libavcodec/movsub_bsf.c:48: error: Null Dereference
  pointer `*poutbuf` last assigned on line 47 could be null and is dereferenced by call to `memcpy()` at line 48, column 5.

libavcodec/movsub_bsf.c:42:1: start of procedure mov2textsub()
40. };
41. 
42. static int mov2textsub(AVBitStreamFilterContext *bsfc, AVCodecContext *avctx, const char *args,
    ^
43.                      uint8_t **poutbuf, int *poutbuf_size,
44.                      const uint8_t *buf, int buf_size, int keyframe){

libavcodec/movsub_bsf.c:45:9: Taking false branch
43.                      uint8_t **poutbuf, int *poutbuf_size,
44.                      const uint8_t *buf, int buf_size, int keyframe){
45.     if (buf_size < 2) return 0;
            ^
46.     *poutbuf_size = FFMIN(buf_size - 2, AV_RB16(buf));
47.     *poutbuf = av_malloc(*poutbuf_size + FF_INPUT_BUFFER_PADDING_SIZE);

libavcodec/movsub_bsf.c:46:21: 
44.                      const uint8_t *buf, int buf_size, int keyframe){
45.     if (buf_size < 2) return 0;
46.     *poutbuf_size = FFMIN(buf_size - 2, AV_RB16(buf));
                        ^
47.     *poutbuf = av_malloc(*poutbuf_size + FF_INPUT_BUFFER_PADDING_SIZE);
48.     memcpy(*poutbuf, buf + 2, *poutbuf_size);

libavutil/bswap.h:58:1: start of procedure av_bswap16()
  56. 
  57. #ifndef av_bswap16
  58. static av_always_inline av_const uint16_t av_bswap16(uint16_t x)
      ^
  59. {
  60.     x= (x>>8) | (x<<8);

libavutil/bswap.h:60:5: 
  58. static av_always_inline av_const uint16_t av_bswap16(uint16_t x)
  59. {
  60.     x= (x>>8) | (x<<8);
          ^
  61.     return x;
  62. }

libavutil/bswap.h:61:5: 
  59. {
  60.     x= (x>>8) | (x<<8);
  61.     return x;
          ^
  62. }
  63. #endif

libavutil/bswap.h:62:1: return from a call to av_bswap16
  60.     x= (x>>8) | (x<<8);
  61.     return x;
  62. }
      ^
  63. #endif
  64. 

libavcodec/movsub_bsf.c:46:21: Condition is true
44.                      const uint8_t *buf, int buf_size, int keyframe){
45.     if (buf_size < 2) return 0;
46.     *poutbuf_size = FFMIN(buf_size - 2, AV_RB16(buf));
                        ^
47.     *poutbuf = av_malloc(*poutbuf_size + FF_INPUT_BUFFER_PADDING_SIZE);
48.     memcpy(*poutbuf, buf + 2, *poutbuf_size);

libavutil/bswap.h:58:1: start of procedure av_bswap16()
  56. 
  57. #ifndef av_bswap16
  58. static av_always_inline av_const uint16_t av_bswap16(uint16_t x)
      ^
  59. {
  60.     x= (x>>8) | (x<<8);

libavutil/bswap.h:60:5: 
  58. static av_always_inline av_const uint16_t av_bswap16(uint16_t x)
  59. {
  60.     x= (x>>8) | (x<<8);
          ^
  61.     return x;
  62. }

libavutil/bswap.h:61:5: 
  59. {
  60.     x= (x>>8) | (x<<8);
  61.     return x;
          ^
  62. }
  63. #endif

libavutil/bswap.h:62:1: return from a call to av_bswap16
  60.     x= (x>>8) | (x<<8);
  61.     return x;
  62. }
      ^
  63. #endif
  64. 

libavcodec/movsub_bsf.c:46:5: 
44.                      const uint8_t *buf, int buf_size, int keyframe){
45.     if (buf_size < 2) return 0;
46.     *poutbuf_size = FFMIN(buf_size - 2, AV_RB16(buf));
        ^
47.     *poutbuf = av_malloc(*poutbuf_size + FF_INPUT_BUFFER_PADDING_SIZE);
48.     memcpy(*poutbuf, buf + 2, *poutbuf_size);

libavcodec/movsub_bsf.c:47:5: 
45.     if (buf_size < 2) return 0;
46.     *poutbuf_size = FFMIN(buf_size - 2, AV_RB16(buf));
47.     *poutbuf = av_malloc(*poutbuf_size + FF_INPUT_BUFFER_PADDING_SIZE);
        ^
48.     memcpy(*poutbuf, buf + 2, *poutbuf_size);
49.     return 1;

libavutil/mem.c:64:1: start of procedure av_malloc()
  62.    linker will do it automatically. */
  63. 
  64. void *av_malloc(size_t size)
      ^
  65. {
  66.     void *ptr = NULL;

libavutil/mem.c:66:5: 
  64. void *av_malloc(size_t size)
  65. {
  66.     void *ptr = NULL;
          ^
  67. #if CONFIG_MEMALIGN_HACK
  68.     long diff;

libavutil/mem.c:72:9: Taking true branch
  70. 
  71.     /* let's disallow possible ambiguous cases */
  72.     if (size > (INT_MAX-32) || !size)
              ^
  73.         return NULL;
  74. 

libavutil/mem.c:73:9: 
  71.     /* let's disallow possible ambiguous cases */
  72.     if (size > (INT_MAX-32) || !size)
  73.         return NULL;
              ^
  74. 
  75. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:117:1: return from a call to av_malloc
  115. #endif
  116.     return ptr;
  117. }
       ^
  118. 
  119. void *av_realloc(void *ptr, size_t size)

libavcodec/movsub_bsf.c:48:5: 
46.     *poutbuf_size = FFMIN(buf_size - 2, AV_RB16(buf));
47.     *poutbuf = av_malloc(*poutbuf_size + FF_INPUT_BUFFER_PADDING_SIZE);
48.     memcpy(*poutbuf, buf + 2, *poutbuf_size);
        ^
49.     return 1;
50. }
