libavformat/rtspdec.c:200: error: Null Dereference
  pointer `null` is dereferenced by call to `rtsp_send_reply()` at line 200, column 9.

libavformat/rtspdec.c:169:1: start of procedure rtsp_read_announce()
167. }
168. 
169. static int rtsp_read_announce(AVFormatContext *s)
     ^
170. {
171.     RTSPState *rt             = s->priv_data;

libavformat/rtspdec.c:171:5: 
169. static int rtsp_read_announce(AVFormatContext *s)
170. {
171.     RTSPState *rt             = s->priv_data;
         ^
172.     RTSPMessageHeader request = { 0 };
173.     char sdp[4096];

libavformat/rtspdec.c:172:5: 
170. {
171.     RTSPState *rt             = s->priv_data;
172.     RTSPMessageHeader request = { 0 };
         ^
173.     char sdp[4096];
174.     int  ret;

libavformat/rtspdec.c:176:5: Skipping rtsp_read_request(): empty list of specs
174.     int  ret;
175. 
176.     ret = rtsp_read_request(s, &request, "ANNOUNCE");
         ^
177.     if (ret)
178.         return ret;

libavformat/rtspdec.c:177:9: Taking false branch
175. 
176.     ret = rtsp_read_request(s, &request, "ANNOUNCE");
177.     if (ret)
             ^
178.         return ret;
179.     rt->seq++;

libavformat/rtspdec.c:179:5: 
177.     if (ret)
178.         return ret;
179.     rt->seq++;
         ^
180.     if (strcmp(request.content_type, "application/sdp")) {
181.         av_log(s, AV_LOG_ERROR, "Unexpected content type %s\n",

libavformat/rtspdec.c:180:9: Taking false branch
178.         return ret;
179.     rt->seq++;
180.     if (strcmp(request.content_type, "application/sdp")) {
             ^
181.         av_log(s, AV_LOG_ERROR, "Unexpected content type %s\n",
182.                request.content_type);

libavformat/rtspdec.c:186:9: Taking true branch
184.         return AVERROR_OPTION_NOT_FOUND;
185.     }
186.     if (request.content_length && request.content_length < sizeof(sdp) - 1) {
             ^
187.         /* Read SDP */
188.         if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)

libavformat/rtspdec.c:186:35: Taking true branch
184.         return AVERROR_OPTION_NOT_FOUND;
185.     }
186.     if (request.content_length && request.content_length < sizeof(sdp) - 1) {
                                       ^
187.         /* Read SDP */
188.         if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)

libavformat/rtspdec.c:188:13: 
186.     if (request.content_length && request.content_length < sizeof(sdp) - 1) {
187.         /* Read SDP */
188.         if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)
                 ^
189.             < request.content_length) {
190.             av_log(s, AV_LOG_ERROR,

libavformat/avio.c:258:1: start of procedure ffurl_read_complete()
  256. }
  257. 
  258. int ffurl_read_complete(URLContext *h, unsigned char *buf, int size)
       ^
  259. {
  260.     if (!(h->flags & AVIO_FLAG_READ))

libavformat/avio.c:260:11: Taking true branch
  258. int ffurl_read_complete(URLContext *h, unsigned char *buf, int size)
  259. {
  260.     if (!(h->flags & AVIO_FLAG_READ))
                 ^
  261.         return AVERROR(EIO);
  262.     return retry_transfer_wrapper(h, buf, size, size, h->prot->url_read);

libavformat/avio.c:261:9: 
  259. {
  260.     if (!(h->flags & AVIO_FLAG_READ))
  261.         return AVERROR(EIO);
               ^
  262.     return retry_transfer_wrapper(h, buf, size, size, h->prot->url_read);
  263. }

libavformat/avio.c:263:1: return from a call to ffurl_read_complete
  261.         return AVERROR(EIO);
  262.     return retry_transfer_wrapper(h, buf, size, size, h->prot->url_read);
  263. }
       ^
  264. 
  265. int ffurl_write(URLContext *h, const unsigned char *buf, int size)

libavformat/rtspdec.c:188:13: Taking false branch
186.     if (request.content_length && request.content_length < sizeof(sdp) - 1) {
187.         /* Read SDP */
188.         if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)
                 ^
189.             < request.content_length) {
190.             av_log(s, AV_LOG_ERROR,

libavformat/rtspdec.c:195:9: 
193.             return AVERROR(EIO);
194.         }
195.         sdp[request.content_length] = '\0';
             ^
196.         av_log(s, AV_LOG_VERBOSE, "SDP: %s\n", sdp);
197.         ret = ff_sdp_parse(s, sdp);

libavformat/rtspdec.c:196:9: Skipping av_log(): empty list of specs
194.         }
195.         sdp[request.content_length] = '\0';
196.         av_log(s, AV_LOG_VERBOSE, "SDP: %s\n", sdp);
             ^
197.         ret = ff_sdp_parse(s, sdp);
198.         if (ret)

libavformat/rtspdec.c:197:9: Skipping ff_sdp_parse(): empty list of specs
195.         sdp[request.content_length] = '\0';
196.         av_log(s, AV_LOG_VERBOSE, "SDP: %s\n", sdp);
197.         ret = ff_sdp_parse(s, sdp);
             ^
198.         if (ret)
199.             return ret;

libavformat/rtspdec.c:198:13: Taking false branch
196.         av_log(s, AV_LOG_VERBOSE, "SDP: %s\n", sdp);
197.         ret = ff_sdp_parse(s, sdp);
198.         if (ret)
                 ^
199.             return ret;
200.         rtsp_send_reply(s, RTSP_STATUS_OK, NULL, request.seq);

libavformat/rtspdec.c:200:9: 
198.         if (ret)
199.             return ret;
200.         rtsp_send_reply(s, RTSP_STATUS_OK, NULL, request.seq);
             ^
201.         return 0;
202.     }

libavformat/rtspdec.c:94:1: start of procedure rtsp_send_reply()
  92. }
  93. 
  94. static int rtsp_send_reply(AVFormatContext *s, enum RTSPStatusCode code,
      ^
  95.                            const char *extracontent, uint16_t seq)
  96. {

libavformat/rtspdec.c:97:5: 
  95.                            const char *extracontent, uint16_t seq)
  96. {
  97.     RTSPState *rt = s->priv_data;
          ^
  98.     char message[4096];
  99.     int index = 0;

libavformat/rtspdec.c:99:5: 
   97.     RTSPState *rt = s->priv_data;
   98.     char message[4096];
   99.     int index = 0;
           ^
  100.     while (status_messages[index].code) {
  101.         if (status_messages[index].code == code) {

libavformat/rtspdec.c:100:12: Loop condition is true. Entering loop body
   98.     char message[4096];
   99.     int index = 0;
  100.     while (status_messages[index].code) {
                  ^
  101.         if (status_messages[index].code == code) {
  102.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",

libavformat/rtspdec.c:101:13: Taking false branch
   99.     int index = 0;
  100.     while (status_messages[index].code) {
  101.         if (status_messages[index].code == code) {
                   ^
  102.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",
  103.                      code, status_messages[index].message);

libavformat/rtspdec.c:106:9: 
  104.             break;
  105.         }
  106.         index++;
               ^
  107.     }
  108.     if (!status_messages[index].code)

libavformat/rtspdec.c:100:12: Loop condition is true. Entering loop body
   98.     char message[4096];
   99.     int index = 0;
  100.     while (status_messages[index].code) {
                  ^
  101.         if (status_messages[index].code == code) {
  102.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",

libavformat/rtspdec.c:101:13: Taking false branch
   99.     int index = 0;
  100.     while (status_messages[index].code) {
  101.         if (status_messages[index].code == code) {
                   ^
  102.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",
  103.                      code, status_messages[index].message);

libavformat/rtspdec.c:106:9: 
  104.             break;
  105.         }
  106.         index++;
               ^
  107.     }
  108.     if (!status_messages[index].code)

libavformat/rtspdec.c:100:12: Loop condition is true. Entering loop body
   98.     char message[4096];
   99.     int index = 0;
  100.     while (status_messages[index].code) {
                  ^
  101.         if (status_messages[index].code == code) {
  102.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",

libavformat/rtspdec.c:101:13: Taking false branch
   99.     int index = 0;
  100.     while (status_messages[index].code) {
  101.         if (status_messages[index].code == code) {
                   ^
  102.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",
  103.                      code, status_messages[index].message);

libavformat/rtspdec.c:106:9: 
  104.             break;
  105.         }
  106.         index++;
               ^
  107.     }
  108.     if (!status_messages[index].code)

libavformat/rtspdec.c:100:12: Loop condition is false. Leaving loop
   98.     char message[4096];
   99.     int index = 0;
  100.     while (status_messages[index].code) {
                  ^
  101.         if (status_messages[index].code == code) {
  102.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",

libavformat/rtspdec.c:108:10: Taking true branch
  106.         index++;
  107.     }
  108.     if (!status_messages[index].code)
                ^
  109.         return AVERROR(EINVAL);
  110.     av_strlcatf(message, sizeof(message), "CSeq: %d\r\n", seq);

libavformat/rtspdec.c:109:9: 
  107.     }
  108.     if (!status_messages[index].code)
  109.         return AVERROR(EINVAL);
               ^
  110.     av_strlcatf(message, sizeof(message), "CSeq: %d\r\n", seq);
  111.     av_strlcatf(message, sizeof(message), "Server: %s\r\n", LIBAVFORMAT_IDENT);

libavformat/rtspdec.c:119:1: return from a call to rtsp_send_reply
  117. 
  118.     return 0;
  119. }
       ^
  120. 
  121. static inline int check_sessionid(AVFormatContext *s,
