libavformat/movenchint.c:244: error: Use After Free
  call to `sample_queue_pop()` eventually accesses memory that was invalidated by call to `free()` on line 244 indirectly during the call to `sample_queue_pop()`.

libavformat/movenchint.c:215:1: invalidation part of the trace starts here
213.  * @return 0 if a match was found, < 0 if no match was found
214.  */
215. static int find_sample_match(const uint8_t *data, int len,
     ^
216.                              HintSampleQueue *queue, int *pos,
217.                              int *match_sample, int *match_offset,

libavformat/movenchint.c:215:1: parameter `queue` of find_sample_match
  213.  * @return 0 if a match was found, < 0 if no match was found
  214.  */
  215. static int find_sample_match(const uint8_t *data, int len,
       ^
  216.                              HintSampleQueue *queue, int *pos,
  217.                              int *match_sample, int *match_offset,

libavformat/movenchint.c:244:13: when calling `sample_queue_pop` here
  242.         } else {
  243.             /* No match for this sample, remove it */
  244.             sample_queue_pop(queue);
                   ^
  245.         }
  246.     }

libavformat/movenchint.c:70:1: parameter `queue` of sample_queue_pop
    68.  * Remove the first sample from the sample queue.
    69.  */
    70. static void sample_queue_pop(HintSampleQueue *queue)
        ^
    71. {
    72.     if (queue->len <= 0)

libavformat/movenchint.c:75:9: when calling `av_free` here
    73.         return;
    74.     if (queue->samples[0].own_data)
    75.         av_free(queue->samples[0].data);
                ^
    76.     queue->len--;
    77.     memmove(queue->samples, queue->samples + 1, sizeof(HintSample)*queue->len);

libavutil/mem.c:137:1: parameter `ptr` of av_free
      135. }
      136. 
      137. void av_free(void *ptr)
           ^
      138. {
      139. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:143:5: was invalidated by call to `free()`
      141.         free((char*)ptr - ((char*)ptr)[-1]);
      142. #else
      143.     free(ptr);
               ^
      144. #endif
      145. }

libavformat/movenchint.c:215:1: use-after-lifetime part of the trace starts here
213.  * @return 0 if a match was found, < 0 if no match was found
214.  */
215. static int find_sample_match(const uint8_t *data, int len,
     ^
216.                              HintSampleQueue *queue, int *pos,
217.                              int *match_sample, int *match_offset,

libavformat/movenchint.c:215:1: parameter `queue` of find_sample_match
  213.  * @return 0 if a match was found, < 0 if no match was found
  214.  */
  215. static int find_sample_match(const uint8_t *data, int len,
       ^
  216.                              HintSampleQueue *queue, int *pos,
  217.                              int *match_sample, int *match_offset,

libavformat/movenchint.c:244:13: when calling `sample_queue_pop` here
  242.         } else {
  243.             /* No match for this sample, remove it */
  244.             sample_queue_pop(queue);
                   ^
  245.         }
  246.     }

libavformat/movenchint.c:70:1: parameter `queue` of sample_queue_pop
    68.  * Remove the first sample from the sample queue.
    69.  */
    70. static void sample_queue_pop(HintSampleQueue *queue)
        ^
    71. {
    72.     if (queue->len <= 0)

libavformat/movenchint.c:75:9: when calling `av_free` here
    73.         return;
    74.     if (queue->samples[0].own_data)
    75.         av_free(queue->samples[0].data);
                ^
    76.     queue->len--;
    77.     memmove(queue->samples, queue->samples + 1, sizeof(HintSample)*queue->len);

libavutil/mem.c:137:1: parameter `ptr` of av_free
      135. }
      136. 
      137. void av_free(void *ptr)
           ^
      138. {
      139. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:143:5: invalid access occurs here
      141.         free((char*)ptr - ((char*)ptr)[-1]);
      142. #else
      143.     free(ptr);
               ^
      144. #endif
      145. }

void av_free(void *ptr)
{
#if CONFIG_MEMALIGN_HACK
    if (ptr)
        free((char*)ptr - ((char*)ptr)[-1]);
#else
    free(ptr);
#endif
}
['static int find_sample_match(const uint8_t *data, int len,\n                             HintSampleQueue *queue, int *pos,\n                             int *match_sample, int *match_offset,\n                             int *match_len)\n{\n    while (queue->len > 0) {\n        HintSample *sample = &queue->samples[0];\n        if (sample->offset == 0 && sample->size > 5)\n            sample->offset = 5;\n        if (match_segments(data, len, sample->data, sample->offset,\n                           sample->size, pos, match_offset, match_len) == 0) {\n            *match_sample = sample->sample_number;\n            sample->offset = *match_offset + *match_len + 5;\n            if (sample->offset + 10 >= sample->size)\n                sample_queue_pop(queue);\n            return 0;\n        }\n        if (sample->offset < 10 && sample->size > 20) {\n            sample->offset = sample->size/2;\n        } else {\n            sample_queue_pop(queue);\n        }\n    }\n    return -1;\n}', 'static void sample_queue_pop(HintSampleQueue *queue)\n{\n    if (queue->len <= 0)\n        return;\n    if (queue->samples[0].own_data)\n        av_free(queue->samples[0].data);\n    queue->len--;\n    memmove(queue->samples, queue->samples + 1, sizeof(HintSample)*queue->len);\n}', 'void av_free(void *ptr)\n{\n#if CONFIG_MEMALIGN_HACK\n    if (ptr)\n        free((char*)ptr - ((char*)ptr)[-1]);\n#else\n    free(ptr);\n#endif\n}']