libavcodec/svq3.c:1039: error: Null Dereference
  pointer `s->gb_slice.buffer` last assigned on line 1036 could be null and is dereferenced at line 1039, column 31.

libavcodec/svq3.c:1002:1: start of procedure svq3_decode_slice_header()
1000. }
1001. 
1002. static int svq3_decode_slice_header(AVCodecContext *avctx)
      ^
1003. {
1004.     SVQ3Context *s = avctx->priv_data;

libavcodec/svq3.c:1004:5: 
1002. static int svq3_decode_slice_header(AVCodecContext *avctx)
1003. {
1004.     SVQ3Context *s = avctx->priv_data;
          ^
1005.     const int mb_xy   = s->mb_xy;
1006.     int i, header;

libavcodec/svq3.c:1005:5: 
1003. {
1004.     SVQ3Context *s = avctx->priv_data;
1005.     const int mb_xy   = s->mb_xy;
          ^
1006.     int i, header;
1007.     unsigned slice_id;

libavcodec/svq3.c:1009:5: Skipping get_bits(): empty list of specs
1007.     unsigned slice_id;
1008. 
1009.     header = get_bits(&s->gb, 8);
          ^
1010. 
1011.     if (((header & 0x9F) != 1 && (header & 0x9F) != 2) || (header & 0x60) == 0) {

libavcodec/svq3.c:1011:10: Taking false branch
1009.     header = get_bits(&s->gb, 8);
1010. 
1011.     if (((header & 0x9F) != 1 && (header & 0x9F) != 2) || (header & 0x60) == 0) {
               ^
1012.         /* TODO: what? */
1013.         av_log(avctx, AV_LOG_ERROR, "unsupported slice header (%02X)\n", header);

libavcodec/svq3.c:1011:59: Taking false branch
1009.     header = get_bits(&s->gb, 8);
1010. 
1011.     if (((header & 0x9F) != 1 && (header & 0x9F) != 2) || (header & 0x60) == 0) {
                                                                ^
1012.         /* TODO: what? */
1013.         av_log(avctx, AV_LOG_ERROR, "unsupported slice header (%02X)\n", header);

libavcodec/svq3.c:1017:9: 
1015.     } else {
1016.         int slice_bits, slice_bytes, slice_length;
1017.         int length = header >> 5 & 3;
              ^
1018. 
1019.         slice_length = show_bits(&s->gb, 8 * length);

libavcodec/svq3.c:1019:9: Skipping show_bits(): empty list of specs
1017.         int length = header >> 5 & 3;
1018. 
1019.         slice_length = show_bits(&s->gb, 8 * length);
              ^
1020.         slice_bits   = slice_length * 8;
1021.         slice_bytes  = slice_length + length - 1;

libavcodec/svq3.c:1020:9: 
1018. 
1019.         slice_length = show_bits(&s->gb, 8 * length);
1020.         slice_bits   = slice_length * 8;
              ^
1021.         slice_bytes  = slice_length + length - 1;
1022. 

libavcodec/svq3.c:1021:9: 
1019.         slice_length = show_bits(&s->gb, 8 * length);
1020.         slice_bits   = slice_length * 8;
1021.         slice_bytes  = slice_length + length - 1;
              ^
1022. 
1023.         if (slice_bytes > get_bits_left(&s->gb)) {

libavcodec/svq3.c:1023:13: 
1021.         slice_bytes  = slice_length + length - 1;
1022. 
1023.         if (slice_bytes > get_bits_left(&s->gb)) {
                  ^
1024.             av_log(avctx, AV_LOG_ERROR, "slice after bitstream end\n");
1025.             return -1;

libavcodec/get_bits.h:575:1: start of procedure get_bits_left()
  573. }
  574. 
  575. static inline int get_bits_left(GetBitContext *gb)
       ^
  576. {
  577.     return gb->size_in_bits - get_bits_count(gb);

libavcodec/get_bits.h:577:5: 
  575. static inline int get_bits_left(GetBitContext *gb)
  576. {
  577.     return gb->size_in_bits - get_bits_count(gb);
           ^
  578. }
  579. 

libavcodec/get_bits.h:195:1: start of procedure get_bits_count()
    193. #define GET_CACHE(name, gb) ((uint32_t) name ## _cache)
    194. 
    195. static inline int get_bits_count(const GetBitContext *s)
         ^
    196. {
    197.     return s->index;

libavcodec/get_bits.h:197:5: 
    195. static inline int get_bits_count(const GetBitContext *s)
    196. {
    197.     return s->index;
             ^
    198. }
    199. 

libavcodec/get_bits.h:198:1: return from a call to get_bits_count
    196. {
    197.     return s->index;
    198. }
         ^
    199. 
    200. static inline void skip_bits_long(GetBitContext *s, int n)

libavcodec/get_bits.h:578:1: return from a call to get_bits_left
  576. {
  577.     return gb->size_in_bits - get_bits_count(gb);
  578. }
       ^
  579. 
  580. //#define TRACE

libavcodec/svq3.c:1023:13: Taking false branch
1021.         slice_bytes  = slice_length + length - 1;
1022. 
1023.         if (slice_bytes > get_bits_left(&s->gb)) {
                  ^
1024.             av_log(avctx, AV_LOG_ERROR, "slice after bitstream end\n");
1025.             return -1;

libavcodec/svq3.c:1028:9: Skipping skip_bits(): empty list of specs
1026.         }
1027. 
1028.         skip_bits(&s->gb, 8);
              ^
1029. 
1030.         av_fast_malloc(&s->slice_buf, &s->slice_size, slice_bytes + AV_INPUT_BUFFER_PADDING_SIZE);

libavcodec/svq3.c:1030:9: 
1028.         skip_bits(&s->gb, 8);
1029. 
1030.         av_fast_malloc(&s->slice_buf, &s->slice_size, slice_bytes + AV_INPUT_BUFFER_PADDING_SIZE);
              ^
1031.         if (!s->slice_buf)
1032.             return AVERROR(ENOMEM);

libavutil/mem.c:394:1: start of procedure av_fast_malloc()
  392. }
  393. 
  394. void av_fast_malloc(void *ptr, unsigned int *size, size_t min_size)
       ^
  395. {
  396.     void **p = ptr;

libavutil/mem.c:396:5: 
  394. void av_fast_malloc(void *ptr, unsigned int *size, size_t min_size)
  395. {
  396.     void **p = ptr;
           ^
  397.     if (min_size < *size)
  398.         return;

libavutil/mem.c:397:9: Taking true branch
  395. {
  396.     void **p = ptr;
  397.     if (min_size < *size)
               ^
  398.         return;
  399.     min_size = FFMAX(17 * min_size / 16 + 32, min_size);

libavutil/mem.c:398:9: 
  396.     void **p = ptr;
  397.     if (min_size < *size)
  398.         return;
               ^
  399.     min_size = FFMAX(17 * min_size / 16 + 32, min_size);
  400.     av_free(*p);

libavutil/mem.c:405:1: return from a call to av_fast_malloc
  403.         min_size = 0;
  404.     *size = min_size;
  405. }
       ^

libavcodec/svq3.c:1031:14: Taking false branch
1029. 
1030.         av_fast_malloc(&s->slice_buf, &s->slice_size, slice_bytes + AV_INPUT_BUFFER_PADDING_SIZE);
1031.         if (!s->slice_buf)
                   ^
1032.             return AVERROR(ENOMEM);
1033. 

libavcodec/svq3.c:1034:9: 
1032.             return AVERROR(ENOMEM);
1033. 
1034.         memcpy(s->slice_buf, s->gb.buffer + s->gb.index / 8, slice_bytes);
              ^
1035. 
1036.         init_get_bits(&s->gb_slice, s->slice_buf, slice_bits);

libavcodec/svq3.c:1036:9: 
1034.         memcpy(s->slice_buf, s->gb.buffer + s->gb.index / 8, slice_bytes);
1035. 
1036.         init_get_bits(&s->gb_slice, s->slice_buf, slice_bits);
              ^
1037. 
1038.         if (s->watermark_key) {

libavcodec/get_bits.h:384:1: start of procedure init_get_bits()
  382.  * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size would overflow.
  383.  */
  384. static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer,
       ^
  385.                                 int bit_size)
  386. {

libavcodec/get_bits.h:388:5: 
  386. {
  387.     int buffer_size;
  388.     int ret = 0;
           ^
  389. 
  390.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {

libavcodec/get_bits.h:390:9: Taking true branch
  388.     int ret = 0;
  389. 
  390.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
               ^
  391.         bit_size    = 0;
  392.         buffer      = NULL;

libavcodec/get_bits.h:391:9: 
  389. 
  390.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
  391.         bit_size    = 0;
               ^
  392.         buffer      = NULL;
  393.         ret         = AVERROR_INVALIDDATA;

libavcodec/get_bits.h:392:9: 
  390.     if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) {
  391.         bit_size    = 0;
  392.         buffer      = NULL;
               ^
  393.         ret         = AVERROR_INVALIDDATA;
  394.     }

libavcodec/get_bits.h:393:9: 
  391.         bit_size    = 0;
  392.         buffer      = NULL;
  393.         ret         = AVERROR_INVALIDDATA;
               ^
  394.     }
  395. 

libavcodec/get_bits.h:396:5: 
  394.     }
  395. 
  396.     buffer_size = (bit_size + 7) >> 3;
           ^
  397. 
  398.     s->buffer             = buffer;

libavcodec/get_bits.h:398:5: 
  396.     buffer_size = (bit_size + 7) >> 3;
  397. 
  398.     s->buffer             = buffer;
           ^
  399.     s->size_in_bits       = bit_size;
  400. #if !UNCHECKED_BITSTREAM_READER

libavcodec/get_bits.h:399:5: 
  397. 
  398.     s->buffer             = buffer;
  399.     s->size_in_bits       = bit_size;
           ^
  400. #if !UNCHECKED_BITSTREAM_READER
  401.     s->size_in_bits_plus8 = bit_size + 8;

libavcodec/get_bits.h:401:5: 
  399.     s->size_in_bits       = bit_size;
  400. #if !UNCHECKED_BITSTREAM_READER
  401.     s->size_in_bits_plus8 = bit_size + 8;
           ^
  402. #endif
  403.     s->buffer_end         = buffer + buffer_size;

libavcodec/get_bits.h:403:5: 
  401.     s->size_in_bits_plus8 = bit_size + 8;
  402. #endif
  403.     s->buffer_end         = buffer + buffer_size;
           ^
  404.     s->index              = 0;
  405. 

libavcodec/get_bits.h:404:5: 
  402. #endif
  403.     s->buffer_end         = buffer + buffer_size;
  404.     s->index              = 0;
           ^
  405. 
  406.     return ret;

libavcodec/get_bits.h:406:5: 
  404.     s->index              = 0;
  405. 
  406.     return ret;
           ^
  407. }
  408. 

libavcodec/get_bits.h:407:1: return from a call to init_get_bits
  405. 
  406.     return ret;
  407. }
       ^
  408. 
  409. /**

libavcodec/svq3.c:1038:13: Taking true branch
1036.         init_get_bits(&s->gb_slice, s->slice_buf, slice_bits);
1037. 
1038.         if (s->watermark_key) {
                  ^
1039.             uint32_t header = AV_RL32(&s->gb_slice.buffer[1]);
1040.             AV_WL32(&s->gb_slice.buffer[1], header ^ s->watermark_key);

libavcodec/svq3.c:1039:13: 
1037. 
1038.         if (s->watermark_key) {
1039.             uint32_t header = AV_RL32(&s->gb_slice.buffer[1]);
                  ^
1040.             AV_WL32(&s->gb_slice.buffer[1], header ^ s->watermark_key);
1041.         }
