libavfilter/af_channelmap.c:351: error: Use After Free
  accessing memory that was invalidated by call to `free()` on line 342 indirectly during the call to `av_free()`.

libavfilter/af_channelmap.c:333:17: invalidation part of the trace starts here
331.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
332.             uint8_t **new_extended_data =
333.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                     ^
334.             if (!new_extended_data) {
335.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:333:17: passed as argument to `av_mallocz`
  331.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  332.             uint8_t **new_extended_data =
  333.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                       ^
  334.             if (!new_extended_data) {
  335.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:333:17: return from call to `av_mallocz`
  331.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  332.             uint8_t **new_extended_data =
  333.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                       ^
  334.             if (!new_extended_data) {
  335.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:332:13: assigned
  330.     if (nch_out > nch_in) {
  331.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  332.             uint8_t **new_extended_data =
                   ^
  333.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
  334.             if (!new_extended_data) {

libavfilter/af_channelmap.c:341:17: assigned
  339.                 buf->extended_data = new_extended_data;
  340.             } else {
  341.                 buf->extended_data = new_extended_data;
                       ^
  342.                 av_free(buf->extended_data);
  343.             }

libavfilter/af_channelmap.c:342:17: when calling `av_free` here
  340.             } else {
  341.                 buf->extended_data = new_extended_data;
  342.                 av_free(buf->extended_data);
                       ^
  343.             }
  344.         } else if (buf->extended_data != buf->data) {

libavutil/mem.c:141:1: parameter `ptr` of av_free
    139. }
    140. 
    141. void av_free(void *ptr)
         ^
    142. {
    143. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:149:5: was invalidated by call to `free()`
    147.     _aligned_free(ptr);
    148. #else
    149.     free(ptr);
             ^
    150. #endif
    151. }

libavfilter/af_channelmap.c:333:17: use-after-lifetime part of the trace starts here
331.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
332.             uint8_t **new_extended_data =
333.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                     ^
334.             if (!new_extended_data) {
335.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:333:17: passed as argument to `av_mallocz`
  331.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  332.             uint8_t **new_extended_data =
  333.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                       ^
  334.             if (!new_extended_data) {
  335.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:333:17: return from call to `av_mallocz`
  331.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  332.             uint8_t **new_extended_data =
  333.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                       ^
  334.             if (!new_extended_data) {
  335.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:332:13: assigned
  330.     if (nch_out > nch_in) {
  331.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  332.             uint8_t **new_extended_data =
                   ^
  333.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
  334.             if (!new_extended_data) {

libavfilter/af_channelmap.c:341:17: assigned
  339.                 buf->extended_data = new_extended_data;
  340.             } else {
  341.                 buf->extended_data = new_extended_data;
                       ^
  342.                 av_free(buf->extended_data);
  343.             }

libavfilter/af_channelmap.c:351:9: invalid access occurs here
  349. 
  350.     for (ch = 0; ch < nch_out; ch++) {
  351.         buf->extended_data[s->map[ch].out_channel_idx] =
               ^
  352.             source_planes[s->map[ch].in_channel_idx];
  353.     }

static int channelmap_filter_samples(AVFilterLink *inlink, AVFilterBufferRef *buf)
{
    AVFilterContext  *ctx = inlink->dst;
    AVFilterLink *outlink = ctx->outputs[0];
    const ChannelMapContext *s = ctx->priv;
    const int nch_in = av_get_channel_layout_nb_channels(inlink->channel_layout);
    const int nch_out = s->nch;
    int ch;
    uint8_t *source_planes[MAX_CH];
    memcpy(source_planes, buf->extended_data,
           nch_in * sizeof(source_planes[0]));
    if (nch_out > nch_in) {
        if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
            uint8_t **new_extended_data =
                av_mallocz(nch_out * sizeof(*buf->extended_data));
            if (!new_extended_data) {
                avfilter_unref_buffer(buf);
                return AVERROR(ENOMEM);
            }
            if (buf->extended_data == buf->data) {
                buf->extended_data = new_extended_data;
            } else {
                buf->extended_data = new_extended_data;
                av_free(buf->extended_data);
            }
        } else if (buf->extended_data != buf->data) {
            av_free(buf->extended_data);
            buf->extended_data = buf->data;
        }
    }
    for (ch = 0; ch < nch_out; ch++) {
        buf->extended_data[s->map[ch].out_channel_idx] =
            source_planes[s->map[ch].in_channel_idx];
    }
    if (buf->data != buf->extended_data)
        memcpy(buf->data, buf->extended_data,
           FFMIN(FF_ARRAY_ELEMS(buf->data), nch_out) * sizeof(buf->data[0]));
    return ff_filter_samples(outlink, buf);
}
['static int channelmap_filter_samples(AVFilterLink *inlink, AVFilterBufferRef *buf)\n{\n    AVFilterContext  *ctx = inlink->dst;\n    AVFilterLink *outlink = ctx->outputs[0];\n    const ChannelMapContext *s = ctx->priv;\n    const int nch_in = av_get_channel_layout_nb_channels(inlink->channel_layout);\n    const int nch_out = s->nch;\n    int ch;\n    uint8_t *source_planes[MAX_CH];\n    memcpy(source_planes, buf->extended_data,\n           nch_in * sizeof(source_planes[0]));\n    if (nch_out > nch_in) {\n        if (nch_out > FF_ARRAY_ELEMS(buf->data)) {\n            uint8_t **new_extended_data =\n                av_mallocz(nch_out * sizeof(*buf->extended_data));\n            if (!new_extended_data) {\n                avfilter_unref_buffer(buf);\n                return AVERROR(ENOMEM);\n            }\n            if (buf->extended_data == buf->data) {\n                buf->extended_data = new_extended_data;\n            } else {\n                buf->extended_data = new_extended_data;\n                av_free(buf->extended_data);\n            }\n        } else if (buf->extended_data != buf->data) {\n            av_free(buf->extended_data);\n            buf->extended_data = buf->data;\n        }\n    }\n    for (ch = 0; ch < nch_out; ch++) {\n        buf->extended_data[s->map[ch].out_channel_idx] =\n            source_planes[s->map[ch].in_channel_idx];\n    }\n    if (buf->data != buf->extended_data)\n        memcpy(buf->data, buf->extended_data,\n           FFMIN(FF_ARRAY_ELEMS(buf->data), nch_out) * sizeof(buf->data[0]));\n    return ff_filter_samples(outlink, buf);\n}', 'void av_free(void *ptr)\n{\n#if CONFIG_MEMALIGN_HACK\n    if (ptr)\n        free((char*)ptr - ((char*)ptr)[-1]);\n#elif HAVE_ALIGNED_MALLOC\n    _aligned_free(ptr);\n#else\n    free(ptr);\n#endif\n}']