libavformat/rtspdec.c:199: error: Null Dereference
  pointer `null` is dereferenced by call to `rtsp_send_reply()` at line 199, column 9.

libavformat/rtspdec.c:168:1: start of procedure rtsp_read_announce()
166. }
167. 
168. static int rtsp_read_announce(AVFormatContext *s)
     ^
169. {
170.     RTSPState *rt             = s->priv_data;

libavformat/rtspdec.c:170:5: 
168. static int rtsp_read_announce(AVFormatContext *s)
169. {
170.     RTSPState *rt             = s->priv_data;
         ^
171.     RTSPMessageHeader request = { 0 };
172.     char sdp[4096];

libavformat/rtspdec.c:171:5: 
169. {
170.     RTSPState *rt             = s->priv_data;
171.     RTSPMessageHeader request = { 0 };
         ^
172.     char sdp[4096];
173.     int  ret;

libavformat/rtspdec.c:175:5: Skipping rtsp_read_request(): empty list of specs
173.     int  ret;
174. 
175.     ret = rtsp_read_request(s, &request, "ANNOUNCE");
         ^
176.     if (ret)
177.         return ret;

libavformat/rtspdec.c:176:9: Taking false branch
174. 
175.     ret = rtsp_read_request(s, &request, "ANNOUNCE");
176.     if (ret)
             ^
177.         return ret;
178.     rt->seq++;

libavformat/rtspdec.c:178:5: 
176.     if (ret)
177.         return ret;
178.     rt->seq++;
         ^
179.     if (strcmp(request.content_type, "application/sdp")) {
180.         av_log(s, AV_LOG_ERROR, "Unexpected content type %s\n",

libavformat/rtspdec.c:179:9: Taking false branch
177.         return ret;
178.     rt->seq++;
179.     if (strcmp(request.content_type, "application/sdp")) {
             ^
180.         av_log(s, AV_LOG_ERROR, "Unexpected content type %s\n",
181.                request.content_type);

libavformat/rtspdec.c:185:9: Taking true branch
183.         return AVERROR_OPTION_NOT_FOUND;
184.     }
185.     if (request.content_length && request.content_length < sizeof(sdp) - 1) {
             ^
186.         /* Read SDP */
187.         if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)

libavformat/rtspdec.c:185:35: Taking true branch
183.         return AVERROR_OPTION_NOT_FOUND;
184.     }
185.     if (request.content_length && request.content_length < sizeof(sdp) - 1) {
                                       ^
186.         /* Read SDP */
187.         if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)

libavformat/rtspdec.c:187:13: 
185.     if (request.content_length && request.content_length < sizeof(sdp) - 1) {
186.         /* Read SDP */
187.         if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)
                 ^
188.             < request.content_length) {
189.             av_log(s, AV_LOG_ERROR,

libavformat/avio.c:258:1: start of procedure ffurl_read_complete()
  256. }
  257. 
  258. int ffurl_read_complete(URLContext *h, unsigned char *buf, int size)
       ^
  259. {
  260.     if (!(h->flags & AVIO_FLAG_READ))

libavformat/avio.c:260:11: Taking true branch
  258. int ffurl_read_complete(URLContext *h, unsigned char *buf, int size)
  259. {
  260.     if (!(h->flags & AVIO_FLAG_READ))
                 ^
  261.         return AVERROR(EIO);
  262.     return retry_transfer_wrapper(h, buf, size, size, h->prot->url_read);

libavformat/avio.c:261:9: 
  259. {
  260.     if (!(h->flags & AVIO_FLAG_READ))
  261.         return AVERROR(EIO);
               ^
  262.     return retry_transfer_wrapper(h, buf, size, size, h->prot->url_read);
  263. }

libavformat/avio.c:263:1: return from a call to ffurl_read_complete
  261.         return AVERROR(EIO);
  262.     return retry_transfer_wrapper(h, buf, size, size, h->prot->url_read);
  263. }
       ^
  264. 
  265. int ffurl_write(URLContext *h, const unsigned char *buf, int size)

libavformat/rtspdec.c:187:13: Taking false branch
185.     if (request.content_length && request.content_length < sizeof(sdp) - 1) {
186.         /* Read SDP */
187.         if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)
                 ^
188.             < request.content_length) {
189.             av_log(s, AV_LOG_ERROR,

libavformat/rtspdec.c:194:9: 
192.             return AVERROR(EIO);
193.         }
194.         sdp[request.content_length] = '\0';
             ^
195.         av_log(s, AV_LOG_VERBOSE, "SDP: %s\n", sdp);
196.         ret = ff_sdp_parse(s, sdp);

libavformat/rtspdec.c:195:9: Skipping av_log(): empty list of specs
193.         }
194.         sdp[request.content_length] = '\0';
195.         av_log(s, AV_LOG_VERBOSE, "SDP: %s\n", sdp);
             ^
196.         ret = ff_sdp_parse(s, sdp);
197.         if (ret)

libavformat/rtspdec.c:196:9: Skipping ff_sdp_parse(): empty list of specs
194.         sdp[request.content_length] = '\0';
195.         av_log(s, AV_LOG_VERBOSE, "SDP: %s\n", sdp);
196.         ret = ff_sdp_parse(s, sdp);
             ^
197.         if (ret)
198.             return ret;

libavformat/rtspdec.c:197:13: Taking false branch
195.         av_log(s, AV_LOG_VERBOSE, "SDP: %s\n", sdp);
196.         ret = ff_sdp_parse(s, sdp);
197.         if (ret)
                 ^
198.             return ret;
199.         rtsp_send_reply(s, RTSP_STATUS_OK, NULL, request.seq);

libavformat/rtspdec.c:199:9: 
197.         if (ret)
198.             return ret;
199.         rtsp_send_reply(s, RTSP_STATUS_OK, NULL, request.seq);
             ^
200.         return 0;
201.     }

libavformat/rtspdec.c:93:1: start of procedure rtsp_send_reply()
  91. }
  92. 
  93. static int rtsp_send_reply(AVFormatContext *s, enum RTSPStatusCode code,
      ^
  94.                            const char *extracontent, uint16_t seq)
  95. {

libavformat/rtspdec.c:96:5: 
  94.                            const char *extracontent, uint16_t seq)
  95. {
  96.     RTSPState *rt = s->priv_data;
          ^
  97.     char message[4096];
  98.     int index = 0;

libavformat/rtspdec.c:98:5: 
   96.     RTSPState *rt = s->priv_data;
   97.     char message[4096];
   98.     int index = 0;
           ^
   99.     while (status_messages[index].code) {
  100.         if (status_messages[index].code == code) {

libavformat/rtspdec.c:99:12: Loop condition is true. Entering loop body
   97.     char message[4096];
   98.     int index = 0;
   99.     while (status_messages[index].code) {
                  ^
  100.         if (status_messages[index].code == code) {
  101.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",

libavformat/rtspdec.c:100:13: Taking false branch
   98.     int index = 0;
   99.     while (status_messages[index].code) {
  100.         if (status_messages[index].code == code) {
                   ^
  101.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",
  102.                      code, status_messages[index].message);

libavformat/rtspdec.c:105:9: 
  103.             break;
  104.         }
  105.         index++;
               ^
  106.     }
  107.     if (!status_messages[index].code)

libavformat/rtspdec.c:99:12: Loop condition is true. Entering loop body
   97.     char message[4096];
   98.     int index = 0;
   99.     while (status_messages[index].code) {
                  ^
  100.         if (status_messages[index].code == code) {
  101.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",

libavformat/rtspdec.c:100:13: Taking false branch
   98.     int index = 0;
   99.     while (status_messages[index].code) {
  100.         if (status_messages[index].code == code) {
                   ^
  101.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",
  102.                      code, status_messages[index].message);

libavformat/rtspdec.c:105:9: 
  103.             break;
  104.         }
  105.         index++;
               ^
  106.     }
  107.     if (!status_messages[index].code)

libavformat/rtspdec.c:99:12: Loop condition is false. Leaving loop
   97.     char message[4096];
   98.     int index = 0;
   99.     while (status_messages[index].code) {
                  ^
  100.         if (status_messages[index].code == code) {
  101.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",

libavformat/rtspdec.c:107:10: Taking true branch
  105.         index++;
  106.     }
  107.     if (!status_messages[index].code)
                ^
  108.         return AVERROR(EINVAL);
  109.     av_strlcatf(message, sizeof(message), "CSeq: %d\r\n", seq);

libavformat/rtspdec.c:108:9: 
  106.     }
  107.     if (!status_messages[index].code)
  108.         return AVERROR(EINVAL);
               ^
  109.     av_strlcatf(message, sizeof(message), "CSeq: %d\r\n", seq);
  110.     av_strlcatf(message, sizeof(message), "Server: %s\r\n", LIBAVFORMAT_IDENT);

libavformat/rtspdec.c:118:1: return from a call to rtsp_send_reply
  116. 
  117.     return 0;
  118. }
       ^
  119. 
  120. static inline int check_sessionid(AVFormatContext *s,
