libavformat/oggdec.c:191: error: Null Dereference
  pointer `nb` last assigned on line 188 could be null and is dereferenced by call to `memcpy()` at line 191, column 9.

libavformat/oggdec.c:185:1: start of procedure ogg_new_buf()
183. }
184. 
185. static int ogg_new_buf(struct ogg *ogg, int idx)
     ^
186. {
187.     struct ogg_stream *os = ogg->streams + idx;

libavformat/oggdec.c:187:5: 
185. static int ogg_new_buf(struct ogg *ogg, int idx)
186. {
187.     struct ogg_stream *os = ogg->streams + idx;
         ^
188.     uint8_t *nb = av_malloc(os->bufsize + FF_INPUT_BUFFER_PADDING_SIZE);
189.     int size = os->bufpos - os->pstart;

libavformat/oggdec.c:188:5: 
186. {
187.     struct ogg_stream *os = ogg->streams + idx;
188.     uint8_t *nb = av_malloc(os->bufsize + FF_INPUT_BUFFER_PADDING_SIZE);
         ^
189.     int size = os->bufpos - os->pstart;
190.     if(os->buf){

libavutil/mem.c:64:1: start of procedure av_malloc()
  62.    linker will do it automatically. */
  63. 
  64. void *av_malloc(size_t size)
      ^
  65. {
  66.     void *ptr = NULL;

libavutil/mem.c:66:5: 
  64. void *av_malloc(size_t size)
  65. {
  66.     void *ptr = NULL;
          ^
  67. #if CONFIG_MEMALIGN_HACK
  68.     long diff;

libavutil/mem.c:72:9: Taking true branch
  70. 
  71.     /* let's disallow possible ambiguous cases */
  72.     if (size > (INT_MAX-32) || !size)
              ^
  73.         return NULL;
  74. 

libavutil/mem.c:73:9: 
  71.     /* let's disallow possible ambiguous cases */
  72.     if (size > (INT_MAX-32) || !size)
  73.         return NULL;
              ^
  74. 
  75. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:117:1: return from a call to av_malloc
  115. #endif
  116.     return ptr;
  117. }
       ^
  118. 
  119. void *av_realloc(void *ptr, size_t size)

libavformat/oggdec.c:189:5: 
187.     struct ogg_stream *os = ogg->streams + idx;
188.     uint8_t *nb = av_malloc(os->bufsize + FF_INPUT_BUFFER_PADDING_SIZE);
189.     int size = os->bufpos - os->pstart;
         ^
190.     if(os->buf){
191.         memcpy(nb, os->buf + os->pstart, size);

libavformat/oggdec.c:190:8: Taking true branch
188.     uint8_t *nb = av_malloc(os->bufsize + FF_INPUT_BUFFER_PADDING_SIZE);
189.     int size = os->bufpos - os->pstart;
190.     if(os->buf){
            ^
191.         memcpy(nb, os->buf + os->pstart, size);
192.         av_free(os->buf);

libavformat/oggdec.c:191:9: 
189.     int size = os->bufpos - os->pstart;
190.     if(os->buf){
191.         memcpy(nb, os->buf + os->pstart, size);
             ^
192.         av_free(os->buf);
193.     }
