libavformat/rtspdec.c:193: error: Null Dereference
  pointer `null` is dereferenced by call to `rtsp_send_reply()` at line 193, column 13.

libavformat/rtspdec.c:170:1: start of procedure rtsp_read_announce()
168. }
169. 
170. static int rtsp_read_announce(AVFormatContext *s)
     ^
171. {
172.     RTSPState *rt             = s->priv_data;

libavformat/rtspdec.c:172:5: 
170. static int rtsp_read_announce(AVFormatContext *s)
171. {
172.     RTSPState *rt             = s->priv_data;
         ^
173.     RTSPMessageHeader request = { 0 };
174.     char sdp[4096];

libavformat/rtspdec.c:173:5: 
171. {
172.     RTSPState *rt             = s->priv_data;
173.     RTSPMessageHeader request = { 0 };
         ^
174.     char sdp[4096];
175.     int  ret;

libavformat/rtspdec.c:177:5: Skipping rtsp_read_request(): empty list of specs
175.     int  ret;
176. 
177.     ret = rtsp_read_request(s, &request, "ANNOUNCE");
         ^
178.     if (ret)
179.         return ret;

libavformat/rtspdec.c:178:9: Taking false branch
176. 
177.     ret = rtsp_read_request(s, &request, "ANNOUNCE");
178.     if (ret)
             ^
179.         return ret;
180.     rt->seq++;

libavformat/rtspdec.c:180:5: 
178.     if (ret)
179.         return ret;
180.     rt->seq++;
         ^
181.     if (strcmp(request.content_type, "application/sdp")) {
182.         av_log(s, AV_LOG_ERROR, "Unexpected content type %s\n",

libavformat/rtspdec.c:181:9: Taking false branch
179.         return ret;
180.     rt->seq++;
181.     if (strcmp(request.content_type, "application/sdp")) {
             ^
182.         av_log(s, AV_LOG_ERROR, "Unexpected content type %s\n",
183.                request.content_type);

libavformat/rtspdec.c:187:9: Taking true branch
185.         return AVERROR_OPTION_NOT_FOUND;
186.     }
187.     if (request.content_length && request.content_length < sizeof(sdp) - 1) {
             ^
188.         /* Read SDP */
189.         if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)

libavformat/rtspdec.c:187:35: Taking true branch
185.         return AVERROR_OPTION_NOT_FOUND;
186.     }
187.     if (request.content_length && request.content_length < sizeof(sdp) - 1) {
                                       ^
188.         /* Read SDP */
189.         if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)

libavformat/rtspdec.c:189:13: 
187.     if (request.content_length && request.content_length < sizeof(sdp) - 1) {
188.         /* Read SDP */
189.         if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)
                 ^
190.             < request.content_length) {
191.             av_log(s, AV_LOG_ERROR,

libavformat/avio.c:258:1: start of procedure ffurl_read_complete()
  256. }
  257. 
  258. int ffurl_read_complete(URLContext *h, unsigned char *buf, int size)
       ^
  259. {
  260.     if (!(h->flags & AVIO_FLAG_READ))

libavformat/avio.c:260:11: Taking true branch
  258. int ffurl_read_complete(URLContext *h, unsigned char *buf, int size)
  259. {
  260.     if (!(h->flags & AVIO_FLAG_READ))
                 ^
  261.         return AVERROR(EIO);
  262.     return retry_transfer_wrapper(h, buf, size, size, h->prot->url_read);

libavformat/avio.c:261:9: 
  259. {
  260.     if (!(h->flags & AVIO_FLAG_READ))
  261.         return AVERROR(EIO);
               ^
  262.     return retry_transfer_wrapper(h, buf, size, size, h->prot->url_read);
  263. }

libavformat/avio.c:263:1: return from a call to ffurl_read_complete
  261.         return AVERROR(EIO);
  262.     return retry_transfer_wrapper(h, buf, size, size, h->prot->url_read);
  263. }
       ^
  264. 
  265. int ffurl_write(URLContext *h, const unsigned char *buf, int size)

libavformat/rtspdec.c:189:13: Taking true branch
187.     if (request.content_length && request.content_length < sizeof(sdp) - 1) {
188.         /* Read SDP */
189.         if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)
                 ^
190.             < request.content_length) {
191.             av_log(s, AV_LOG_ERROR,

libavformat/rtspdec.c:191:13: Skipping av_log(): empty list of specs
189.         if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)
190.             < request.content_length) {
191.             av_log(s, AV_LOG_ERROR,
                 ^
192.                    "Unable to get complete SDP Description in ANNOUNCE\n");
193.             rtsp_send_reply(s, RTSP_STATUS_INTERNAL, NULL, request.seq);

libavformat/rtspdec.c:193:13: 
191.             av_log(s, AV_LOG_ERROR,
192.                    "Unable to get complete SDP Description in ANNOUNCE\n");
193.             rtsp_send_reply(s, RTSP_STATUS_INTERNAL, NULL, request.seq);
                 ^
194.             return AVERROR(EIO);
195.         }

libavformat/rtspdec.c:95:1: start of procedure rtsp_send_reply()
  93. }
  94. 
  95. static int rtsp_send_reply(AVFormatContext *s, enum RTSPStatusCode code,
      ^
  96.                            const char *extracontent, uint16_t seq)
  97. {

libavformat/rtspdec.c:98:5: 
   96.                            const char *extracontent, uint16_t seq)
   97. {
   98.     RTSPState *rt = s->priv_data;
           ^
   99.     char message[4096];
  100.     int index = 0;

libavformat/rtspdec.c:100:5: 
   98.     RTSPState *rt = s->priv_data;
   99.     char message[4096];
  100.     int index = 0;
           ^
  101.     while (status_messages[index].code) {
  102.         if (status_messages[index].code == code) {

libavformat/rtspdec.c:101:12: Loop condition is true. Entering loop body
   99.     char message[4096];
  100.     int index = 0;
  101.     while (status_messages[index].code) {
                  ^
  102.         if (status_messages[index].code == code) {
  103.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",

libavformat/rtspdec.c:102:13: Taking false branch
  100.     int index = 0;
  101.     while (status_messages[index].code) {
  102.         if (status_messages[index].code == code) {
                   ^
  103.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",
  104.                      code, status_messages[index].message);

libavformat/rtspdec.c:107:9: 
  105.             break;
  106.         }
  107.         index++;
               ^
  108.     }
  109.     if (!status_messages[index].code)

libavformat/rtspdec.c:101:12: Loop condition is true. Entering loop body
   99.     char message[4096];
  100.     int index = 0;
  101.     while (status_messages[index].code) {
                  ^
  102.         if (status_messages[index].code == code) {
  103.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",

libavformat/rtspdec.c:102:13: Taking false branch
  100.     int index = 0;
  101.     while (status_messages[index].code) {
  102.         if (status_messages[index].code == code) {
                   ^
  103.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",
  104.                      code, status_messages[index].message);

libavformat/rtspdec.c:107:9: 
  105.             break;
  106.         }
  107.         index++;
               ^
  108.     }
  109.     if (!status_messages[index].code)

libavformat/rtspdec.c:101:12: Loop condition is false. Leaving loop
   99.     char message[4096];
  100.     int index = 0;
  101.     while (status_messages[index].code) {
                  ^
  102.         if (status_messages[index].code == code) {
  103.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",

libavformat/rtspdec.c:109:10: Taking true branch
  107.         index++;
  108.     }
  109.     if (!status_messages[index].code)
                ^
  110.         return AVERROR(EINVAL);
  111.     av_strlcatf(message, sizeof(message), "CSeq: %d\r\n", seq);

libavformat/rtspdec.c:110:9: 
  108.     }
  109.     if (!status_messages[index].code)
  110.         return AVERROR(EINVAL);
               ^
  111.     av_strlcatf(message, sizeof(message), "CSeq: %d\r\n", seq);
  112.     av_strlcatf(message, sizeof(message), "Server: %s\r\n", LIBAVFORMAT_IDENT);

libavformat/rtspdec.c:120:1: return from a call to rtsp_send_reply
  118. 
  119.     return 0;
  120. }
       ^
  121. 
  122. static inline int check_sessionid(AVFormatContext *s,

static int rtsp_read_announce(AVFormatContext *s)
{
    RTSPState *rt             = s->priv_data;
    RTSPMessageHeader request = { 0 };
    char sdp[4096];
    int  ret;
    ret = rtsp_read_request(s, &request, "ANNOUNCE");
    if (ret)
        return ret;
    rt->seq++;
    if (strcmp(request.content_type, "application/sdp")) {
        av_log(s, AV_LOG_ERROR, "Unexpected content type %s\n",
               request.content_type);
        rtsp_send_reply(s, RTSP_STATUS_SERVICE, NULL, request.seq);
        return AVERROR_OPTION_NOT_FOUND;
    }
    if (request.content_length && request.content_length < sizeof(sdp) - 1) {
        if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)
            < request.content_length) {
            av_log(s, AV_LOG_ERROR,
                   "Unable to get complete SDP Description in ANNOUNCE\n");
            rtsp_send_reply(s, RTSP_STATUS_INTERNAL, NULL, request.seq);
            return AVERROR(EIO);
        }
        sdp[request.content_length] = '\0';
        av_log(s, AV_LOG_VERBOSE, "SDP: %s\n", sdp);
        ret = ff_sdp_parse(s, sdp);
        if (ret)
            return ret;
        rtsp_send_reply(s, RTSP_STATUS_OK, NULL, request.seq);
        return 0;
    }
    av_log(s, AV_LOG_ERROR,
           "Content-Length header value exceeds sdp allocated buffer (4KB)\n");
    rtsp_send_reply(s, RTSP_STATUS_INTERNAL,
                    "Content-Length exceeds buffer size", request.seq);
    return AVERROR(EIO);
}
['static int rtsp_read_announce(AVFormatContext *s)\n{\n    RTSPState *rt             = s->priv_data;\n    RTSPMessageHeader request = { 0 };\n    char sdp[4096];\n    int  ret;\n    ret = rtsp_read_request(s, &request, "ANNOUNCE");\n    if (ret)\n        return ret;\n    rt->seq++;\n    if (strcmp(request.content_type, "application/sdp")) {\n        av_log(s, AV_LOG_ERROR, "Unexpected content type %s\\n",\n               request.content_type);\n        rtsp_send_reply(s, RTSP_STATUS_SERVICE, NULL, request.seq);\n        return AVERROR_OPTION_NOT_FOUND;\n    }\n    if (request.content_length && request.content_length < sizeof(sdp) - 1) {\n        if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)\n            < request.content_length) {\n            av_log(s, AV_LOG_ERROR,\n                   "Unable to get complete SDP Description in ANNOUNCE\\n");\n            rtsp_send_reply(s, RTSP_STATUS_INTERNAL, NULL, request.seq);\n            return AVERROR(EIO);\n        }\n        sdp[request.content_length] = \'\\0\';\n        av_log(s, AV_LOG_VERBOSE, "SDP: %s\\n", sdp);\n        ret = ff_sdp_parse(s, sdp);\n        if (ret)\n            return ret;\n        rtsp_send_reply(s, RTSP_STATUS_OK, NULL, request.seq);\n        return 0;\n    }\n    av_log(s, AV_LOG_ERROR,\n           "Content-Length header value exceeds sdp allocated buffer (4KB)\\n");\n    rtsp_send_reply(s, RTSP_STATUS_INTERNAL,\n                    "Content-Length exceeds buffer size", request.seq);\n    return AVERROR(EIO);\n}', 'int ffurl_read_complete(URLContext *h, unsigned char *buf, int size)\n{\n    if (!(h->flags & AVIO_FLAG_READ))\n        return AVERROR(EIO);\n    return retry_transfer_wrapper(h, buf, size, size, h->prot->url_read);\n}', 'static int rtsp_send_reply(AVFormatContext *s, enum RTSPStatusCode code,\n                           const char *extracontent, uint16_t seq)\n{\n    RTSPState *rt = s->priv_data;\n    char message[4096];\n    int index = 0;\n    while (status_messages[index].code) {\n        if (status_messages[index].code == code) {\n            snprintf(message, sizeof(message), "RTSP/1.0 %d %s\\r\\n",\n                     code, status_messages[index].message);\n            break;\n        }\n        index++;\n    }\n    if (!status_messages[index].code)\n        return AVERROR(EINVAL);\n    av_strlcatf(message, sizeof(message), "CSeq: %d\\r\\n", seq);\n    av_strlcatf(message, sizeof(message), "Server: %s\\r\\n", LIBAVFORMAT_IDENT);\n    if (extracontent)\n        av_strlcat(message, extracontent, sizeof(message));\n    av_strlcat(message, "\\r\\n", sizeof(message));\n    av_dlog(s, "Sending response:\\n%s", message);\n    ffurl_write(rt->rtsp_hd, message, strlen(message));\n    return 0;\n}']