libavcodec/g2meet.c:251: error: Null Dereference
  pointer `c->buf` last assigned on line 248 could be null and is dereferenced by call to `jpg_unescape()` at line 251, column 5.

libavcodec/g2meet.c:236:1: start of procedure jpg_decode_data()
234. }
235. 
236. static int jpg_decode_data(JPGContext *c, int width, int height,
     ^
237.                            const uint8_t *src, int src_size,
238.                            uint8_t *dst, int dst_stride,

libavcodec/g2meet.c:248:9: 
246.     int ret;
247. 
248.     if ((ret = av_reallocp(&c->buf,
             ^
249.                            src_size + FF_INPUT_BUFFER_PADDING_SIZE)) < 0)
250.         return ret;

libavutil/mem.c:140:1: start of procedure av_reallocp()
  138. }
  139. 
  140. int av_reallocp(void *ptr, size_t size)
       ^
  141. {
  142.     void **ptrptr = ptr;

libavutil/mem.c:142:5: 
  140. int av_reallocp(void *ptr, size_t size)
  141. {
  142.     void **ptrptr = ptr;
           ^
  143.     void *ret;
  144. 

libavutil/mem.c:145:10: Taking true branch
  143.     void *ret;
  144. 
  145.     if (!size) {
                ^
  146.         av_freep(ptr);
  147.         return 0;

libavutil/mem.c:146:9: 
  144. 
  145.     if (!size) {
  146.         av_freep(ptr);
               ^
  147.         return 0;
  148.     }

libavutil/mem.c:198:1: start of procedure av_freep()
    196. }
    197. 
    198. void av_freep(void *arg)
         ^
    199. {
    200.     void **ptr = (void **)arg;

libavutil/mem.c:200:5: 
    198. void av_freep(void *arg)
    199. {
    200.     void **ptr = (void **)arg;
             ^
    201.     av_free(*ptr);
    202.     *ptr = NULL;

libavutil/mem.c:201:5: 
    199. {
    200.     void **ptr = (void **)arg;
    201.     av_free(*ptr);
             ^
    202.     *ptr = NULL;
    203. }

libavutil/mem.c:186:1: start of procedure av_free()
      184. }
      185. 
      186. void av_free(void *ptr)
           ^
      187. {
      188. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:194:5: 
      192.     _aligned_free(ptr);
      193. #else
      194.     free(ptr);
               ^
      195. #endif
      196. }

libavutil/mem.c:196:1: return from a call to av_free
      194.     free(ptr);
      195. #endif
      196. }
           ^
      197. 
      198. void av_freep(void *arg)

libavutil/mem.c:202:5: 
    200.     void **ptr = (void **)arg;
    201.     av_free(*ptr);
    202.     *ptr = NULL;
             ^
    203. }
    204. 

libavutil/mem.c:203:1: return from a call to av_freep
    201.     av_free(*ptr);
    202.     *ptr = NULL;
    203. }
         ^
    204. 
    205. void *av_mallocz(size_t size)

libavutil/mem.c:147:9: 
  145.     if (!size) {
  146.         av_freep(ptr);
  147.         return 0;
               ^
  148.     }
  149.     ret = av_realloc(*ptrptr, size);

libavutil/mem.c:158:1: return from a call to av_reallocp
  156.     *ptrptr = ret;
  157.     return 0;
  158. }
       ^
  159. 
  160. void *av_realloc_array(void *ptr, size_t nmemb, size_t size)

libavcodec/g2meet.c:248:9: Taking false branch
246.     int ret;
247. 
248.     if ((ret = av_reallocp(&c->buf,
             ^
249.                            src_size + FF_INPUT_BUFFER_PADDING_SIZE)) < 0)
250.         return ret;

libavcodec/g2meet.c:251:5: 
249.                            src_size + FF_INPUT_BUFFER_PADDING_SIZE)) < 0)
250.         return ret;
251.     jpg_unescape(src, src_size, c->buf, &unesc_size);
         ^
252.     memset(c->buf + unesc_size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
253.     init_get_bits(&gb, c->buf, unesc_size * 8);

libavcodec/g2meet.c:175:1: start of procedure jpg_unescape()
  173. }
  174. 
  175. static void jpg_unescape(const uint8_t *src, int src_size,
       ^
  176.                          uint8_t *dst, int *dst_size)
  177. {

libavcodec/g2meet.c:178:5: 
  176.                          uint8_t *dst, int *dst_size)
  177. {
  178.     const uint8_t *src_end = src + src_size;
           ^
  179.     uint8_t *dst_start = dst;
  180. 

libavcodec/g2meet.c:179:5: 
  177. {
  178.     const uint8_t *src_end = src + src_size;
  179.     uint8_t *dst_start = dst;
           ^
  180. 
  181.     while (src < src_end) {

libavcodec/g2meet.c:181:12: Loop condition is false. Leaving loop
  179.     uint8_t *dst_start = dst;
  180. 
  181.     while (src < src_end) {
                  ^
  182.         uint8_t x = *src++;
  183. 

libavcodec/g2meet.c:189:5: 
  187.             src++;
  188.     }
  189.     *dst_size = dst - dst_start;
           ^
  190. }
  191. 

libavcodec/g2meet.c:190:1: return from a call to jpg_unescape
  188.     }
  189.     *dst_size = dst - dst_start;
  190. }
       ^
  191. 
  192. static int jpg_decode_block(JPGContext *c, GetBitContext *gb,

static int jpg_decode_data(JPGContext *c, int width, int height,
                           const uint8_t *src, int src_size,
                           uint8_t *dst, int dst_stride,
                           const uint8_t *mask, int mask_stride, int num_mbs,
                           int swapuv)
{
    GetBitContext gb;
    int mb_w, mb_h, mb_x, mb_y, i, j;
    int bx, by;
    int unesc_size;
    int ret;
    if ((ret = av_reallocp(&c->buf,
                           src_size + FF_INPUT_BUFFER_PADDING_SIZE)) < 0)
        return ret;
    jpg_unescape(src, src_size, c->buf, &unesc_size);
    memset(c->buf + unesc_size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
    init_get_bits(&gb, c->buf, unesc_size * 8);
    width = FFALIGN(width, 16);
    mb_w  =  width        >> 4;
    mb_h  = (height + 15) >> 4;
    if (!num_mbs)
        num_mbs = mb_w * mb_h * 4;
    for (i = 0; i < 3; i++)
        c->prev_dc[i] = 1024;
    bx = by = 0;
    c->bdsp.clear_blocks(c->block[0]);
    for (mb_y = 0; mb_y < mb_h; mb_y++) {
        for (mb_x = 0; mb_x < mb_w; mb_x++) {
            if (mask && !mask[mb_x * 2] && !mask[mb_x * 2 + 1] &&
                !mask[mb_x * 2 +     mask_stride] &&
                !mask[mb_x * 2 + 1 + mask_stride]) {
                bx += 16;
                continue;
            }
            for (j = 0; j < 2; j++) {
                for (i = 0; i < 2; i++) {
                    if (mask && !mask[mb_x * 2 + i + j * mask_stride])
                        continue;
                    num_mbs--;
                    if ((ret = jpg_decode_block(c, &gb, 0,
                                                c->block[i + j * 2])) != 0)
                        return ret;
                    c->dsp.idct(c->block[i + j * 2]);
                }
            }
            for (i = 1; i < 3; i++) {
                if ((ret = jpg_decode_block(c, &gb, i, c->block[i + 3])) != 0)
                    return ret;
                c->dsp.idct(c->block[i + 3]);
            }
            for (j = 0; j < 16; j++) {
                uint8_t *out = dst + bx * 3 + (by + j) * dst_stride;
                for (i = 0; i < 16; i++) {
                    int Y, U, V;
                    Y = c->block[(j >> 3) * 2 + (i >> 3)][(i & 7) + (j & 7) * 8];
                    U = c->block[4 ^ swapuv][(i >> 1) + (j >> 1) * 8] - 128;
                    V = c->block[5 ^ swapuv][(i >> 1) + (j >> 1) * 8] - 128;
                    yuv2rgb(out + i * 3, Y, U, V);
                }
            }
            if (!num_mbs)
                return 0;
            bx += 16;
        }
        bx  = 0;
        by += 16;
        if (mask)
            mask += mask_stride * 2;
    }
    return 0;
}
['static int jpg_decode_data(JPGContext *c, int width, int height,\n                           const uint8_t *src, int src_size,\n                           uint8_t *dst, int dst_stride,\n                           const uint8_t *mask, int mask_stride, int num_mbs,\n                           int swapuv)\n{\n    GetBitContext gb;\n    int mb_w, mb_h, mb_x, mb_y, i, j;\n    int bx, by;\n    int unesc_size;\n    int ret;\n    if ((ret = av_reallocp(&c->buf,\n                           src_size + FF_INPUT_BUFFER_PADDING_SIZE)) < 0)\n        return ret;\n    jpg_unescape(src, src_size, c->buf, &unesc_size);\n    memset(c->buf + unesc_size, 0, FF_INPUT_BUFFER_PADDING_SIZE);\n    init_get_bits(&gb, c->buf, unesc_size * 8);\n    width = FFALIGN(width, 16);\n    mb_w  =  width        >> 4;\n    mb_h  = (height + 15) >> 4;\n    if (!num_mbs)\n        num_mbs = mb_w * mb_h * 4;\n    for (i = 0; i < 3; i++)\n        c->prev_dc[i] = 1024;\n    bx = by = 0;\n    c->bdsp.clear_blocks(c->block[0]);\n    for (mb_y = 0; mb_y < mb_h; mb_y++) {\n        for (mb_x = 0; mb_x < mb_w; mb_x++) {\n            if (mask && !mask[mb_x * 2] && !mask[mb_x * 2 + 1] &&\n                !mask[mb_x * 2 +     mask_stride] &&\n                !mask[mb_x * 2 + 1 + mask_stride]) {\n                bx += 16;\n                continue;\n            }\n            for (j = 0; j < 2; j++) {\n                for (i = 0; i < 2; i++) {\n                    if (mask && !mask[mb_x * 2 + i + j * mask_stride])\n                        continue;\n                    num_mbs--;\n                    if ((ret = jpg_decode_block(c, &gb, 0,\n                                                c->block[i + j * 2])) != 0)\n                        return ret;\n                    c->dsp.idct(c->block[i + j * 2]);\n                }\n            }\n            for (i = 1; i < 3; i++) {\n                if ((ret = jpg_decode_block(c, &gb, i, c->block[i + 3])) != 0)\n                    return ret;\n                c->dsp.idct(c->block[i + 3]);\n            }\n            for (j = 0; j < 16; j++) {\n                uint8_t *out = dst + bx * 3 + (by + j) * dst_stride;\n                for (i = 0; i < 16; i++) {\n                    int Y, U, V;\n                    Y = c->block[(j >> 3) * 2 + (i >> 3)][(i & 7) + (j & 7) * 8];\n                    U = c->block[4 ^ swapuv][(i >> 1) + (j >> 1) * 8] - 128;\n                    V = c->block[5 ^ swapuv][(i >> 1) + (j >> 1) * 8] - 128;\n                    yuv2rgb(out + i * 3, Y, U, V);\n                }\n            }\n            if (!num_mbs)\n                return 0;\n            bx += 16;\n        }\n        bx  = 0;\n        by += 16;\n        if (mask)\n            mask += mask_stride * 2;\n    }\n    return 0;\n}', 'int av_reallocp(void *ptr, size_t size)\n{\n    void **ptrptr = ptr;\n    void *ret;\n    if (!size) {\n        av_freep(ptr);\n        return 0;\n    }\n    ret = av_realloc(*ptrptr, size);\n    if (!ret) {\n        av_freep(ptr);\n        return AVERROR(ENOMEM);\n    }\n    *ptrptr = ret;\n    return 0;\n}', 'void av_freep(void *arg)\n{\n    void **ptr = (void **)arg;\n    av_free(*ptr);\n    *ptr = NULL;\n}', 'void av_free(void *ptr)\n{\n#if CONFIG_MEMALIGN_HACK\n    if (ptr)\n        free((char *)ptr - ((char *)ptr)[-1]);\n#elif HAVE_ALIGNED_MALLOC\n    _aligned_free(ptr);\n#else\n    free(ptr);\n#endif\n}', 'static void jpg_unescape(const uint8_t *src, int src_size,\n                         uint8_t *dst, int *dst_size)\n{\n    const uint8_t *src_end = src + src_size;\n    uint8_t *dst_start = dst;\n    while (src < src_end) {\n        uint8_t x = *src++;\n        *dst++ = x;\n        if (x == 0xFF && !*src)\n            src++;\n    }\n    *dst_size = dst - dst_start;\n}']