libavformat/rtpdec_asf.c:116: error: Null Dereference
  pointer `rt->asf_ctx` last assigned on line 111 could be null and is dereferenced at line 116, column 40.

libavformat/rtpdec_asf.c:95:1: start of procedure ff_wms_parse_sdp_a_line()
93. }
94. 
95. int ff_wms_parse_sdp_a_line(AVFormatContext *s, const char *p)
    ^
96. {
97.     int ret = 0;

libavformat/rtpdec_asf.c:97:5: 
95. int ff_wms_parse_sdp_a_line(AVFormatContext *s, const char *p)
96. {
97.     int ret = 0;
        ^
98.     if (av_strstart(p, "pgmpu:data:application/vnd.ms.wms-hdr.asfv1;base64,", &p)) {
99.         AVIOContext pb;

libavformat/rtpdec_asf.c:98:9: Taking true branch
 96. {
 97.     int ret = 0;
 98.     if (av_strstart(p, "pgmpu:data:application/vnd.ms.wms-hdr.asfv1;base64,", &p)) {
             ^
 99.         AVIOContext pb;
100.         RTSPState *rt = s->priv_data;

libavformat/rtpdec_asf.c:100:9: 
 98.     if (av_strstart(p, "pgmpu:data:application/vnd.ms.wms-hdr.asfv1;base64,", &p)) {
 99.         AVIOContext pb;
100.         RTSPState *rt = s->priv_data;
             ^
101.         int len = strlen(p) * 6 / 8;
102.         char *buf = av_mallocz(len);

libavformat/rtpdec_asf.c:101:9: 
 99.         AVIOContext pb;
100.         RTSPState *rt = s->priv_data;
101.         int len = strlen(p) * 6 / 8;
             ^
102.         char *buf = av_mallocz(len);
103.         av_base64_decode(buf, p, len);

libavformat/rtpdec_asf.c:102:9: 
100.         RTSPState *rt = s->priv_data;
101.         int len = strlen(p) * 6 / 8;
102.         char *buf = av_mallocz(len);
             ^
103.         av_base64_decode(buf, p, len);
104. 

libavutil/mem.c:156:1: start of procedure av_mallocz()
  154. }
  155. 
  156. void *av_mallocz(FF_INTERNAL_MEM_TYPE size)
       ^
  157. {
  158.     void *ptr = av_malloc(size);

libavutil/mem.c:158:5: 
  156. void *av_mallocz(FF_INTERNAL_MEM_TYPE size)
  157. {
  158.     void *ptr = av_malloc(size);
           ^
  159.     if (ptr)
  160.         memset(ptr, 0, size);

libavutil/mem.c:64:1: start of procedure av_malloc()
    62.    linker will do it automatically. */
    63. 
    64. void *av_malloc(FF_INTERNAL_MEM_TYPE size)
        ^
    65. {
    66.     void *ptr = NULL;

libavutil/mem.c:66:5: 
    64. void *av_malloc(FF_INTERNAL_MEM_TYPE size)
    65. {
    66.     void *ptr = NULL;
            ^
    67. #if CONFIG_MEMALIGN_HACK
    68.     long diff;

libavutil/mem.c:72:8: Taking true branch
    70. 
    71.     /* let's disallow possible ambiguous cases */
    72.     if(size > (INT_MAX-16) )
               ^
    73.         return NULL;
    74. 

libavutil/mem.c:73:9: 
    71.     /* let's disallow possible ambiguous cases */
    72.     if(size > (INT_MAX-16) )
    73.         return NULL;
                ^
    74. 
    75. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:117:1: return from a call to av_malloc
    115. #endif
    116.     return ptr;
    117. }
         ^
    118. 
    119. void *av_realloc(void *ptr, FF_INTERNAL_MEM_TYPE size)

libavutil/mem.c:159:9: Taking false branch
  157. {
  158.     void *ptr = av_malloc(size);
  159.     if (ptr)
               ^
  160.         memset(ptr, 0, size);
  161.     return ptr;

libavutil/mem.c:161:5: 
  159.     if (ptr)
  160.         memset(ptr, 0, size);
  161.     return ptr;
           ^
  162. }
  163. 

libavutil/mem.c:162:1: return from a call to av_mallocz
  160.         memset(ptr, 0, size);
  161.     return ptr;
  162. }
       ^
  163. 
  164. char *av_strdup(const char *s)

libavformat/rtpdec_asf.c:103:9: Skipping av_base64_decode(): empty list of specs
101.         int len = strlen(p) * 6 / 8;
102.         char *buf = av_mallocz(len);
103.         av_base64_decode(buf, p, len);
             ^
104. 
105.         if (rtp_asf_fix_header(buf, len) < 0)

libavformat/rtpdec_asf.c:105:13: Taking true branch
103.         av_base64_decode(buf, p, len);
104. 
105.         if (rtp_asf_fix_header(buf, len) < 0)
                 ^
106.             av_log(s, AV_LOG_ERROR,
107.                    "Failed to fix invalid RTSP-MS/ASF min_pktsize\n");

libavformat/rtpdec_asf.c:106:13: Skipping av_log(): empty list of specs
104. 
105.         if (rtp_asf_fix_header(buf, len) < 0)
106.             av_log(s, AV_LOG_ERROR,
                 ^
107.                    "Failed to fix invalid RTSP-MS/ASF min_pktsize\n");
108.         init_packetizer(&pb, buf, len);

libavformat/rtpdec_asf.c:108:9: 
106.             av_log(s, AV_LOG_ERROR,
107.                    "Failed to fix invalid RTSP-MS/ASF min_pktsize\n");
108.         init_packetizer(&pb, buf, len);
             ^
109.         if (rt->asf_ctx) {
110.             av_close_input_stream(rt->asf_ctx);

libavformat/rtpdec_asf.c:86:1: start of procedure init_packetizer()
  84. }
  85. 
  86. static void init_packetizer(AVIOContext *pb, uint8_t *buf, int len)
      ^
  87. {
  88.     ffio_init_context(pb, buf, len, 0, NULL, packetizer_read, NULL, NULL);

libavformat/rtpdec_asf.c:88:5: 
  86. static void init_packetizer(AVIOContext *pb, uint8_t *buf, int len)
  87. {
  88.     ffio_init_context(pb, buf, len, 0, NULL, packetizer_read, NULL, NULL);
          ^
  89. 
  90.     /* this "fills" the buffer with its current content */

libavformat/aviobuf.c:45:1: start of procedure ffio_init_context()
    43. #endif
    44. 
    45. int ffio_init_context(AVIOContext *s,
        ^
    46.                   unsigned char *buffer,
    47.                   int buffer_size,

libavformat/aviobuf.c:54:5: 
    52.                   int64_t (*seek)(void *opaque, int64_t offset, int whence))
    53. {
    54.     s->buffer = buffer;
            ^
    55.     s->buffer_size = buffer_size;
    56.     s->buf_ptr = buffer;

libavformat/aviobuf.c:55:5: 
    53. {
    54.     s->buffer = buffer;
    55.     s->buffer_size = buffer_size;
            ^
    56.     s->buf_ptr = buffer;
    57.     s->opaque = opaque;

libavformat/aviobuf.c:56:5: 
    54.     s->buffer = buffer;
    55.     s->buffer_size = buffer_size;
    56.     s->buf_ptr = buffer;
            ^
    57.     s->opaque = opaque;
    58.     url_resetbuf(s, write_flag ? AVIO_WRONLY : AVIO_RDONLY);

libavformat/aviobuf.c:57:5: 
    55.     s->buffer_size = buffer_size;
    56.     s->buf_ptr = buffer;
    57.     s->opaque = opaque;
            ^
    58.     url_resetbuf(s, write_flag ? AVIO_WRONLY : AVIO_RDONLY);
    59.     s->write_packet = write_packet;

libavformat/aviobuf.c:58:21: Condition is false
    56.     s->buf_ptr = buffer;
    57.     s->opaque = opaque;
    58.     url_resetbuf(s, write_flag ? AVIO_WRONLY : AVIO_RDONLY);
                            ^
    59.     s->write_packet = write_packet;
    60.     s->read_packet = read_packet;

libavformat/aviobuf.c:58:5: 
    56.     s->buf_ptr = buffer;
    57.     s->opaque = opaque;
    58.     url_resetbuf(s, write_flag ? AVIO_WRONLY : AVIO_RDONLY);
            ^
    59.     s->write_packet = write_packet;
    60.     s->read_packet = read_packet;

libavformat/aviobuf.c:882:1: start of procedure url_resetbuf()
      880. 
      881. #if FF_API_URL_RESETBUF
      882. int url_resetbuf(AVIOContext *s, int flags)
           ^
      883. #else
      884. static int url_resetbuf(AVIOContext *s, int flags)

libavformat/aviobuf.c:888:9: Taking false branch
      886. {
      887. #if FF_API_URL_RESETBUF
      888.     if (flags & AVIO_RDWR)
                   ^
      889.         return AVERROR(EINVAL);
      890. #else

libavformat/aviobuf.c:894:9: Taking true branch
      892. #endif
      893. 
      894.     if (flags & AVIO_WRONLY) {
                   ^
      895.         s->buf_end = s->buffer + s->buffer_size;
      896.         s->write_flag = 1;

libavformat/aviobuf.c:895:9: 
      893. 
      894.     if (flags & AVIO_WRONLY) {
      895.         s->buf_end = s->buffer + s->buffer_size;
                   ^
      896.         s->write_flag = 1;
      897.     } else {

libavformat/aviobuf.c:896:9: 
      894.     if (flags & AVIO_WRONLY) {
      895.         s->buf_end = s->buffer + s->buffer_size;
      896.         s->write_flag = 1;
                   ^
      897.     } else {
      898.         s->buf_end = s->buffer;

libavformat/aviobuf.c:901:5: 
      899.         s->write_flag = 0;
      900.     }
      901.     return 0;
               ^
      902. }
      903. 

libavformat/aviobuf.c:902:1: return from a call to url_resetbuf
      900.     }
      901.     return 0;
      902. }
           ^
      903. 
      904. int ffio_rewind_with_probe_data(AVIOContext *s, unsigned char *buf, int buf_size)

libavformat/aviobuf.c:59:5: 
    57.     s->opaque = opaque;
    58.     url_resetbuf(s, write_flag ? AVIO_WRONLY : AVIO_RDONLY);
    59.     s->write_packet = write_packet;
            ^
    60.     s->read_packet = read_packet;
    61.     s->seek = seek;

libavformat/aviobuf.c:60:5: 
    58.     url_resetbuf(s, write_flag ? AVIO_WRONLY : AVIO_RDONLY);
    59.     s->write_packet = write_packet;
    60.     s->read_packet = read_packet;
            ^
    61.     s->seek = seek;
    62.     s->pos = 0;

libavformat/aviobuf.c:61:5: 
    59.     s->write_packet = write_packet;
    60.     s->read_packet = read_packet;
    61.     s->seek = seek;
            ^
    62.     s->pos = 0;
    63.     s->must_flush = 0;

libavformat/aviobuf.c:62:5: 
    60.     s->read_packet = read_packet;
    61.     s->seek = seek;
    62.     s->pos = 0;
            ^
    63.     s->must_flush = 0;
    64.     s->eof_reached = 0;

libavformat/aviobuf.c:63:5: 
    61.     s->seek = seek;
    62.     s->pos = 0;
    63.     s->must_flush = 0;
            ^
    64.     s->eof_reached = 0;
    65.     s->error = 0;

libavformat/aviobuf.c:64:5: 
    62.     s->pos = 0;
    63.     s->must_flush = 0;
    64.     s->eof_reached = 0;
            ^
    65.     s->error = 0;
    66. #if FF_API_OLD_AVIO

libavformat/aviobuf.c:65:5: 
    63.     s->must_flush = 0;
    64.     s->eof_reached = 0;
    65.     s->error = 0;
            ^
    66. #if FF_API_OLD_AVIO
    67.     s->is_streamed = 0;

libavformat/aviobuf.c:67:5: 
    65.     s->error = 0;
    66. #if FF_API_OLD_AVIO
    67.     s->is_streamed = 0;
            ^
    68. #endif
    69.     s->seekable = AVIO_SEEKABLE_NORMAL;

libavformat/aviobuf.c:69:5: 
    67.     s->is_streamed = 0;
    68. #endif
    69.     s->seekable = AVIO_SEEKABLE_NORMAL;
            ^
    70.     s->max_packet_size = 0;
    71.     s->update_checksum= NULL;

libavformat/aviobuf.c:70:5: 
    68. #endif
    69.     s->seekable = AVIO_SEEKABLE_NORMAL;
    70.     s->max_packet_size = 0;
            ^
    71.     s->update_checksum= NULL;
    72.     if(!read_packet && !write_flag){

libavformat/aviobuf.c:71:5: 
    69.     s->seekable = AVIO_SEEKABLE_NORMAL;
    70.     s->max_packet_size = 0;
    71.     s->update_checksum= NULL;
            ^
    72.     if(!read_packet && !write_flag){
    73.         s->pos = buffer_size;

libavformat/aviobuf.c:72:9: Taking false branch
    70.     s->max_packet_size = 0;
    71.     s->update_checksum= NULL;
    72.     if(!read_packet && !write_flag){
                ^
    73.         s->pos = buffer_size;
    74.         s->buf_end = s->buffer + buffer_size;

libavformat/aviobuf.c:76:5: 
    74.         s->buf_end = s->buffer + buffer_size;
    75.     }
    76.     s->read_pause = NULL;
            ^
    77.     s->read_seek  = NULL;
    78.     return 0;

libavformat/aviobuf.c:77:5: 
    75.     }
    76.     s->read_pause = NULL;
    77.     s->read_seek  = NULL;
            ^
    78.     return 0;
    79. }

libavformat/aviobuf.c:78:5: 
    76.     s->read_pause = NULL;
    77.     s->read_seek  = NULL;
    78.     return 0;
            ^
    79. }
    80. 

libavformat/aviobuf.c:79:1: return from a call to ffio_init_context
    77.     s->read_seek  = NULL;
    78.     return 0;
    79. }
        ^
    80. 
    81. #if FF_API_OLD_AVIO

libavformat/rtpdec_asf.c:91:5: 
  89. 
  90.     /* this "fills" the buffer with its current content */
  91.     pb->pos     = len;
          ^
  92.     pb->buf_end = buf + len;
  93. }

libavformat/rtpdec_asf.c:92:5: 
  90.     /* this "fills" the buffer with its current content */
  91.     pb->pos     = len;
  92.     pb->buf_end = buf + len;
          ^
  93. }
  94. 

libavformat/rtpdec_asf.c:93:1: return from a call to init_packetizer
  91.     pb->pos     = len;
  92.     pb->buf_end = buf + len;
  93. }
      ^
  94. 
  95. int ff_wms_parse_sdp_a_line(AVFormatContext *s, const char *p)

libavformat/rtpdec_asf.c:109:13: Taking true branch
107.                    "Failed to fix invalid RTSP-MS/ASF min_pktsize\n");
108.         init_packetizer(&pb, buf, len);
109.         if (rt->asf_ctx) {
                 ^
110.             av_close_input_stream(rt->asf_ctx);
111.             rt->asf_ctx = NULL;

libavformat/rtpdec_asf.c:110:13: 
108.         init_packetizer(&pb, buf, len);
109.         if (rt->asf_ctx) {
110.             av_close_input_stream(rt->asf_ctx);
                 ^
111.             rt->asf_ctx = NULL;
112.         }

libavformat/utils.c:2595:1: start of procedure av_close_input_stream()
  2593. }
  2594. 
  2595. void av_close_input_stream(AVFormatContext *s)
        ^
  2596. {
  2597.     flush_packet_queue(s);

libavformat/utils.c:2597:5: Skipping flush_packet_queue(): empty list of specs
  2595. void av_close_input_stream(AVFormatContext *s)
  2596. {
  2597.     flush_packet_queue(s);
            ^
  2598.     if (s->iformat->read_close)
  2599.         s->iformat->read_close(s);

libavformat/utils.c:2598:9: Taking false branch
  2596. {
  2597.     flush_packet_queue(s);
  2598.     if (s->iformat->read_close)
                ^
  2599.         s->iformat->read_close(s);
  2600.     avformat_free_context(s);

libavformat/utils.c:2600:5: Skipping avformat_free_context(): empty list of specs
  2598.     if (s->iformat->read_close)
  2599.         s->iformat->read_close(s);
  2600.     avformat_free_context(s);
            ^
  2601. }
  2602. 

libavformat/utils.c:2601:1: return from a call to av_close_input_stream
  2599.         s->iformat->read_close(s);
  2600.     avformat_free_context(s);
  2601. }
        ^
  2602. 
  2603. void avformat_free_context(AVFormatContext *s)

libavformat/rtpdec_asf.c:111:13: 
109.         if (rt->asf_ctx) {
110.             av_close_input_stream(rt->asf_ctx);
111.             rt->asf_ctx = NULL;
                 ^
112.         }
113.         ret = av_open_input_stream(&rt->asf_ctx, &pb, "", &ff_asf_demuxer, NULL);

libavformat/rtpdec_asf.c:113:9: Skipping av_open_input_stream(): empty list of specs
111.             rt->asf_ctx = NULL;
112.         }
113.         ret = av_open_input_stream(&rt->asf_ctx, &pb, "", &ff_asf_demuxer, NULL);
             ^
114.         if (ret < 0)
115.             return ret;

libavformat/rtpdec_asf.c:114:13: Taking false branch
112.         }
113.         ret = av_open_input_stream(&rt->asf_ctx, &pb, "", &ff_asf_demuxer, NULL);
114.         if (ret < 0)
                 ^
115.             return ret;
116.         av_metadata_copy(&s->metadata, rt->asf_ctx->metadata, 0);

libavformat/rtpdec_asf.c:116:9: 
114.         if (ret < 0)
115.             return ret;
116.         av_metadata_copy(&s->metadata, rt->asf_ctx->metadata, 0);
             ^
117.         rt->asf_pb_pos = avio_tell(&pb);
118.         av_free(buf);
