libavcodec/movsub_bsf.c:48: error: Null Dereference
  pointer `*poutbuf` last assigned on line 47 could be null and is dereferenced by call to `memcpy()` at line 48, column 5.

libavcodec/movsub_bsf.c:42:1: start of procedure mov2textsub()
40. };
41. 
42. static int mov2textsub(AVBitStreamFilterContext *bsfc, AVCodecContext *avctx, const char *args,
    ^
43.                      uint8_t **poutbuf, int *poutbuf_size,
44.                      const uint8_t *buf, int buf_size, int keyframe){

libavcodec/movsub_bsf.c:45:9: Taking false branch
43.                      uint8_t **poutbuf, int *poutbuf_size,
44.                      const uint8_t *buf, int buf_size, int keyframe){
45.     if (buf_size < 2) return 0;
            ^
46.     *poutbuf_size = FFMIN(buf_size - 2, AV_RB16(buf));
47.     *poutbuf = av_malloc(*poutbuf_size + FF_INPUT_BUFFER_PADDING_SIZE);

libavcodec/movsub_bsf.c:46:21: Condition is true
44.                      const uint8_t *buf, int buf_size, int keyframe){
45.     if (buf_size < 2) return 0;
46.     *poutbuf_size = FFMIN(buf_size - 2, AV_RB16(buf));
                        ^
47.     *poutbuf = av_malloc(*poutbuf_size + FF_INPUT_BUFFER_PADDING_SIZE);
48.     memcpy(*poutbuf, buf + 2, *poutbuf_size);

libavcodec/movsub_bsf.c:46:5: 
44.                      const uint8_t *buf, int buf_size, int keyframe){
45.     if (buf_size < 2) return 0;
46.     *poutbuf_size = FFMIN(buf_size - 2, AV_RB16(buf));
        ^
47.     *poutbuf = av_malloc(*poutbuf_size + FF_INPUT_BUFFER_PADDING_SIZE);
48.     memcpy(*poutbuf, buf + 2, *poutbuf_size);

libavcodec/movsub_bsf.c:47:5: 
45.     if (buf_size < 2) return 0;
46.     *poutbuf_size = FFMIN(buf_size - 2, AV_RB16(buf));
47.     *poutbuf = av_malloc(*poutbuf_size + FF_INPUT_BUFFER_PADDING_SIZE);
        ^
48.     memcpy(*poutbuf, buf + 2, *poutbuf_size);
49.     return 1;

libavutil/mem.c:43:1: start of procedure av_malloc()
  41.    linker will do it automatically */
  42. 
  43. void *av_malloc(unsigned int size)
      ^
  44. {
  45.     void *ptr = NULL;

libavutil/mem.c:45:5: 
  43. void *av_malloc(unsigned int size)
  44. {
  45.     void *ptr = NULL;
          ^
  46. #ifdef CONFIG_MEMALIGN_HACK
  47.     long diff;

libavutil/mem.c:51:8: Taking true branch
  49. 
  50.     /* let's disallow possible ambiguous cases */
  51.     if(size > (INT_MAX-16) )
             ^
  52.         return NULL;
  53. 

libavutil/mem.c:52:9: 
  50.     /* let's disallow possible ambiguous cases */
  51.     if(size > (INT_MAX-16) )
  52.         return NULL;
              ^
  53. 
  54. #ifdef CONFIG_MEMALIGN_HACK

libavutil/mem.c:95:1: return from a call to av_malloc
  93. #endif
  94.     return ptr;
  95. }
      ^
  96. 
  97. void *av_realloc(void *ptr, unsigned int size)

libavcodec/movsub_bsf.c:48:5: 
46.     *poutbuf_size = FFMIN(buf_size - 2, AV_RB16(buf));
47.     *poutbuf = av_malloc(*poutbuf_size + FF_INPUT_BUFFER_PADDING_SIZE);
48.     memcpy(*poutbuf, buf + 2, *poutbuf_size);
        ^
49.     return 1;
50. }

static int mov2textsub(AVBitStreamFilterContext *bsfc, AVCodecContext *avctx, const char *args,
                     uint8_t **poutbuf, int *poutbuf_size,
                     const uint8_t *buf, int buf_size, int keyframe){
    if (buf_size < 2) return 0;
    *poutbuf_size = FFMIN(buf_size - 2, AV_RB16(buf));
    *poutbuf = av_malloc(*poutbuf_size + FF_INPUT_BUFFER_PADDING_SIZE);
    memcpy(*poutbuf, buf + 2, *poutbuf_size);
    return 1;
}
['static int mov2textsub(AVBitStreamFilterContext *bsfc, AVCodecContext *avctx, const char *args,\n                     uint8_t **poutbuf, int *poutbuf_size,\n                     const uint8_t *buf, int buf_size, int keyframe){\n    if (buf_size < 2) return 0;\n    *poutbuf_size = FFMIN(buf_size - 2, AV_RB16(buf));\n    *poutbuf = av_malloc(*poutbuf_size + FF_INPUT_BUFFER_PADDING_SIZE);\n    memcpy(*poutbuf, buf + 2, *poutbuf_size);\n    return 1;\n}', 'void *av_malloc(unsigned int size)\n{\n    void *ptr = NULL;\n#ifdef CONFIG_MEMALIGN_HACK\n    long diff;\n#endif\n    if(size > (INT_MAX-16) )\n        return NULL;\n#ifdef CONFIG_MEMALIGN_HACK\n    ptr = malloc(size+16);\n    if(!ptr)\n        return ptr;\n    diff= ((-(long)ptr - 1)&15) + 1;\n    ptr = (char*)ptr + diff;\n    ((char*)ptr)[-1]= diff;\n#elif defined (HAVE_POSIX_MEMALIGN)\n    posix_memalign(&ptr,16,size);\n#elif defined (HAVE_MEMALIGN)\n    ptr = memalign(16,size);\n#else\n    ptr = malloc(size);\n#endif\n    return ptr;\n}']