libavcodec/faxcompr.c:281: error: Null Dereference
  pointer `ref` last assigned on line 280 could be null and is dereferenced at line 281, column 5.

libavcodec/faxcompr.c:269:1: start of procedure ff_ccitt_unpack()
267. }
268. 
269. int ff_ccitt_unpack(AVCodecContext *avctx,
     ^
270.                        const uint8_t *src, int srcsize,
271.                        uint8_t *dst, int height, int stride, enum TiffCompr compr)

libavcodec/faxcompr.c:277:5: 
275.     int *runs, *ref, *runend;
276.     int ret;
277.     int runsize= avctx->width + 2;
         ^
278. 
279.     runs = av_malloc(runsize * sizeof(runs[0]));

libavcodec/faxcompr.c:279:5: 
277.     int runsize= avctx->width + 2;
278. 
279.     runs = av_malloc(runsize * sizeof(runs[0]));
         ^
280.     ref  = av_malloc(runsize * sizeof(ref[0]));
281.     ref[0] = avctx->width;

libavutil/mem.c:47:1: start of procedure av_malloc()
  45.    linker will do it automatically. */
  46. 
  47. void *av_malloc(unsigned int size)
      ^
  48. {
  49.     void *ptr = NULL;

libavutil/mem.c:49:5: 
  47. void *av_malloc(unsigned int size)
  48. {
  49.     void *ptr = NULL;
          ^
  50. #if CONFIG_MEMALIGN_HACK
  51.     long diff;

libavutil/mem.c:55:8: Taking true branch
  53. 
  54.     /* let's disallow possible ambiguous cases */
  55.     if(size > (INT_MAX-16) )
             ^
  56.         return NULL;
  57. 

libavutil/mem.c:56:9: 
  54.     /* let's disallow possible ambiguous cases */
  55.     if(size > (INT_MAX-16) )
  56.         return NULL;
              ^
  57. 
  58. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:99:1: return from a call to av_malloc
   97. #endif
   98.     return ptr;
   99. }
       ^
  100. 
  101. void *av_realloc(void *ptr, unsigned int size)

libavcodec/faxcompr.c:280:5: 
278. 
279.     runs = av_malloc(runsize * sizeof(runs[0]));
280.     ref  = av_malloc(runsize * sizeof(ref[0]));
         ^
281.     ref[0] = avctx->width;
282.     ref[1] = 0;

libavutil/mem.c:47:1: start of procedure av_malloc()
  45.    linker will do it automatically. */
  46. 
  47. void *av_malloc(unsigned int size)
      ^
  48. {
  49.     void *ptr = NULL;

libavutil/mem.c:49:5: 
  47. void *av_malloc(unsigned int size)
  48. {
  49.     void *ptr = NULL;
          ^
  50. #if CONFIG_MEMALIGN_HACK
  51.     long diff;

libavutil/mem.c:55:8: Taking true branch
  53. 
  54.     /* let's disallow possible ambiguous cases */
  55.     if(size > (INT_MAX-16) )
             ^
  56.         return NULL;
  57. 

libavutil/mem.c:56:9: 
  54.     /* let's disallow possible ambiguous cases */
  55.     if(size > (INT_MAX-16) )
  56.         return NULL;
              ^
  57. 
  58. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:99:1: return from a call to av_malloc
   97. #endif
   98.     return ptr;
   99. }
       ^
  100. 
  101. void *av_realloc(void *ptr, unsigned int size)

libavcodec/faxcompr.c:281:5: 
279.     runs = av_malloc(runsize * sizeof(runs[0]));
280.     ref  = av_malloc(runsize * sizeof(ref[0]));
281.     ref[0] = avctx->width;
         ^
282.     ref[1] = 0;
283.     ref[2] = 0;
