libavcodec/h264_mp4toannexb_bsf.c:212: error: Null Dereference
  pointer `null` is dereferenced by call to `alloc_and_copy()` at line 212, column 17.

libavcodec/h264_mp4toannexb_bsf.c:159:1: start of procedure h264_mp4toannexb_filter()
157. }
158. 
159. static int h264_mp4toannexb_filter(AVBSFContext *ctx, AVPacket *out)
     ^
160. {
161.     H264BSFContext *s = ctx->priv_data;

libavcodec/h264_mp4toannexb_bsf.c:161:5: 
159. static int h264_mp4toannexb_filter(AVBSFContext *ctx, AVPacket *out)
160. {
161.     H264BSFContext *s = ctx->priv_data;
         ^
162. 
163.     AVPacket *in;

libavcodec/h264_mp4toannexb_bsf.c:166:5: 
164.     uint8_t unit_type;
165.     int32_t nal_size;
166.     uint32_t cumul_size    = 0;
         ^
167.     const uint8_t *buf;
168.     const uint8_t *buf_end;

libavcodec/h264_mp4toannexb_bsf.c:170:5: 
168.     const uint8_t *buf_end;
169.     int            buf_size;
170.     int ret = 0;
         ^
171. 
172.     ret = ff_bsf_get_packet(ctx, &in);

libavcodec/h264_mp4toannexb_bsf.c:172:5: 
170.     int ret = 0;
171. 
172.     ret = ff_bsf_get_packet(ctx, &in);
         ^
173.     if (ret < 0)
174.         return ret;

libavcodec/bsf.c:199:1: start of procedure ff_bsf_get_packet()
  197. }
  198. 
  199. int ff_bsf_get_packet(AVBSFContext *ctx, AVPacket **pkt)
       ^
  200. {
  201.     AVBSFInternal *in = ctx->internal;

libavcodec/bsf.c:201:5: 
  199. int ff_bsf_get_packet(AVBSFContext *ctx, AVPacket **pkt)
  200. {
  201.     AVBSFInternal *in = ctx->internal;
           ^
  202.     AVPacket *tmp_pkt;
  203. 

libavcodec/bsf.c:204:9: Taking false branch
  202.     AVPacket *tmp_pkt;
  203. 
  204.     if (in->eof)
               ^
  205.         return AVERROR_EOF;
  206. 

libavcodec/bsf.c:207:10: Taking false branch
  205.         return AVERROR_EOF;
  206. 
  207.     if (!ctx->internal->buffer_pkt->data &&
                ^
  208.         !ctx->internal->buffer_pkt->side_data_elems)
  209.         return AVERROR(EAGAIN);

libavcodec/bsf.c:211:5: Skipping av_packet_alloc(): empty list of specs
  209.         return AVERROR(EAGAIN);
  210. 
  211.     tmp_pkt = av_packet_alloc();
           ^
  212.     if (!tmp_pkt)
  213.         return AVERROR(ENOMEM);

libavcodec/bsf.c:212:10: Taking false branch
  210. 
  211.     tmp_pkt = av_packet_alloc();
  212.     if (!tmp_pkt)
                ^
  213.         return AVERROR(ENOMEM);
  214. 

libavcodec/bsf.c:215:5: 
  213.         return AVERROR(ENOMEM);
  214. 
  215.     *pkt = ctx->internal->buffer_pkt;
           ^
  216.     ctx->internal->buffer_pkt = tmp_pkt;
  217. 

libavcodec/bsf.c:216:5: 
  214. 
  215.     *pkt = ctx->internal->buffer_pkt;
  216.     ctx->internal->buffer_pkt = tmp_pkt;
           ^
  217. 
  218.     return 0;

libavcodec/bsf.c:218:5: 
  216.     ctx->internal->buffer_pkt = tmp_pkt;
  217. 
  218.     return 0;
           ^
  219. }

libavcodec/bsf.c:219:1: return from a call to ff_bsf_get_packet
  217. 
  218.     return 0;
  219. }
       ^

libavcodec/h264_mp4toannexb_bsf.c:173:9: Taking false branch
171. 
172.     ret = ff_bsf_get_packet(ctx, &in);
173.     if (ret < 0)
             ^
174.         return ret;
175. 

libavcodec/h264_mp4toannexb_bsf.c:177:10: Taking false branch
175. 
176.     /* nothing to filter */
177.     if (!s->extradata_parsed) {
              ^
178.         av_packet_move_ref(out, in);
179.         av_packet_free(&in);

libavcodec/h264_mp4toannexb_bsf.c:183:5: 
181.     }
182. 
183.     buf      = in->data;
         ^
184.     buf_size = in->size;
185.     buf_end  = in->data + in->size;

libavcodec/h264_mp4toannexb_bsf.c:184:5: 
182. 
183.     buf      = in->data;
184.     buf_size = in->size;
         ^
185.     buf_end  = in->data + in->size;
186. 

libavcodec/h264_mp4toannexb_bsf.c:185:5: 
183.     buf      = in->data;
184.     buf_size = in->size;
185.     buf_end  = in->data + in->size;
         ^
186. 
187.     do {

libavcodec/h264_mp4toannexb_bsf.c:188:13: Taking false branch
186. 
187.     do {
188.         if (buf + s->length_size > buf_end)
                 ^
189.             goto fail;
190. 

libavcodec/h264_mp4toannexb_bsf.c:191:13: Taking false branch
189.             goto fail;
190. 
191.         if (s->length_size == 1) {
                 ^
192.             nal_size = buf[0];
193.         } else if (s->length_size == 2) {

libavcodec/h264_mp4toannexb_bsf.c:193:20: Taking false branch
191.         if (s->length_size == 1) {
192.             nal_size = buf[0];
193.         } else if (s->length_size == 2) {
                        ^
194.             nal_size = AV_RB16(buf);
195.         } else

libavcodec/h264_mp4toannexb_bsf.c:196:13: 
194.             nal_size = AV_RB16(buf);
195.         } else
196.             nal_size = AV_RB32(buf);
                 ^
197. 
198.         buf += s->length_size;

libavutil/ppc/intreadwrite.h:59:1: start of procedure av_read_bswap32()
  57. }
  58. 
  59. static av_always_inline uint32_t av_read_bswap32(const void *p)
      ^
  60. {
  61.     uint32_t v;

libavutil/ppc/intreadwrite.h:62:5: Skipping __infer_skip_gcc_asm_stmt(): function or method not found
  60. {
  61.     uint32_t v;
  62.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
          ^
  63.     return v;
  64. }

libavutil/ppc/intreadwrite.h:63:5: 
  61.     uint32_t v;
  62.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
  63.     return v;
          ^
  64. }
  65. 

libavutil/ppc/intreadwrite.h:64:1: return from a call to av_read_bswap32
  62.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
  63.     return v;
  64. }
      ^
  65. 
  66. static av_always_inline void av_write_bswap32(void *p, uint32_t v)

libavcodec/h264_mp4toannexb_bsf.c:198:9: 
196.             nal_size = AV_RB32(buf);
197. 
198.         buf += s->length_size;
             ^
199.         unit_type = *buf & 0x1f;
200. 

libavcodec/h264_mp4toannexb_bsf.c:199:9: 
197. 
198.         buf += s->length_size;
199.         unit_type = *buf & 0x1f;
             ^
200. 
201.         if (buf + nal_size > buf_end || nal_size < 0)

libavcodec/h264_mp4toannexb_bsf.c:201:13: Taking false branch
199.         unit_type = *buf & 0x1f;
200. 
201.         if (buf + nal_size > buf_end || nal_size < 0)
                 ^
202.             goto fail;
203. 

libavcodec/h264_mp4toannexb_bsf.c:201:41: Taking false branch
199.         unit_type = *buf & 0x1f;
200. 
201.         if (buf + nal_size > buf_end || nal_size < 0)
                                             ^
202.             goto fail;
203. 

libavcodec/h264_mp4toannexb_bsf.c:205:13: Taking false branch
203. 
204.         /* prepend only to the first type 5 NAL unit of an IDR picture */
205.         if (s->first_idr && unit_type == 5) {
                 ^
206.             if (alloc_and_copy(out,
207.                                ctx->par_out->extradata, ctx->par_out->extradata_size,

libavcodec/h264_mp4toannexb_bsf.c:212:17: 
210.             s->first_idr = 0;
211.         } else {
212.             if (alloc_and_copy(out,
                     ^
213.                                NULL, 0, buf, nal_size) < 0)
214.                 goto fail;

libavcodec/h264_mp4toannexb_bsf.c:36:1: start of procedure alloc_and_copy()
  34. } H264BSFContext;
  35. 
  36. static int alloc_and_copy(AVPacket *out,
      ^
  37.                           const uint8_t *sps_pps, uint32_t sps_pps_size,
  38.                           const uint8_t *in, uint32_t in_size)

libavcodec/h264_mp4toannexb_bsf.c:40:5: 
  38.                           const uint8_t *in, uint32_t in_size)
  39. {
  40.     uint32_t offset         = out->size;
          ^
  41.     uint8_t nal_header_size = offset ? 3 : 4;
  42.     int err;

libavcodec/h264_mp4toannexb_bsf.c:41:31: Condition is true
  39. {
  40.     uint32_t offset         = out->size;
  41.     uint8_t nal_header_size = offset ? 3 : 4;
                                    ^
  42.     int err;
  43. 

libavcodec/h264_mp4toannexb_bsf.c:41:5: 
  39. {
  40.     uint32_t offset         = out->size;
  41.     uint8_t nal_header_size = offset ? 3 : 4;
          ^
  42.     int err;
  43. 

libavcodec/h264_mp4toannexb_bsf.c:44:5: 
  42.     int err;
  43. 
  44.     err = av_grow_packet(out, sps_pps_size + in_size + nal_header_size);
          ^
  45.     if (err < 0)
  46.         return err;

libavcodec/avpacket.c:107:1: start of procedure av_grow_packet()
    105. }
    106. 
    107. int av_grow_packet(AVPacket *pkt, int grow_by)
         ^
    108. {
    109.     int new_size;

libavcodec/avpacket.c:110:5: Taking false branch
    108. {
    109.     int new_size;
    110.     av_assert0((unsigned)pkt->size <= INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE);
             ^
    111.     if (!pkt->size)
    112.         return av_new_packet(pkt, grow_by);

libavcodec/avpacket.c:110:5: Loop condition is false. Leaving loop
    108. {
    109.     int new_size;
    110.     av_assert0((unsigned)pkt->size <= INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE);
             ^
    111.     if (!pkt->size)
    112.         return av_new_packet(pkt, grow_by);

libavcodec/avpacket.c:111:10: Taking false branch
    109.     int new_size;
    110.     av_assert0((unsigned)pkt->size <= INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE);
    111.     if (!pkt->size)
                  ^
    112.         return av_new_packet(pkt, grow_by);
    113.     if ((unsigned)grow_by >

libavcodec/avpacket.c:113:9: Taking false branch
    111.     if (!pkt->size)
    112.         return av_new_packet(pkt, grow_by);
    113.     if ((unsigned)grow_by >
                 ^
    114.         INT_MAX - (pkt->size + AV_INPUT_BUFFER_PADDING_SIZE))
    115.         return -1;

libavcodec/avpacket.c:117:5: 
    115.         return -1;
    116. 
    117.     new_size = pkt->size + grow_by + AV_INPUT_BUFFER_PADDING_SIZE;
             ^
    118.     if (pkt->buf) {
    119.         int ret = av_buffer_realloc(&pkt->buf, new_size);

libavcodec/avpacket.c:118:9: Taking true branch
    116. 
    117.     new_size = pkt->size + grow_by + AV_INPUT_BUFFER_PADDING_SIZE;
    118.     if (pkt->buf) {
                 ^
    119.         int ret = av_buffer_realloc(&pkt->buf, new_size);
    120.         if (ret < 0)

libavcodec/avpacket.c:119:9: 
    117.     new_size = pkt->size + grow_by + AV_INPUT_BUFFER_PADDING_SIZE;
    118.     if (pkt->buf) {
    119.         int ret = av_buffer_realloc(&pkt->buf, new_size);
                 ^
    120.         if (ret < 0)
    121.             return ret;

libavutil/buffer.c:148:1: start of procedure av_buffer_realloc()
      146. }
      147. 
      148. int av_buffer_realloc(AVBufferRef **pbuf, int size)
           ^
      149. {
      150.     AVBufferRef *buf = *pbuf;

libavutil/buffer.c:150:5: 
      148. int av_buffer_realloc(AVBufferRef **pbuf, int size)
      149. {
      150.     AVBufferRef *buf = *pbuf;
               ^
      151.     uint8_t *tmp;
      152. 

libavutil/buffer.c:153:10: Taking false branch
      151.     uint8_t *tmp;
      152. 
      153.     if (!buf) {
                    ^
      154.         /* allocate a new buffer with av_realloc(), so it will be reallocatable
      155.          * later */

libavutil/buffer.c:170:16: Taking false branch
      168. 
      169.         return 0;
      170.     } else if (buf->size == size)
                          ^
      171.         return 0;
      172. 

libavutil/buffer.c:173:11: Taking false branch
      171.         return 0;
      172. 
      173.     if (!(buf->buffer->flags & BUFFER_FLAG_REALLOCATABLE) ||
                     ^
      174.         !av_buffer_is_writable(buf) || buf->data != buf->buffer->data) {
      175.         /* cannot realloc, allocate a new reallocable buffer and copy data */

libavutil/buffer.c:174:10: 
      172. 
      173.     if (!(buf->buffer->flags & BUFFER_FLAG_REALLOCATABLE) ||
      174.         !av_buffer_is_writable(buf) || buf->data != buf->buffer->data) {
                    ^
      175.         /* cannot realloc, allocate a new reallocable buffer and copy data */
      176.         AVBufferRef *new = NULL;

libavutil/buffer.c:122:1: start of procedure av_buffer_is_writable()
        120. }
        121. 
        122. int av_buffer_is_writable(const AVBufferRef *buf)
             ^
        123. {
        124.     if (buf->buffer->flags & AV_BUFFER_FLAG_READONLY)

libavutil/buffer.c:124:9: Taking false branch
        122. int av_buffer_is_writable(const AVBufferRef *buf)
        123. {
        124.     if (buf->buffer->flags & AV_BUFFER_FLAG_READONLY)
                     ^
        125.         return 0;
        126. 

libavutil/buffer.c:127:12: Condition is true
        125.         return 0;
        126. 
        127.     return atomic_load(&buf->buffer->refcount) == 1;
                        ^
        128. }
        129. 

libavutil/buffer.c:127:5: 
        125.         return 0;
        126. 
        127.     return atomic_load(&buf->buffer->refcount) == 1;
                 ^
        128. }
        129. 

libavutil/buffer.c:128:1: return from a call to av_buffer_is_writable
        126. 
        127.     return atomic_load(&buf->buffer->refcount) == 1;
        128. }
             ^
        129. 
        130. int av_buffer_make_writable(AVBufferRef **pbuf)

libavutil/buffer.c:174:10: Taking false branch
      172. 
      173.     if (!(buf->buffer->flags & BUFFER_FLAG_REALLOCATABLE) ||
      174.         !av_buffer_is_writable(buf) || buf->data != buf->buffer->data) {
                    ^
      175.         /* cannot realloc, allocate a new reallocable buffer and copy data */
      176.         AVBufferRef *new = NULL;

libavutil/buffer.c:174:40: Taking false branch
      172. 
      173.     if (!(buf->buffer->flags & BUFFER_FLAG_REALLOCATABLE) ||
      174.         !av_buffer_is_writable(buf) || buf->data != buf->buffer->data) {
                                                  ^
      175.         /* cannot realloc, allocate a new reallocable buffer and copy data */
      176.         AVBufferRef *new = NULL;

libavutil/buffer.c:189:5: 
      187.     }
      188. 
      189.     tmp = av_realloc(buf->buffer->data, size);
               ^
      190.     if (!tmp)
      191.         return AVERROR(ENOMEM);

libavutil/mem.c:107:1: start of procedure av_realloc()
        105. }
        106. 
        107. void *av_realloc(void *ptr, size_t size)
             ^
        108. {
        109.     /* let's disallow possibly ambiguous cases */

libavutil/mem.c:110:9: Taking false branch
        108. {
        109.     /* let's disallow possibly ambiguous cases */
        110.     if (size > (INT_MAX - 16))
                     ^
        111.         return NULL;
        112. 

libavutil/mem.c:116:5: 
        114.     return _aligned_realloc(ptr, size, 32);
        115. #else
        116.     return realloc(ptr, size);
                 ^
        117. #endif
        118. }

libavutil/mem.c:118:1: return from a call to av_realloc
        116.     return realloc(ptr, size);
        117. #endif
        118. }
             ^
        119. 
        120. int av_reallocp(void *ptr, size_t size)

libavutil/buffer.c:190:10: Taking false branch
      188. 
      189.     tmp = av_realloc(buf->buffer->data, size);
      190.     if (!tmp)
                    ^
      191.         return AVERROR(ENOMEM);
      192. 

libavutil/buffer.c:193:5: 
      191.         return AVERROR(ENOMEM);
      192. 
      193.     buf->buffer->data = buf->data = tmp;
               ^
      194.     buf->buffer->size = buf->size = size;
      195.     return 0;

libavutil/buffer.c:194:5: 
      192. 
      193.     buf->buffer->data = buf->data = tmp;
      194.     buf->buffer->size = buf->size = size;
               ^
      195.     return 0;
      196. }

libavutil/buffer.c:195:5: 
      193.     buf->buffer->data = buf->data = tmp;
      194.     buf->buffer->size = buf->size = size;
      195.     return 0;
               ^
      196. }
      197. 

libavutil/buffer.c:196:1: return from a call to av_buffer_realloc
      194.     buf->buffer->size = buf->size = size;
      195.     return 0;
      196. }
           ^
      197. 
      198. AVBufferPool *av_buffer_pool_init2(int size, void *opaque,

libavcodec/avpacket.c:120:13: Taking false branch
    118.     if (pkt->buf) {
    119.         int ret = av_buffer_realloc(&pkt->buf, new_size);
    120.         if (ret < 0)
                     ^
    121.             return ret;
    122.     } else {

libavcodec/avpacket.c:128:5: 
    126.         memcpy(pkt->buf->data, pkt->data, FFMIN(pkt->size, pkt->size + grow_by));
    127.     }
    128.     pkt->data  = pkt->buf->data;
             ^
    129.     pkt->size += grow_by;
    130.     memset(pkt->data + pkt->size, 0, AV_INPUT_BUFFER_PADDING_SIZE);

libavcodec/avpacket.c:129:5: 
    127.     }
    128.     pkt->data  = pkt->buf->data;
    129.     pkt->size += grow_by;
             ^
    130.     memset(pkt->data + pkt->size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
    131. 

libavcodec/avpacket.c:130:5: 
    128.     pkt->data  = pkt->buf->data;
    129.     pkt->size += grow_by;
    130.     memset(pkt->data + pkt->size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
             ^
    131. 
    132.     return 0;

libavcodec/avpacket.c:132:5: 
    130.     memset(pkt->data + pkt->size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
    131. 
    132.     return 0;
             ^
    133. }
    134. 

libavcodec/avpacket.c:133:1: return from a call to av_grow_packet
    131. 
    132.     return 0;
    133. }
         ^
    134. 
    135. int av_packet_from_data(AVPacket *pkt, uint8_t *data, int size)

libavcodec/h264_mp4toannexb_bsf.c:45:9: Taking false branch
  43. 
  44.     err = av_grow_packet(out, sps_pps_size + in_size + nal_header_size);
  45.     if (err < 0)
              ^
  46.         return err;
  47. 

libavcodec/h264_mp4toannexb_bsf.c:48:9: Taking true branch
  46.         return err;
  47. 
  48.     if (sps_pps)
              ^
  49.         memcpy(out->data + offset, sps_pps, sps_pps_size);
  50.     memcpy(out->data + sps_pps_size + nal_header_size + offset, in, in_size);

libavcodec/h264_mp4toannexb_bsf.c:49:9: 
  47. 
  48.     if (sps_pps)
  49.         memcpy(out->data + offset, sps_pps, sps_pps_size);
              ^
  50.     memcpy(out->data + sps_pps_size + nal_header_size + offset, in, in_size);
  51.     if (!offset) {

libavcodec/h264_mp4toannexb_bsf.c:50:5: 
  48.     if (sps_pps)
  49.         memcpy(out->data + offset, sps_pps, sps_pps_size);
  50.     memcpy(out->data + sps_pps_size + nal_header_size + offset, in, in_size);
          ^
  51.     if (!offset) {
  52.         AV_WB32(out->data + sps_pps_size, 1);

libavcodec/h264_mp4toannexb_bsf.c:51:10: Taking false branch
  49.         memcpy(out->data + offset, sps_pps, sps_pps_size);
  50.     memcpy(out->data + sps_pps_size + nal_header_size + offset, in, in_size);
  51.     if (!offset) {
               ^
  52.         AV_WB32(out->data + sps_pps_size, 1);
  53.     } else {

libavcodec/h264_mp4toannexb_bsf.c:54:9: 
  52.         AV_WB32(out->data + sps_pps_size, 1);
  53.     } else {
  54.         (out->data + offset + sps_pps_size)[0] =
              ^
  55.         (out->data + offset + sps_pps_size)[1] = 0;
  56.         (out->data + offset + sps_pps_size)[2] = 1;

libavcodec/h264_mp4toannexb_bsf.c:56:9: 
  54.         (out->data + offset + sps_pps_size)[0] =
  55.         (out->data + offset + sps_pps_size)[1] = 0;
  56.         (out->data + offset + sps_pps_size)[2] = 1;
              ^
  57.     }
  58. 

libavcodec/h264_mp4toannexb_bsf.c:59:5: 
  57.     }
  58. 
  59.     return 0;
          ^
  60. }
  61. 

libavcodec/h264_mp4toannexb_bsf.c:60:1: return from a call to alloc_and_copy
  58. 
  59.     return 0;
  60. }
      ^
  61. 
  62. static int h264_extradata_to_annexb(AVBSFContext *ctx, const int padding)
