libavformat/rdt.c:139: error: Null Dereference
  pointer `pb` last assigned on line 138 could be null and is dereferenced by call to `get_le32()` at line 139, column 11.

libavformat/rdt.c:115:1: start of procedure rdt_load_mdpr()
113. }
114. 
115. static int
     ^
116. rdt_load_mdpr (PayloadContext *rdt, AVStream *st, int rule_nr)
117. {

libavformat/rdt.c:136:10: Taking false branch
134.      * the RM demuxer to parse the stream-specific header data.
135.      */
136.     if (!rdt->mlti_data)
              ^
137.         return -1;
138.     url_open_buf(&pb, rdt->mlti_data, rdt->mlti_data_size, URL_RDONLY);

libavformat/rdt.c:138:5: 
136.     if (!rdt->mlti_data)
137.         return -1;
138.     url_open_buf(&pb, rdt->mlti_data, rdt->mlti_data_size, URL_RDONLY);
         ^
139.     tag = get_le32(pb);
140.     if (tag == MKTAG('M', 'L', 'T', 'I')) {

libavformat/aviobuf.c:682:1: start of procedure url_open_buf()
  680. #if defined(CONFIG_MUXERS) || defined(CONFIG_NETWORK)
  681. /* buffer handling */
  682. int url_open_buf(ByteIOContext **s, uint8_t *buf, int buf_size, int flags)
       ^
  683. {
  684.     int ret;

libavformat/aviobuf.c:685:5: 
  683. {
  684.     int ret;
  685.     *s = av_mallocz(sizeof(ByteIOContext));
           ^
  686.     if(!*s)
  687.         return AVERROR(ENOMEM);

libavutil/mem.c:132:1: start of procedure av_mallocz()
    130. }
    131. 
    132. void *av_mallocz(unsigned int size)
         ^
    133. {
    134.     void *ptr = av_malloc(size);

libavutil/mem.c:134:5: 
    132. void *av_mallocz(unsigned int size)
    133. {
    134.     void *ptr = av_malloc(size);
             ^
    135.     if (ptr)
    136.         memset(ptr, 0, size);

libavutil/mem.c:42:1: start of procedure av_malloc()
      40.    linker will do it automatically */
      41. 
      42. void *av_malloc(unsigned int size)
          ^
      43. {
      44.     void *ptr;

libavutil/mem.c:50:8: Taking false branch
      48. 
      49.     /* let's disallow possible ambiguous cases */
      50.     if(size > (INT_MAX-16) )
                 ^
      51.         return NULL;
      52. 

libavutil/mem.c:61:5: Skipping memalign(): method has no implementation
      59.     ((char*)ptr)[-1]= diff;
      60. #elif defined (HAVE_MEMALIGN)
      61.     ptr = memalign(16,size);
              ^
      62.     /* Why 64?
      63.        Indeed, we should align it:

libavutil/mem.c:91:5: 
      89.     ptr = malloc(size);
      90. #endif
      91.     return ptr;
              ^
      92. }
      93. 

libavutil/mem.c:92:1: return from a call to av_malloc
      90. #endif
      91.     return ptr;
      92. }
          ^
      93. 
      94. void *av_realloc(void *ptr, unsigned int size)

libavutil/mem.c:135:9: Taking true branch
    133. {
    134.     void *ptr = av_malloc(size);
    135.     if (ptr)
                 ^
    136.         memset(ptr, 0, size);
    137.     return ptr;

libavutil/mem.c:136:9: 
    134.     void *ptr = av_malloc(size);
    135.     if (ptr)
    136.         memset(ptr, 0, size);
                 ^
    137.     return ptr;
    138. }

libavutil/mem.c:137:5: 
    135.     if (ptr)
    136.         memset(ptr, 0, size);
    137.     return ptr;
             ^
    138. }
    139. 

libavutil/mem.c:138:1: return from a call to av_mallocz
    136.         memset(ptr, 0, size);
    137.     return ptr;
    138. }
         ^
    139. 
    140. char *av_strdup(const char *s)

libavformat/aviobuf.c:686:9: Taking false branch
  684.     int ret;
  685.     *s = av_mallocz(sizeof(ByteIOContext));
  686.     if(!*s)
               ^
  687.         return AVERROR(ENOMEM);
  688.     ret = init_put_byte(*s, buf, buf_size,

libavformat/aviobuf.c:689:26: Condition is true
  687.         return AVERROR(ENOMEM);
  688.     ret = init_put_byte(*s, buf, buf_size,
  689.                         (flags & URL_WRONLY || flags & URL_RDWR),
                                ^
  690.                         NULL, NULL, NULL, NULL);
  691.     if(ret != 0)

libavformat/aviobuf.c:688:5: Skipping init_put_byte(): empty list of specs
  686.     if(!*s)
  687.         return AVERROR(ENOMEM);
  688.     ret = init_put_byte(*s, buf, buf_size,
           ^
  689.                         (flags & URL_WRONLY || flags & URL_RDWR),
  690.                         NULL, NULL, NULL, NULL);

libavformat/aviobuf.c:691:8: Taking true branch
  689.                         (flags & URL_WRONLY || flags & URL_RDWR),
  690.                         NULL, NULL, NULL, NULL);
  691.     if(ret != 0)
              ^
  692.         av_freep(s);
  693.     return ret;

libavformat/aviobuf.c:692:9: 
  690.                         NULL, NULL, NULL, NULL);
  691.     if(ret != 0)
  692.         av_freep(s);
               ^
  693.     return ret;
  694. }

libavutil/mem.c:125:1: start of procedure av_freep()
    123. }
    124. 
    125. void av_freep(void *arg)
         ^
    126. {
    127.     void **ptr= (void**)arg;

libavutil/mem.c:127:5: 
    125. void av_freep(void *arg)
    126. {
    127.     void **ptr= (void**)arg;
             ^
    128.     av_free(*ptr);
    129.     *ptr = NULL;

libavutil/mem.c:128:5: 
    126. {
    127.     void **ptr= (void**)arg;
    128.     av_free(*ptr);
             ^
    129.     *ptr = NULL;
    130. }

libavutil/mem.c:114:1: start of procedure av_free()
      112. }
      113. 
      114. void av_free(void *ptr)
           ^
      115. {
      116.     /* XXX: this test should not be needed on most libcs */

libavutil/mem.c:117:9: Taking true branch
      115. {
      116.     /* XXX: this test should not be needed on most libcs */
      117.     if (ptr)
                   ^
      118. #ifdef CONFIG_MEMALIGN_HACK
      119.         free((char*)ptr - ((char*)ptr)[-1]);

libavutil/mem.c:121:9: 
      119.         free((char*)ptr - ((char*)ptr)[-1]);
      120. #else
      121.         free(ptr);
                   ^
      122. #endif
      123. }

libavutil/mem.c:117:5: 
      115. {
      116.     /* XXX: this test should not be needed on most libcs */
      117.     if (ptr)
               ^
      118. #ifdef CONFIG_MEMALIGN_HACK
      119.         free((char*)ptr - ((char*)ptr)[-1]);

libavutil/mem.c:123:1: return from a call to av_free
      121.         free(ptr);
      122. #endif
      123. }
           ^
      124. 
      125. void av_freep(void *arg)

libavutil/mem.c:129:5: 
    127.     void **ptr= (void**)arg;
    128.     av_free(*ptr);
    129.     *ptr = NULL;
             ^
    130. }
    131. 

libavutil/mem.c:130:1: return from a call to av_freep
    128.     av_free(*ptr);
    129.     *ptr = NULL;
    130. }
         ^
    131. 
    132. void *av_mallocz(unsigned int size)

libavformat/aviobuf.c:693:5: 
  691.     if(ret != 0)
  692.         av_freep(s);
  693.     return ret;
           ^
  694. }
  695. 

libavformat/aviobuf.c:694:1: return from a call to url_open_buf
  692.         av_freep(s);
  693.     return ret;
  694. }
       ^
  695. 
  696. int url_close_buf(ByteIOContext *s)

libavformat/rdt.c:139:5: 
137.         return -1;
138.     url_open_buf(&pb, rdt->mlti_data, rdt->mlti_data_size, URL_RDONLY);
139.     tag = get_le32(pb);
         ^
140.     if (tag == MKTAG('M', 'L', 'T', 'I')) {
141.         int num, chunk_nr;

libavformat/aviobuf.c:443:1: start of procedure get_le32()
  441. }
  442. 
  443. unsigned int get_le32(ByteIOContext *s)
       ^
  444. {
  445.     unsigned int val;

libavformat/aviobuf.c:446:5: 
  444. {
  445.     unsigned int val;
  446.     val = get_le16(s);
           ^
  447.     val |= get_le16(s) << 16;
  448.     return val;

libavformat/aviobuf.c:427:1: start of procedure get_le16()
    425. }
    426. 
    427. unsigned int get_le16(ByteIOContext *s)
         ^
    428. {
    429.     unsigned int val;

libavformat/aviobuf.c:430:5: 
    428. {
    429.     unsigned int val;
    430.     val = get_byte(s);
             ^
    431.     val |= get_byte(s) << 8;
    432.     return val;

libavformat/aviobuf.c:339:1: start of procedure get_byte()
      337. 
      338. /* XXX: put an inline version */
      339. int get_byte(ByteIOContext *s)
           ^
      340. {
      341.     if (s->buf_ptr < s->buf_end) {

libavformat/aviobuf.c:341:9: Taking true branch
      339. int get_byte(ByteIOContext *s)
      340. {
      341.     if (s->buf_ptr < s->buf_end) {
                   ^
      342.         return *s->buf_ptr++;
      343.     } else {

libavformat/aviobuf.c:342:9: 
      340. {
      341.     if (s->buf_ptr < s->buf_end) {
      342.         return *s->buf_ptr++;
                   ^
      343.     } else {
      344.         fill_buffer(s);

libavformat/aviobuf.c:350:1: return from a call to get_byte
      348.             return 0;
      349.     }
      350. }
           ^
      351. 
      352. int url_fgetc(ByteIOContext *s)

libavformat/aviobuf.c:431:5: 
    429.     unsigned int val;
    430.     val = get_byte(s);
    431.     val |= get_byte(s) << 8;
             ^
    432.     return val;
    433. }

libavformat/aviobuf.c:339:1: start of procedure get_byte()
      337. 
      338. /* XXX: put an inline version */
      339. int get_byte(ByteIOContext *s)
           ^
      340. {
      341.     if (s->buf_ptr < s->buf_end) {

libavformat/aviobuf.c:341:9: Taking true branch
      339. int get_byte(ByteIOContext *s)
      340. {
      341.     if (s->buf_ptr < s->buf_end) {
                   ^
      342.         return *s->buf_ptr++;
      343.     } else {

libavformat/aviobuf.c:342:9: 
      340. {
      341.     if (s->buf_ptr < s->buf_end) {
      342.         return *s->buf_ptr++;
                   ^
      343.     } else {
      344.         fill_buffer(s);

libavformat/aviobuf.c:350:1: return from a call to get_byte
      348.             return 0;
      349.     }
      350. }
           ^
      351. 
      352. int url_fgetc(ByteIOContext *s)

libavformat/aviobuf.c:432:5: 
    430.     val = get_byte(s);
    431.     val |= get_byte(s) << 8;
    432.     return val;
             ^
    433. }
    434. 

libavformat/aviobuf.c:433:1: return from a call to get_le16
    431.     val |= get_byte(s) << 8;
    432.     return val;
    433. }
         ^
    434. 
    435. unsigned int get_le24(ByteIOContext *s)

libavformat/aviobuf.c:447:5: 
  445.     unsigned int val;
  446.     val = get_le16(s);
  447.     val |= get_le16(s) << 16;
           ^
  448.     return val;
  449. }

libavformat/aviobuf.c:427:1: start of procedure get_le16()
    425. }
    426. 
    427. unsigned int get_le16(ByteIOContext *s)
         ^
    428. {
    429.     unsigned int val;

libavformat/aviobuf.c:430:5: 
    428. {
    429.     unsigned int val;
    430.     val = get_byte(s);
             ^
    431.     val |= get_byte(s) << 8;
    432.     return val;

libavformat/aviobuf.c:339:1: start of procedure get_byte()
      337. 
      338. /* XXX: put an inline version */
      339. int get_byte(ByteIOContext *s)
           ^
      340. {
      341.     if (s->buf_ptr < s->buf_end) {

libavformat/aviobuf.c:341:9: Taking true branch
      339. int get_byte(ByteIOContext *s)
      340. {
      341.     if (s->buf_ptr < s->buf_end) {
                   ^
      342.         return *s->buf_ptr++;
      343.     } else {

libavformat/aviobuf.c:342:9: 
      340. {
      341.     if (s->buf_ptr < s->buf_end) {
      342.         return *s->buf_ptr++;
                   ^
      343.     } else {
      344.         fill_buffer(s);

libavformat/aviobuf.c:350:1: return from a call to get_byte
      348.             return 0;
      349.     }
      350. }
           ^
      351. 
      352. int url_fgetc(ByteIOContext *s)

libavformat/aviobuf.c:431:5: 
    429.     unsigned int val;
    430.     val = get_byte(s);
    431.     val |= get_byte(s) << 8;
             ^
    432.     return val;
    433. }

libavformat/aviobuf.c:339:1: start of procedure get_byte()
      337. 
      338. /* XXX: put an inline version */
      339. int get_byte(ByteIOContext *s)
           ^
      340. {
      341.     if (s->buf_ptr < s->buf_end) {

libavformat/aviobuf.c:341:9: 
      339. int get_byte(ByteIOContext *s)
      340. {
      341.     if (s->buf_ptr < s->buf_end) {
                   ^
      342.         return *s->buf_ptr++;
      343.     } else {
