libavformat/rtspdec.c:202: error: Null Dereference
  pointer `null` is dereferenced by call to `rtsp_send_reply()` at line 202, column 9.

libavformat/rtspdec.c:171:1: start of procedure rtsp_read_announce()
169. }
170. 
171. static int rtsp_read_announce(AVFormatContext *s)
     ^
172. {
173.     RTSPState *rt             = s->priv_data;

libavformat/rtspdec.c:173:5: 
171. static int rtsp_read_announce(AVFormatContext *s)
172. {
173.     RTSPState *rt             = s->priv_data;
         ^
174.     RTSPMessageHeader request = { 0 };
175.     char sdp[4096];

libavformat/rtspdec.c:174:5: 
172. {
173.     RTSPState *rt             = s->priv_data;
174.     RTSPMessageHeader request = { 0 };
         ^
175.     char sdp[4096];
176.     int  ret;

libavformat/rtspdec.c:178:5: Skipping rtsp_read_request(): empty list of specs
176.     int  ret;
177. 
178.     ret = rtsp_read_request(s, &request, "ANNOUNCE");
         ^
179.     if (ret)
180.         return ret;

libavformat/rtspdec.c:179:9: Taking false branch
177. 
178.     ret = rtsp_read_request(s, &request, "ANNOUNCE");
179.     if (ret)
             ^
180.         return ret;
181.     rt->seq++;

libavformat/rtspdec.c:181:5: 
179.     if (ret)
180.         return ret;
181.     rt->seq++;
         ^
182.     if (strcmp(request.content_type, "application/sdp")) {
183.         av_log(s, AV_LOG_ERROR, "Unexpected content type %s\n",

libavformat/rtspdec.c:182:9: Taking false branch
180.         return ret;
181.     rt->seq++;
182.     if (strcmp(request.content_type, "application/sdp")) {
             ^
183.         av_log(s, AV_LOG_ERROR, "Unexpected content type %s\n",
184.                request.content_type);

libavformat/rtspdec.c:188:9: Taking true branch
186.         return AVERROR_OPTION_NOT_FOUND;
187.     }
188.     if (request.content_length && request.content_length < sizeof(sdp) - 1) {
             ^
189.         /* Read SDP */
190.         if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)

libavformat/rtspdec.c:188:35: Taking true branch
186.         return AVERROR_OPTION_NOT_FOUND;
187.     }
188.     if (request.content_length && request.content_length < sizeof(sdp) - 1) {
                                       ^
189.         /* Read SDP */
190.         if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)

libavformat/rtspdec.c:190:13: 
188.     if (request.content_length && request.content_length < sizeof(sdp) - 1) {
189.         /* Read SDP */
190.         if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)
                 ^
191.             < request.content_length) {
192.             av_log(s, AV_LOG_ERROR,

libavformat/avio.c:269:1: start of procedure ffurl_read_complete()
  267. }
  268. 
  269. int ffurl_read_complete(URLContext *h, unsigned char *buf, int size)
       ^
  270. {
  271.     if (!(h->flags & AVIO_FLAG_READ))

libavformat/avio.c:271:11: Taking true branch
  269. int ffurl_read_complete(URLContext *h, unsigned char *buf, int size)
  270. {
  271.     if (!(h->flags & AVIO_FLAG_READ))
                 ^
  272.         return AVERROR(EIO);
  273.     return retry_transfer_wrapper(h, buf, size, size, h->prot->url_read);

libavformat/avio.c:272:9: 
  270. {
  271.     if (!(h->flags & AVIO_FLAG_READ))
  272.         return AVERROR(EIO);
               ^
  273.     return retry_transfer_wrapper(h, buf, size, size, h->prot->url_read);
  274. }

libavformat/avio.c:274:1: return from a call to ffurl_read_complete
  272.         return AVERROR(EIO);
  273.     return retry_transfer_wrapper(h, buf, size, size, h->prot->url_read);
  274. }
       ^
  275. 
  276. int ffurl_write(URLContext *h, const unsigned char *buf, int size)

libavformat/rtspdec.c:190:13: Taking false branch
188.     if (request.content_length && request.content_length < sizeof(sdp) - 1) {
189.         /* Read SDP */
190.         if (ffurl_read_complete(rt->rtsp_hd, sdp, request.content_length)
                 ^
191.             < request.content_length) {
192.             av_log(s, AV_LOG_ERROR,

libavformat/rtspdec.c:197:9: 
195.             return AVERROR(EIO);
196.         }
197.         sdp[request.content_length] = '\0';
             ^
198.         av_log(s, AV_LOG_VERBOSE, "SDP: %s\n", sdp);
199.         ret = ff_sdp_parse(s, sdp);

libavformat/rtspdec.c:198:9: Skipping av_log(): empty list of specs
196.         }
197.         sdp[request.content_length] = '\0';
198.         av_log(s, AV_LOG_VERBOSE, "SDP: %s\n", sdp);
             ^
199.         ret = ff_sdp_parse(s, sdp);
200.         if (ret)

libavformat/rtspdec.c:199:9: Skipping ff_sdp_parse(): empty list of specs
197.         sdp[request.content_length] = '\0';
198.         av_log(s, AV_LOG_VERBOSE, "SDP: %s\n", sdp);
199.         ret = ff_sdp_parse(s, sdp);
             ^
200.         if (ret)
201.             return ret;

libavformat/rtspdec.c:200:13: Taking false branch
198.         av_log(s, AV_LOG_VERBOSE, "SDP: %s\n", sdp);
199.         ret = ff_sdp_parse(s, sdp);
200.         if (ret)
                 ^
201.             return ret;
202.         rtsp_send_reply(s, RTSP_STATUS_OK, NULL, request.seq);

libavformat/rtspdec.c:202:9: 
200.         if (ret)
201.             return ret;
202.         rtsp_send_reply(s, RTSP_STATUS_OK, NULL, request.seq);
             ^
203.         return 0;
204.     }

libavformat/rtspdec.c:96:1: start of procedure rtsp_send_reply()
  94. }
  95. 
  96. static int rtsp_send_reply(AVFormatContext *s, enum RTSPStatusCode code,
      ^
  97.                            const char *extracontent, uint16_t seq)
  98. {

libavformat/rtspdec.c:99:5: 
   97.                            const char *extracontent, uint16_t seq)
   98. {
   99.     RTSPState *rt = s->priv_data;
           ^
  100.     char message[4096];
  101.     int index = 0;

libavformat/rtspdec.c:101:5: 
   99.     RTSPState *rt = s->priv_data;
  100.     char message[4096];
  101.     int index = 0;
           ^
  102.     while (status_messages[index].code) {
  103.         if (status_messages[index].code == code) {

libavformat/rtspdec.c:102:12: Loop condition is true. Entering loop body
  100.     char message[4096];
  101.     int index = 0;
  102.     while (status_messages[index].code) {
                  ^
  103.         if (status_messages[index].code == code) {
  104.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",

libavformat/rtspdec.c:103:13: Taking false branch
  101.     int index = 0;
  102.     while (status_messages[index].code) {
  103.         if (status_messages[index].code == code) {
                   ^
  104.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",
  105.                      code, status_messages[index].message);

libavformat/rtspdec.c:108:9: 
  106.             break;
  107.         }
  108.         index++;
               ^
  109.     }
  110.     if (!status_messages[index].code)

libavformat/rtspdec.c:102:12: Loop condition is true. Entering loop body
  100.     char message[4096];
  101.     int index = 0;
  102.     while (status_messages[index].code) {
                  ^
  103.         if (status_messages[index].code == code) {
  104.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",

libavformat/rtspdec.c:103:13: Taking false branch
  101.     int index = 0;
  102.     while (status_messages[index].code) {
  103.         if (status_messages[index].code == code) {
                   ^
  104.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",
  105.                      code, status_messages[index].message);

libavformat/rtspdec.c:108:9: 
  106.             break;
  107.         }
  108.         index++;
               ^
  109.     }
  110.     if (!status_messages[index].code)

libavformat/rtspdec.c:102:12: Loop condition is true. Entering loop body
  100.     char message[4096];
  101.     int index = 0;
  102.     while (status_messages[index].code) {
                  ^
  103.         if (status_messages[index].code == code) {
  104.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",

libavformat/rtspdec.c:103:13: Taking false branch
  101.     int index = 0;
  102.     while (status_messages[index].code) {
  103.         if (status_messages[index].code == code) {
                   ^
  104.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",
  105.                      code, status_messages[index].message);

libavformat/rtspdec.c:108:9: 
  106.             break;
  107.         }
  108.         index++;
               ^
  109.     }
  110.     if (!status_messages[index].code)

libavformat/rtspdec.c:102:12: Loop condition is false. Leaving loop
  100.     char message[4096];
  101.     int index = 0;
  102.     while (status_messages[index].code) {
                  ^
  103.         if (status_messages[index].code == code) {
  104.             snprintf(message, sizeof(message), "RTSP/1.0 %d %s\r\n",

libavformat/rtspdec.c:110:10: Taking true branch
  108.         index++;
  109.     }
  110.     if (!status_messages[index].code)
                ^
  111.         return AVERROR(EINVAL);
  112.     av_strlcatf(message, sizeof(message), "CSeq: %d\r\n", seq);

libavformat/rtspdec.c:111:9: 
  109.     }
  110.     if (!status_messages[index].code)
  111.         return AVERROR(EINVAL);
               ^
  112.     av_strlcatf(message, sizeof(message), "CSeq: %d\r\n", seq);
  113.     av_strlcatf(message, sizeof(message), "Server: %s\r\n", LIBAVFORMAT_IDENT);

libavformat/rtspdec.c:121:1: return from a call to rtsp_send_reply
  119. 
  120.     return 0;
  121. }
       ^
  122. 
  123. static inline int check_sessionid(AVFormatContext *s,
