLACContext *s = avctx->priv_data;\n    int tmp = 0, i, j = 0, input_buf_size = 0;\n    int16_t *samples_16 = data;\n    int32_t *samples_32 = data;\n    int alloc_data_size= *data_size;\n    *data_size=0;\n    if (s->max_framesize == 0) {\n        s->max_framesize= FFMAX(4, buf_size);\n        s->bitstream= av_fast_realloc(s->bitstream, &s->allocated_bitstream_size, s->max_framesize);\n    }\n    if (1 && s->max_framesize) {\n        if (s->bitstream_size < 4 || AV_RL32(s->bitstream) != MKTAG(\'f\',\'L\',\'a\',\'C\'))\n            buf_size= FFMIN(buf_size, s->max_framesize - FFMIN(s->bitstream_size, s->max_framesize));\n        input_buf_size= buf_size;\n        if (s->bitstream_size + buf_size < buf_size || s->bitstream_index + s->bitstream_size + buf_size < s->bitstream_index)\n            return -1;\n        if (s->allocated_bitstream_size < s->bitstream_size + buf_size)\n            s->bitstream= av_fast_realloc(s->bitstream, &s->allocated_bitstream_size, s->bitstream_size + buf_size);\n        if (s->bitstream_index + s->bitstream_size + buf_size > s->allocated_bitstream_size) {\n            memmove(s->bitstream, &s->bitstream[s->bitstream_index],\n                    s->bitstream_size);\n            s->bitstream_index=0;\n        }\n        memcpy(&s->bitstream[s->bitstream_index + s->bitstream_size],\n               buf, buf_size);\n        buf= &s->bitstream[s->bitstream_index];\n        buf_size += s->bitstream_size;\n        s->bitstream_size= buf_size;\n        if (buf_size < s->max_framesize && input_buf_size) {\n            return input_buf_size;\n        }\n    }\n    init_get_bits(&s->gb, buf, buf_size*8);\n    if (metadata_parse(s))\n        goto end;\n    tmp = show_bits(&s->gb, 16);\n    if ((tmp & 0xFFFE) != 0xFFF8) {\n        av_log(s->avctx, AV_LOG_ERROR, "FRAME HEADER not here\\n");\n        while (get_bits_count(&s->gb)/8+2 < buf_size && (show_bits(&s->gb, 16) & 0xFFFE) != 0xFFF8)\n            skip_bits(&s->gb, 8);\n        goto end;\n    }\n    skip_bits(&s->gb, 16);\n    if (decode_frame(s, alloc_data_size) < 0) {\n        av_log(s->avctx, AV_LOG_ERROR, "decode_frame() failed\\n");\n        s->bitstream_size=0;\n        s->bitstream_index=0;\n        return -1;\n    }\n#define DECORRELATE(left, right)\\\n            assert(s->channels == 2);\\\n            for (i = 0; i < s->blocksize; i++) {\\\n                int a= s->decoded[0][i];\\\n                int b= s->decoded[1][i];\\\n                if (s->is32) {\\\n                    *samples_32++ = (left)  << s->sample_shift;\\\n                    *samples_32++ = (right) << s->sample_shift;\\\n                } else {\\\n                    *samples_16++ = (left)  << s->sample_shift;\\\n                    *samples_16++ = (right) << s->sample_shift;\\\n                }\\\n            }\\\n            break;\n    switch (s->decorrelation) {\n    case INDEPENDENT:\n        for (j = 0; j < s->blocksize; j++) {\n            for (i = 0; i < s->channels; i++) {\n                if (s->is32)\n                    *samples_32++ = s->decoded[i][j] << s->sample_shift;\n                else\n                    *samples_16++ = s->decoded[i][j] << s->sample_shift;\n            }\n        }\n        break;\n    case LEFT_SIDE:\n        DECORRELATE(a,a-b)\n    case RIGHT_SIDE:\n        DECORRELATE(a+b,b)\n    case MID_SIDE:\n        DECORRELATE( (a-=b>>1) + b, a)\n    }\n    *data_size = s->blocksize * s->channels * (s->is32 ? 4 : 2);\nend:\n    i= (get_bits_count(&s->gb)+7)/8;\n    if (i > buf_size) {\n        av_log(s->avctx, AV_LOG_ERROR, "overread: %d\\n", i - buf_size);\n        s->bitstream_size=0;\n        s->bitstream_index=0;\n        return -1;\n    }\n    if (s->bitstream_size) {\n        s->bitstream_index += i;\n        s->bitstream_size  -= i;\n        return input_buf_size;\n    } else\n        return i;\n}', 'void *av_fast_realloc(void *ptr, unsigned int *size, unsigned int min_size)\n{\n    if(min_size < *size)\n        return ptr;\n    *size= FFMAX(17*min_size/16 + 32, min_size);\n    ptr= av_realloc(ptr, *size);\n    if(!ptr)\n        *size= 0;\n    return ptr;\n}', 'void *av_realloc(void *ptr, unsigned int size)\n{\n#if CONFIG_MEMALIGN_HACK\n    int diff;\n#endif\n    if(size > (INT_MAX-16) )\n        return NULL;\n#if CONFIG_MEMALIGN_HACK\n    if(!ptr) return av_malloc(size);\n    diff= ((char*)ptr)[-1];\n    return (char*)realloc((char*)ptr - diff, size + diff) + diff;\n#else\n    return realloc(ptr, size);\n#endif\n}']