libavformat/rmenc.c:349: error: Null Dereference
  pointer `buf1` last assigned on line 343 could be null and is dereferenced at line 349, column 9.

libavformat/rmenc.c:334:1: start of procedure rm_write_audio()
332. }
333. 
334. static int rm_write_audio(AVFormatContext *s, const uint8_t *buf, int size, int flags)
     ^
335. {
336.     uint8_t *buf1;

libavformat/rmenc.c:337:5: 
335. {
336.     uint8_t *buf1;
337.     RMMuxContext *rm = s->priv_data;
         ^
338.     ByteIOContext *pb = s->pb;
339.     StreamInfo *stream = rm->audio_stream;

libavformat/rmenc.c:338:5: 
336.     uint8_t *buf1;
337.     RMMuxContext *rm = s->priv_data;
338.     ByteIOContext *pb = s->pb;
         ^
339.     StreamInfo *stream = rm->audio_stream;
340.     int i;

libavformat/rmenc.c:339:5: 
337.     RMMuxContext *rm = s->priv_data;
338.     ByteIOContext *pb = s->pb;
339.     StreamInfo *stream = rm->audio_stream;
         ^
340.     int i;
341. 

libavformat/rmenc.c:343:5: 
341. 
342.     /* XXX: suppress this malloc */
343.     buf1= (uint8_t*) av_malloc( size * sizeof(uint8_t) );
         ^
344. 
345.     write_packet_header(s, stream, size, !!(flags & PKT_FLAG_KEY));

libavutil/mem.c:42:1: start of procedure av_malloc()
  40.    linker will do it automatically */
  41. 
  42. void *av_malloc(unsigned int size)
      ^
  43. {
  44.     void *ptr;

libavutil/mem.c:50:8: Taking true branch
  48. 
  49.     /* let's disallow possible ambiguous cases */
  50.     if(size > (INT_MAX-16) )
             ^
  51.         return NULL;
  52. 

libavutil/mem.c:51:9: 
  49.     /* let's disallow possible ambiguous cases */
  50.     if(size > (INT_MAX-16) )
  51.         return NULL;
              ^
  52. 
  53. #ifdef CONFIG_MEMALIGN_HACK

libavutil/mem.c:92:1: return from a call to av_malloc
  90. #endif
  91.     return ptr;
  92. }
      ^
  93. 
  94. void *av_realloc(void *ptr, unsigned int size)

libavformat/rmenc.c:345:45: Condition is false
343.     buf1= (uint8_t*) av_malloc( size * sizeof(uint8_t) );
344. 
345.     write_packet_header(s, stream, size, !!(flags & PKT_FLAG_KEY));
                                                 ^
346. 
347.     /* for AC-3, the words seem to be reversed */

libavformat/rmenc.c:345:42: 
343.     buf1= (uint8_t*) av_malloc( size * sizeof(uint8_t) );
344. 
345.     write_packet_header(s, stream, size, !!(flags & PKT_FLAG_KEY));
                                              ^
346. 
347.     /* for AC-3, the words seem to be reversed */

libavformat/rmenc.c:345:5: Skipping write_packet_header(): empty list of specs
343.     buf1= (uint8_t*) av_malloc( size * sizeof(uint8_t) );
344. 
345.     write_packet_header(s, stream, size, !!(flags & PKT_FLAG_KEY));
         ^
346. 
347.     /* for AC-3, the words seem to be reversed */

libavformat/rmenc.c:348:9: 
346. 
347.     /* for AC-3, the words seem to be reversed */
348.     for(i=0;i<size;i+=2) {
             ^
349.         buf1[i] = buf[i+1];
350.         buf1[i+1] = buf[i];

libavformat/rmenc.c:348:13: Loop condition is true. Entering loop body
346. 
347.     /* for AC-3, the words seem to be reversed */
348.     for(i=0;i<size;i+=2) {
                 ^
349.         buf1[i] = buf[i+1];
350.         buf1[i+1] = buf[i];

libavformat/rmenc.c:349:9: 
347.     /* for AC-3, the words seem to be reversed */
348.     for(i=0;i<size;i+=2) {
349.         buf1[i] = buf[i+1];
             ^
350.         buf1[i+1] = buf[i];
351.     }
