libavformat/oggparsespeex.c:78: error: Null Dereference
  pointer `st->codec->extradata` last assigned on line 76 could be null and is dereferenced by call to `memcpy()` at line 78, column 9.

libavformat/oggparsespeex.c:41:1: start of procedure speex_header()
39. };
40. 
41. static int speex_header(AVFormatContext *s, int idx) {
    ^
42.     struct ogg *ogg = s->priv_data;
43.     struct ogg_stream *os = ogg->streams + idx;

libavformat/oggparsespeex.c:42:5: 
40. 
41. static int speex_header(AVFormatContext *s, int idx) {
42.     struct ogg *ogg = s->priv_data;
        ^
43.     struct ogg_stream *os = ogg->streams + idx;
44.     struct speex_params *spxp = os->private;

libavformat/oggparsespeex.c:43:5: 
41. static int speex_header(AVFormatContext *s, int idx) {
42.     struct ogg *ogg = s->priv_data;
43.     struct ogg_stream *os = ogg->streams + idx;
        ^
44.     struct speex_params *spxp = os->private;
45.     AVStream *st = s->streams[idx];

libavformat/oggparsespeex.c:44:5: 
42.     struct ogg *ogg = s->priv_data;
43.     struct ogg_stream *os = ogg->streams + idx;
44.     struct speex_params *spxp = os->private;
        ^
45.     AVStream *st = s->streams[idx];
46.     uint8_t *p = os->buf + os->pstart;

libavformat/oggparsespeex.c:45:5: 
43.     struct ogg_stream *os = ogg->streams + idx;
44.     struct speex_params *spxp = os->private;
45.     AVStream *st = s->streams[idx];
        ^
46.     uint8_t *p = os->buf + os->pstart;
47. 

libavformat/oggparsespeex.c:46:5: 
44.     struct speex_params *spxp = os->private;
45.     AVStream *st = s->streams[idx];
46.     uint8_t *p = os->buf + os->pstart;
        ^
47. 
48.     if (!spxp) {

libavformat/oggparsespeex.c:48:10: Taking false branch
46.     uint8_t *p = os->buf + os->pstart;
47. 
48.     if (!spxp) {
             ^
49.         spxp = av_mallocz(sizeof(*spxp));
50.         os->private = spxp;

libavformat/oggparsespeex.c:53:9: Taking false branch
51.     }
52. 
53.     if (spxp->seq > 1)
            ^
54.         return 0;
55. 

libavformat/oggparsespeex.c:56:9: Taking true branch
54.         return 0;
55. 
56.     if (spxp->seq == 0) {
            ^
57.         int frames_per_packet;
58.         st->codec->codec_type = AVMEDIA_TYPE_AUDIO;

libavformat/oggparsespeex.c:58:9: 
56.     if (spxp->seq == 0) {
57.         int frames_per_packet;
58.         st->codec->codec_type = AVMEDIA_TYPE_AUDIO;
            ^
59.         st->codec->codec_id = AV_CODEC_ID_SPEEX;
60. 

libavformat/oggparsespeex.c:59:9: 
57.         int frames_per_packet;
58.         st->codec->codec_type = AVMEDIA_TYPE_AUDIO;
59.         st->codec->codec_id = AV_CODEC_ID_SPEEX;
            ^
60. 
61.         st->codec->sample_rate = AV_RL32(p + 36);

libavformat/oggparsespeex.c:61:9: 
59.         st->codec->codec_id = AV_CODEC_ID_SPEEX;
60. 
61.         st->codec->sample_rate = AV_RL32(p + 36);
            ^
62.         st->codec->channels = AV_RL32(p + 48);
63.         if (st->codec->channels < 1 || st->codec->channels > 2) {

libavutil/ppc/intreadwrite.h:44:1: start of procedure AV_RL32()
  42. 
  43. #define AV_RL32 AV_RL32
  44. static av_always_inline uint32_t AV_RL32(const void *p)
      ^
  45. {
  46.     uint32_t v;

libavutil/ppc/intreadwrite.h:47:5: Skipping __infer_skip_gcc_asm_stmt(): function or method not found
  45. {
  46.     uint32_t v;
  47.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
          ^
  48.     return v;
  49. }

libavutil/ppc/intreadwrite.h:48:5: 
  46.     uint32_t v;
  47.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
  48.     return v;
          ^
  49. }
  50. 

libavutil/ppc/intreadwrite.h:49:1: return from a call to AV_RL32
  47.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
  48.     return v;
  49. }
      ^
  50. 
  51. #define AV_WL32 AV_WL32

libavformat/oggparsespeex.c:62:9: 
60. 
61.         st->codec->sample_rate = AV_RL32(p + 36);
62.         st->codec->channels = AV_RL32(p + 48);
            ^
63.         if (st->codec->channels < 1 || st->codec->channels > 2) {
64.             av_log(s, AV_LOG_ERROR, "invalid channel count. Speex must be mono or stereo.\n");

libavutil/ppc/intreadwrite.h:44:1: start of procedure AV_RL32()
  42. 
  43. #define AV_RL32 AV_RL32
  44. static av_always_inline uint32_t AV_RL32(const void *p)
      ^
  45. {
  46.     uint32_t v;

libavutil/ppc/intreadwrite.h:47:5: Skipping __infer_skip_gcc_asm_stmt(): function or method not found
  45. {
  46.     uint32_t v;
  47.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
          ^
  48.     return v;
  49. }

libavutil/ppc/intreadwrite.h:48:5: 
  46.     uint32_t v;
  47.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
  48.     return v;
          ^
  49. }
  50. 

libavutil/ppc/intreadwrite.h:49:1: return from a call to AV_RL32
  47.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
  48.     return v;
  49. }
      ^
  50. 
  51. #define AV_WL32 AV_WL32

libavformat/oggparsespeex.c:63:13: Taking false branch
61.         st->codec->sample_rate = AV_RL32(p + 36);
62.         st->codec->channels = AV_RL32(p + 48);
63.         if (st->codec->channels < 1 || st->codec->channels > 2) {
                ^
64.             av_log(s, AV_LOG_ERROR, "invalid channel count. Speex must be mono or stereo.\n");
65.             return AVERROR_INVALIDDATA;

libavformat/oggparsespeex.c:63:40: Taking false branch
61.         st->codec->sample_rate = AV_RL32(p + 36);
62.         st->codec->channels = AV_RL32(p + 48);
63.         if (st->codec->channels < 1 || st->codec->channels > 2) {
                                           ^
64.             av_log(s, AV_LOG_ERROR, "invalid channel count. Speex must be mono or stereo.\n");
65.             return AVERROR_INVALIDDATA;

libavformat/oggparsespeex.c:67:37: Condition is false
65.             return AVERROR_INVALIDDATA;
66.         }
67.         st->codec->channel_layout = st->codec->channels == 1 ? AV_CH_LAYOUT_MONO :
                                        ^
68.                                                                AV_CH_LAYOUT_STEREO;
69. 

libavformat/oggparsespeex.c:67:9: 
65.             return AVERROR_INVALIDDATA;
66.         }
67.         st->codec->channel_layout = st->codec->channels == 1 ? AV_CH_LAYOUT_MONO :
            ^
68.                                                                AV_CH_LAYOUT_STEREO;
69. 

libavformat/oggparsespeex.c:70:9: 
68.                                                                AV_CH_LAYOUT_STEREO;
69. 
70.         spxp->packet_size  = AV_RL32(p + 56);
            ^
71.         frames_per_packet  = AV_RL32(p + 64);
72.         if (frames_per_packet)

libavutil/ppc/intreadwrite.h:44:1: start of procedure AV_RL32()
  42. 
  43. #define AV_RL32 AV_RL32
  44. static av_always_inline uint32_t AV_RL32(const void *p)
      ^
  45. {
  46.     uint32_t v;

libavutil/ppc/intreadwrite.h:47:5: Skipping __infer_skip_gcc_asm_stmt(): function or method not found
  45. {
  46.     uint32_t v;
  47.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
          ^
  48.     return v;
  49. }

libavutil/ppc/intreadwrite.h:48:5: 
  46.     uint32_t v;
  47.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
  48.     return v;
          ^
  49. }
  50. 

libavutil/ppc/intreadwrite.h:49:1: return from a call to AV_RL32
  47.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
  48.     return v;
  49. }
      ^
  50. 
  51. #define AV_WL32 AV_WL32

libavformat/oggparsespeex.c:71:9: 
69. 
70.         spxp->packet_size  = AV_RL32(p + 56);
71.         frames_per_packet  = AV_RL32(p + 64);
            ^
72.         if (frames_per_packet)
73.             spxp->packet_size *= frames_per_packet;

libavutil/ppc/intreadwrite.h:44:1: start of procedure AV_RL32()
  42. 
  43. #define AV_RL32 AV_RL32
  44. static av_always_inline uint32_t AV_RL32(const void *p)
      ^
  45. {
  46.     uint32_t v;

libavutil/ppc/intreadwrite.h:47:5: Skipping __infer_skip_gcc_asm_stmt(): function or method not found
  45. {
  46.     uint32_t v;
  47.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
          ^
  48.     return v;
  49. }

libavutil/ppc/intreadwrite.h:48:5: 
  46.     uint32_t v;
  47.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
  48.     return v;
          ^
  49. }
  50. 

libavutil/ppc/intreadwrite.h:49:1: return from a call to AV_RL32
  47.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
  48.     return v;
  49. }
      ^
  50. 
  51. #define AV_WL32 AV_WL32

libavformat/oggparsespeex.c:72:13: Taking false branch
70.         spxp->packet_size  = AV_RL32(p + 56);
71.         frames_per_packet  = AV_RL32(p + 64);
72.         if (frames_per_packet)
                ^
73.             spxp->packet_size *= frames_per_packet;
74. 

libavformat/oggparsespeex.c:75:9: 
73.             spxp->packet_size *= frames_per_packet;
74. 
75.         st->codec->extradata_size = os->psize;
            ^
76.         st->codec->extradata = av_malloc(st->codec->extradata_size
77.                                          + FF_INPUT_BUFFER_PADDING_SIZE);

libavformat/oggparsespeex.c:76:9: 
74. 
75.         st->codec->extradata_size = os->psize;
76.         st->codec->extradata = av_malloc(st->codec->extradata_size
            ^
77.                                          + FF_INPUT_BUFFER_PADDING_SIZE);
78.         memcpy(st->codec->extradata, p, st->codec->extradata_size);

libavutil/mem.c:61:1: start of procedure av_malloc()
  59.  * linker will do it automatically. */
  60. 
  61. void *av_malloc(size_t size)
      ^
  62. {
  63.     void *ptr = NULL;

libavutil/mem.c:63:5: 
  61. void *av_malloc(size_t size)
  62. {
  63.     void *ptr = NULL;
          ^
  64. #if CONFIG_MEMALIGN_HACK
  65.     long diff;

libavutil/mem.c:69:9: Taking true branch
  67. 
  68.     /* let's disallow possibly ambiguous cases */
  69.     if (size > (INT_MAX - 32) || !size)
              ^
  70.         return NULL;
  71. 

libavutil/mem.c:70:9: 
  68.     /* let's disallow possibly ambiguous cases */
  69.     if (size > (INT_MAX - 32) || !size)
  70.         return NULL;
              ^
  71. 
  72. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:114:1: return from a call to av_malloc
  112. #endif
  113.     return ptr;
  114. }
       ^
  115. 
  116. void *av_realloc(void *ptr, size_t size)

libavformat/oggparsespeex.c:78:9: 
76.         st->codec->extradata = av_malloc(st->codec->extradata_size
77.                                          + FF_INPUT_BUFFER_PADDING_SIZE);
78.         memcpy(st->codec->extradata, p, st->codec->extradata_size);
            ^
79. 
80.         avpriv_set_pts_info(st, 64, 1, st->codec->sample_rate);
