libavcodec/faxcompr.c:284: error: Null Dereference
  pointer `ref` last assigned on line 283 could be null and is dereferenced at line 284, column 5.

libavcodec/faxcompr.c:271:1: start of procedure ff_ccitt_unpack()
269. }
270. 
271. int ff_ccitt_unpack(AVCodecContext *avctx,
     ^
272.                     const uint8_t *src, int srcsize,
273.                     uint8_t *dst, int height, int stride,

libavcodec/faxcompr.c:280:5: 
278.     int *runs, *ref, *runend;
279.     int ret;
280.     int runsize= avctx->width + 2;
         ^
281. 
282.     runs = av_malloc(runsize * sizeof(runs[0]));

libavcodec/faxcompr.c:282:5: 
280.     int runsize= avctx->width + 2;
281. 
282.     runs = av_malloc(runsize * sizeof(runs[0]));
         ^
283.     ref  = av_malloc(runsize * sizeof(ref[0]));
284.     ref[0] = avctx->width;

libavutil/mem.c:47:1: start of procedure av_malloc()
  45.    linker will do it automatically. */
  46. 
  47. void *av_malloc(unsigned int size)
      ^
  48. {
  49.     void *ptr = NULL;

libavutil/mem.c:49:5: 
  47. void *av_malloc(unsigned int size)
  48. {
  49.     void *ptr = NULL;
          ^
  50. #if CONFIG_MEMALIGN_HACK
  51.     long diff;

libavutil/mem.c:55:8: Taking false branch
  53. 
  54.     /* let's disallow possible ambiguous cases */
  55.     if(size > (INT_MAX-16) )
             ^
  56.         return NULL;
  57. 

libavutil/mem.c:66:9: Taking false branch
  64.     ((char*)ptr)[-1]= diff;
  65. #elif HAVE_POSIX_MEMALIGN
  66.     if (posix_memalign(&ptr,16,size))
              ^
  67.         ptr = NULL;
  68. #elif HAVE_MEMALIGN

libavutil/mem.c:99:5: 
   97.     ptr = malloc(size);
   98. #endif
   99.     return ptr;
           ^
  100. }
  101. 

libavutil/mem.c:100:1: return from a call to av_malloc
   98. #endif
   99.     return ptr;
  100. }
       ^
  101. 
  102. void *av_realloc(void *ptr, unsigned int size)

libavcodec/faxcompr.c:283:5: 
281. 
282.     runs = av_malloc(runsize * sizeof(runs[0]));
283.     ref  = av_malloc(runsize * sizeof(ref[0]));
         ^
284.     ref[0] = avctx->width;
285.     ref[1] = 0;

libavutil/mem.c:47:1: start of procedure av_malloc()
  45.    linker will do it automatically. */
  46. 
  47. void *av_malloc(unsigned int size)
      ^
  48. {
  49.     void *ptr = NULL;

libavutil/mem.c:49:5: 
  47. void *av_malloc(unsigned int size)
  48. {
  49.     void *ptr = NULL;
          ^
  50. #if CONFIG_MEMALIGN_HACK
  51.     long diff;

libavutil/mem.c:55:8: Taking false branch
  53. 
  54.     /* let's disallow possible ambiguous cases */
  55.     if(size > (INT_MAX-16) )
             ^
  56.         return NULL;
  57. 

libavutil/mem.c:66:9: Taking true branch
  64.     ((char*)ptr)[-1]= diff;
  65. #elif HAVE_POSIX_MEMALIGN
  66.     if (posix_memalign(&ptr,16,size))
              ^
  67.         ptr = NULL;
  68. #elif HAVE_MEMALIGN

libavutil/mem.c:67:9: 
  65. #elif HAVE_POSIX_MEMALIGN
  66.     if (posix_memalign(&ptr,16,size))
  67.         ptr = NULL;
              ^
  68. #elif HAVE_MEMALIGN
  69.     ptr = memalign(16,size);

libavutil/mem.c:99:5: 
   97.     ptr = malloc(size);
   98. #endif
   99.     return ptr;
           ^
  100. }
  101. 

libavutil/mem.c:100:1: return from a call to av_malloc
   98. #endif
   99.     return ptr;
  100. }
       ^
  101. 
  102. void *av_realloc(void *ptr, unsigned int size)

libavcodec/faxcompr.c:284:5: 
282.     runs = av_malloc(runsize * sizeof(runs[0]));
283.     ref  = av_malloc(runsize * sizeof(ref[0]));
284.     ref[0] = avctx->width;
         ^
285.     ref[1] = 0;
286.     ref[2] = 0;
