libavfilter/fifo.c:211: error: Null Dereference
  pointer `s->root.next` last assigned on line 196 could be null and is dereferenced at line 211, column 24.

libavfilter/fifo.c:146:1: start of procedure return_audio_frame()
144. }
145. 
146. static int return_audio_frame(AVFilterContext *ctx)
     ^
147. {
148.     AVFilterLink *link = ctx->outputs[0];

libavfilter/fifo.c:148:5: 
146. static int return_audio_frame(AVFilterContext *ctx)
147. {
148.     AVFilterLink *link = ctx->outputs[0];
         ^
149.     FifoContext *s = ctx->priv;
150.     AVFrame *head = s->root.next->frame;

libavfilter/fifo.c:149:5: 
147. {
148.     AVFilterLink *link = ctx->outputs[0];
149.     FifoContext *s = ctx->priv;
         ^
150.     AVFrame *head = s->root.next->frame;
151.     AVFrame *out;

libavfilter/fifo.c:150:5: 
148.     AVFilterLink *link = ctx->outputs[0];
149.     FifoContext *s = ctx->priv;
150.     AVFrame *head = s->root.next->frame;
         ^
151.     AVFrame *out;
152.     int ret;

libavfilter/fifo.c:154:10: Taking false branch
152.     int ret;
153. 
154.     if (!s->out &&
              ^
155.         head->nb_samples >= link->request_samples &&
156.         calc_ptr_alignment(head) >= 32) {

libavfilter/fifo.c:169:9: 
167.         }
168.     } else {
169.         int nb_channels = av_get_channel_layout_nb_channels(link->channel_layout);
             ^
170. 
171.         if (!s->out) {

libavutil/channel_layout.c:178:1: start of procedure av_get_channel_layout_nb_channels()
  176. }
  177. 
  178. int av_get_channel_layout_nb_channels(uint64_t channel_layout)
       ^
  179. {
  180.     return av_popcount64(channel_layout);

libavutil/channel_layout.c:180:5: 
  178. int av_get_channel_layout_nb_channels(uint64_t channel_layout)
  179. {
  180.     return av_popcount64(channel_layout);
           ^
  181. }
  182. 

libavutil/common.h:232:1: start of procedure av_popcount64_c()
    230.  * @return the number of bits set to one in x
    231.  */
    232. static av_always_inline av_const int av_popcount64_c(uint64_t x)
         ^
    233. {
    234.     return av_popcount(x) + av_popcount(x >> 32);

libavutil/common.h:234:5: 
    232. static av_always_inline av_const int av_popcount64_c(uint64_t x)
    233. {
    234.     return av_popcount(x) + av_popcount(x >> 32);
             ^
    235. }
    236. 

libavutil/common.h:218:1: start of procedure av_popcount_c()
      216.  * @return the number of bits set to one in x
      217.  */
      218. static av_always_inline av_const int av_popcount_c(uint32_t x)
           ^
      219. {
      220.     x -= (x >> 1) & 0x55555555;

libavutil/common.h:220:5: 
      218. static av_always_inline av_const int av_popcount_c(uint32_t x)
      219. {
      220.     x -= (x >> 1) & 0x55555555;
               ^
      221.     x = (x & 0x33333333) + ((x >> 2) & 0x33333333);
      222.     x = (x + (x >> 4)) & 0x0F0F0F0F;

libavutil/common.h:221:5: 
      219. {
      220.     x -= (x >> 1) & 0x55555555;
      221.     x = (x & 0x33333333) + ((x >> 2) & 0x33333333);
               ^
      222.     x = (x + (x >> 4)) & 0x0F0F0F0F;
      223.     x += x >> 8;

libavutil/common.h:222:5: 
      220.     x -= (x >> 1) & 0x55555555;
      221.     x = (x & 0x33333333) + ((x >> 2) & 0x33333333);
      222.     x = (x + (x >> 4)) & 0x0F0F0F0F;
               ^
      223.     x += x >> 8;
      224.     return (x + (x >> 16)) & 0x3F;

libavutil/common.h:223:5: 
      221.     x = (x & 0x33333333) + ((x >> 2) & 0x33333333);
      222.     x = (x + (x >> 4)) & 0x0F0F0F0F;
      223.     x += x >> 8;
               ^
      224.     return (x + (x >> 16)) & 0x3F;
      225. }

libavutil/common.h:224:5: 
      222.     x = (x + (x >> 4)) & 0x0F0F0F0F;
      223.     x += x >> 8;
      224.     return (x + (x >> 16)) & 0x3F;
               ^
      225. }
      226. 

libavutil/common.h:225:1: return from a call to av_popcount_c
      223.     x += x >> 8;
      224.     return (x + (x >> 16)) & 0x3F;
      225. }
           ^
      226. 
      227. /**

libavutil/common.h:218:1: start of procedure av_popcount_c()
      216.  * @return the number of bits set to one in x
      217.  */
      218. static av_always_inline av_const int av_popcount_c(uint32_t x)
           ^
      219. {
      220.     x -= (x >> 1) & 0x55555555;

libavutil/common.h:220:5: 
      218. static av_always_inline av_const int av_popcount_c(uint32_t x)
      219. {
      220.     x -= (x >> 1) & 0x55555555;
               ^
      221.     x = (x & 0x33333333) + ((x >> 2) & 0x33333333);
      222.     x = (x + (x >> 4)) & 0x0F0F0F0F;

libavutil/common.h:221:5: 
      219. {
      220.     x -= (x >> 1) & 0x55555555;
      221.     x = (x & 0x33333333) + ((x >> 2) & 0x33333333);
               ^
      222.     x = (x + (x >> 4)) & 0x0F0F0F0F;
      223.     x += x >> 8;

libavutil/common.h:222:5: 
      220.     x -= (x >> 1) & 0x55555555;
      221.     x = (x & 0x33333333) + ((x >> 2) & 0x33333333);
      222.     x = (x + (x >> 4)) & 0x0F0F0F0F;
               ^
      223.     x += x >> 8;
      224.     return (x + (x >> 16)) & 0x3F;

libavutil/common.h:223:5: 
      221.     x = (x & 0x33333333) + ((x >> 2) & 0x33333333);
      222.     x = (x + (x >> 4)) & 0x0F0F0F0F;
      223.     x += x >> 8;
               ^
      224.     return (x + (x >> 16)) & 0x3F;
      225. }

libavutil/common.h:224:5: 
      222.     x = (x + (x >> 4)) & 0x0F0F0F0F;
      223.     x += x >> 8;
      224.     return (x + (x >> 16)) & 0x3F;
               ^
      225. }
      226. 

libavutil/common.h:225:1: return from a call to av_popcount_c
      223.     x += x >> 8;
      224.     return (x + (x >> 16)) & 0x3F;
      225. }
           ^
      226. 
      227. /**

libavutil/common.h:235:1: return from a call to av_popcount64_c
    233. {
    234.     return av_popcount(x) + av_popcount(x >> 32);
    235. }
         ^
    236. 
    237. #define MKTAG(a,b,c,d) ((a) | ((b) << 8) | ((c) << 16) | ((unsigned)(d) << 24))

libavutil/channel_layout.c:181:1: return from a call to av_get_channel_layout_nb_channels
  179. {
  180.     return av_popcount64(channel_layout);
  181. }
       ^
  182. 
  183. uint64_t av_get_default_channel_layout(int nb_channels)

libavfilter/fifo.c:171:14: Taking false branch
169.         int nb_channels = av_get_channel_layout_nb_channels(link->channel_layout);
170. 
171.         if (!s->out) {
                  ^
172.             s->out = ff_get_audio_buffer(link, link->request_samples);
173.             if (!s->out)

libavfilter/fifo.c:179:20: Taking false branch
177.             s->out->pts                   = head->pts;
178.             s->allocated_samples          = link->request_samples;
179.         } else if (link->request_samples != s->allocated_samples) {
                        ^
180.             av_log(ctx, AV_LOG_ERROR, "request_samples changed before the "
181.                    "buffer was returned.\n");

libavfilter/fifo.c:185:16: Loop condition is true. Entering loop body
183.         }
184. 
185.         while (s->out->nb_samples < s->allocated_samples) {
                    ^
186.             int len = FFMIN(s->allocated_samples - s->out->nb_samples,
187.                             head->nb_samples);

libavfilter/fifo.c:186:23: Condition is true
184. 
185.         while (s->out->nb_samples < s->allocated_samples) {
186.             int len = FFMIN(s->allocated_samples - s->out->nb_samples,
                           ^
187.                             head->nb_samples);
188. 

libavfilter/fifo.c:186:13: 
184. 
185.         while (s->out->nb_samples < s->allocated_samples) {
186.             int len = FFMIN(s->allocated_samples - s->out->nb_samples,
                 ^
187.                             head->nb_samples);
188. 

libavfilter/fifo.c:189:13: Skipping av_samples_copy(): empty list of specs
187.                             head->nb_samples);
188. 
189.             av_samples_copy(s->out->extended_data, head->extended_data,
                 ^
190.                             s->out->nb_samples, 0, len, nb_channels,
191.                             link->format);

libavfilter/fifo.c:192:13: 
190.                             s->out->nb_samples, 0, len, nb_channels,
191.                             link->format);
192.             s->out->nb_samples += len;
                 ^
193. 
194.             if (len == head->nb_samples) {

libavfilter/fifo.c:194:17: Taking true branch
192.             s->out->nb_samples += len;
193. 
194.             if (len == head->nb_samples) {
                     ^
195.                 av_frame_free(&head);
196.                 queue_pop(s);

libavfilter/fifo.c:195:17: 
193. 
194.             if (len == head->nb_samples) {
195.                 av_frame_free(&head);
                     ^
196.                 queue_pop(s);
197. 

libavutil/frame.c:55:1: start of procedure av_frame_free()
  53. }
  54. 
  55. void av_frame_free(AVFrame **frame)
      ^
  56. {
  57.     if (!frame || !*frame)

libavutil/frame.c:57:10: Taking false branch
  55. void av_frame_free(AVFrame **frame)
  56. {
  57.     if (!frame || !*frame)
               ^
  58.         return;
  59. 

libavutil/frame.c:57:20: Taking false branch
  55. void av_frame_free(AVFrame **frame)
  56. {
  57.     if (!frame || !*frame)
                         ^
  58.         return;
  59. 

libavutil/frame.c:60:5: Skipping av_frame_unref(): empty list of specs
  58.         return;
  59. 
  60.     av_frame_unref(*frame);
          ^
  61.     av_freep(frame);
  62. }

libavutil/frame.c:61:5: 
  59. 
  60.     av_frame_unref(*frame);
  61.     av_freep(frame);
          ^
  62. }
  63. 

libavutil/mem.c:151:1: start of procedure av_freep()
    149. }
    150. 
    151. void av_freep(void *arg)
         ^
    152. {
    153.     void **ptr = (void **)arg;

libavutil/mem.c:153:5: 
    151. void av_freep(void *arg)
    152. {
    153.     void **ptr = (void **)arg;
             ^
    154.     av_free(*ptr);
    155.     *ptr = NULL;

libavutil/mem.c:154:5: 
    152. {
    153.     void **ptr = (void **)arg;
    154.     av_free(*ptr);
             ^
    155.     *ptr = NULL;
    156. }

libavutil/mem.c:139:1: start of procedure av_free()
      137. }
      138. 
      139. void av_free(void *ptr)
           ^
      140. {
      141. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:147:5: 
      145.     _aligned_free(ptr);
      146. #else
      147.     free(ptr);
               ^
      148. #endif
      149. }

libavutil/mem.c:149:1: return from a call to av_free
      147.     free(ptr);
      148. #endif
      149. }
           ^
      150. 
      151. void av_freep(void *arg)

libavutil/mem.c:155:5: 
    153.     void **ptr = (void **)arg;
    154.     av_free(*ptr);
    155.     *ptr = NULL;
             ^
    156. }
    157. 

libavutil/mem.c:156:1: return from a call to av_freep
    154.     av_free(*ptr);
    155.     *ptr = NULL;
    156. }
         ^
    157. 
    158. void *av_mallocz(size_t size)

libavutil/frame.c:62:1: return from a call to av_frame_free
  60.     av_frame_unref(*frame);
  61.     av_freep(frame);
  62. }
      ^
  63. 
  64. static int get_video_buffer(AVFrame *frame, int align)

libavfilter/fifo.c:196:17: 
194.             if (len == head->nb_samples) {
195.                 av_frame_free(&head);
196.                 queue_pop(s);
                     ^
197. 
198.                 if (!s->root.next &&

libavfilter/fifo.c:92:1: start of procedure queue_pop()
  90. }
  91. 
  92. static void queue_pop(FifoContext *s)
      ^
  93. {
  94.     Buf *tmp = s->root.next->next;

libavfilter/fifo.c:94:5: 
  92. static void queue_pop(FifoContext *s)
  93. {
  94.     Buf *tmp = s->root.next->next;
          ^
  95.     if (s->last == s->root.next)
  96.         s->last = &s->root;

libavfilter/fifo.c:95:9: Taking false branch
  93. {
  94.     Buf *tmp = s->root.next->next;
  95.     if (s->last == s->root.next)
              ^
  96.         s->last = &s->root;
  97.     av_freep(&s->root.next);

libavfilter/fifo.c:97:5: 
  95.     if (s->last == s->root.next)
  96.         s->last = &s->root;
  97.     av_freep(&s->root.next);
          ^
  98.     s->root.next = tmp;
  99. }

libavutil/mem.c:151:1: start of procedure av_freep()
    149. }
    150. 
    151. void av_freep(void *arg)
         ^
    152. {
    153.     void **ptr = (void **)arg;

libavutil/mem.c:153:5: 
    151. void av_freep(void *arg)
    152. {
    153.     void **ptr = (void **)arg;
             ^
    154.     av_free(*ptr);
    155.     *ptr = NULL;

libavutil/mem.c:154:5: 
    152. {
    153.     void **ptr = (void **)arg;
    154.     av_free(*ptr);
             ^
    155.     *ptr = NULL;
    156. }

libavutil/mem.c:139:1: start of procedure av_free()
      137. }
      138. 
      139. void av_free(void *ptr)
           ^
      140. {
      141. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:147:5: 
      145.     _aligned_free(ptr);
      146. #else
      147.     free(ptr);
               ^
      148. #endif
      149. }

libavutil/mem.c:149:1: return from a call to av_free
      147.     free(ptr);
      148. #endif
      149. }
           ^
      150. 
      151. void av_freep(void *arg)

libavutil/mem.c:155:5: 
    153.     void **ptr = (void **)arg;
    154.     av_free(*ptr);
    155.     *ptr = NULL;
             ^
    156. }
    157. 

libavutil/mem.c:156:1: return from a call to av_freep
    154.     av_free(*ptr);
    155.     *ptr = NULL;
    156. }
         ^
    157. 
    158. void *av_mallocz(size_t size)

libavfilter/fifo.c:98:5: 
   96.         s->last = &s->root;
   97.     av_freep(&s->root.next);
   98.     s->root.next = tmp;
           ^
   99. }
  100. 

libavfilter/fifo.c:99:1: return from a call to queue_pop
   97.     av_freep(&s->root.next);
   98.     s->root.next = tmp;
   99. }
       ^
  100. 
  101. /**

libavfilter/fifo.c:198:22: Taking true branch
196.                 queue_pop(s);
197. 
198.                 if (!s->root.next &&
                          ^
199.                     (ret = ff_request_frame(ctx->inputs[0])) < 0) {
200.                     if (ret == AVERROR_EOF) {

libavfilter/fifo.c:199:21: 
197. 
198.                 if (!s->root.next &&
199.                     (ret = ff_request_frame(ctx->inputs[0])) < 0) {
                         ^
200.                     if (ret == AVERROR_EOF) {
201.                         av_samples_set_silence(s->out->extended_data,

libavfilter/avfilter.c:241:1: start of procedure ff_request_frame()
  239. }
  240. 
  241. int ff_request_frame(AVFilterLink *link)
       ^
  242. {
  243.     FF_DPRINTF_START(NULL, request_frame); ff_dlog_link(NULL, link, 1);

libavfilter/avfilter.c:243:44: 
  241. int ff_request_frame(AVFilterLink *link)
  242. {
  243.     FF_DPRINTF_START(NULL, request_frame); ff_dlog_link(NULL, link, 1);
                                                  ^
  244. 
  245.     if (link->srcpad->request_frame)

libavfilter/avfilter.c:217:1: start of procedure ff_dlog_link()
    215. }
    216. 
    217. void ff_dlog_link(void *ctx, AVFilterLink *link, int end)
         ^
    218. {
    219.     if (link->type == AVMEDIA_TYPE_VIDEO) {

libavfilter/avfilter.c:219:9: Taking false branch
    217. void ff_dlog_link(void *ctx, AVFilterLink *link, int end)
    218. {
    219.     if (link->type == AVMEDIA_TYPE_VIDEO) {
                 ^
    220.         av_dlog(ctx,
    221.                 "link[%p s:%dx%d fmt:%-16s %-16s->%-16s]%s",

libavfilter/avfilter.c:229:9: Skipping av_get_channel_layout_string(): empty list of specs
    227.     } else {
    228.         char buf[128];
    229.         av_get_channel_layout_string(buf, sizeof(buf), -1, link->channel_layout);
                 ^
    230. 
    231.         av_dlog(ctx,

libavfilter/avfilter.c:219:5: 
    217. void ff_dlog_link(void *ctx, AVFilterLink *link, int end)
    218. {
    219.     if (link->type == AVMEDIA_TYPE_VIDEO) {
             ^
    220.         av_dlog(ctx,
    221.                 "link[%p s:%dx%d fmt:%-16s %-16s->%-16s]%s",

libavfilter/avfilter.c:239:1: return from a call to ff_dlog_link
    237.                 end ? "\n" : "");
    238.     }
    239. }
         ^
    240. 
    241. int ff_request_frame(AVFilterLink *link)

libavfilter/avfilter.c:245:9: Taking false branch
  243.     FF_DPRINTF_START(NULL, request_frame); ff_dlog_link(NULL, link, 1);
  244. 
  245.     if (link->srcpad->request_frame)
               ^
  246.         return link->srcpad->request_frame(link);
  247.     else if (link->src->inputs[0])

libavfilter/avfilter.c:247:14: Taking true branch
  245.     if (link->srcpad->request_frame)
  246.         return link->srcpad->request_frame(link);
  247.     else if (link->src->inputs[0])
                    ^
  248.         return ff_request_frame(link->src->inputs[0]);
  249.     else return -1;

libavfilter/avfilter.c:248:9: Skipping ff_request_frame(): function or method not found
  246.         return link->srcpad->request_frame(link);
  247.     else if (link->src->inputs[0])
  248.         return ff_request_frame(link->src->inputs[0]);
               ^
  249.     else return -1;
  250. }

libavfilter/avfilter.c:250:1: return from a call to ff_request_frame
  248.         return ff_request_frame(link->src->inputs[0]);
  249.     else return -1;
  250. }
       ^
  251. 
  252. int ff_poll_frame(AVFilterLink *link)

libavfilter/fifo.c:199:21: Taking false branch
197. 
198.                 if (!s->root.next &&
199.                     (ret = ff_request_frame(ctx->inputs[0])) < 0) {
                         ^
200.                     if (ret == AVERROR_EOF) {
201.                         av_samples_set_silence(s->out->extended_data,

libavfilter/fifo.c:211:17: 
209.                     return ret;
210.                 }
211.                 head = s->root.next->frame;
                     ^
212.             } else {
213.                 buffer_offset(link, head, len);
