libavformat/smacker.c:318: error: Memory Leak
  memory dynamically allocated by call to `av_reallocp()` at line 318, column 28 is not reachable after line 318, column 28.

libavformat/smacker.c:240:1: start of procedure smacker_read_packet()
238. 
239. 
240. static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
     ^
241. {
242.     SmackerContext *smk = s->priv_data;

libavformat/smacker.c:242:5: 
240. static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
241. {
242.     SmackerContext *smk = s->priv_data;
         ^
243.     int flags;
244.     int ret;

libavformat/smacker.c:246:5: 
244.     int ret;
245.     int i;
246.     int frame_size = 0;
         ^
247.     int palchange = 0;
248. 

libavformat/smacker.c:247:5: 
245.     int i;
246.     int frame_size = 0;
247.     int palchange = 0;
         ^
248. 
249.     if (s->pb->eof_reached || smk->cur_frame >= smk->frames)

libavformat/smacker.c:249:9: Taking false branch
247.     int palchange = 0;
248. 
249.     if (s->pb->eof_reached || smk->cur_frame >= smk->frames)
             ^
250.         return AVERROR_EOF;
251. 

libavformat/smacker.c:249:31: Taking false branch
247.     int palchange = 0;
248. 
249.     if (s->pb->eof_reached || smk->cur_frame >= smk->frames)
                                   ^
250.         return AVERROR_EOF;
251. 

libavformat/smacker.c:253:8: Taking true branch
251. 
252.     /* if we demuxed all streams, pass another frame */
253.     if(smk->curstream < 0) {
            ^
254.         avio_seek(s->pb, smk->nextpos, 0);
255.         frame_size = smk->frm_size[smk->cur_frame] & (~3);

libavformat/smacker.c:254:9: Skipping avio_seek(): empty list of specs
252.     /* if we demuxed all streams, pass another frame */
253.     if(smk->curstream < 0) {
254.         avio_seek(s->pb, smk->nextpos, 0);
             ^
255.         frame_size = smk->frm_size[smk->cur_frame] & (~3);
256.         flags = smk->frm_flags[smk->cur_frame];

libavformat/smacker.c:255:9: 
253.     if(smk->curstream < 0) {
254.         avio_seek(s->pb, smk->nextpos, 0);
255.         frame_size = smk->frm_size[smk->cur_frame] & (~3);
             ^
256.         flags = smk->frm_flags[smk->cur_frame];
257.         /* handle palette change event */

libavformat/smacker.c:256:9: 
254.         avio_seek(s->pb, smk->nextpos, 0);
255.         frame_size = smk->frm_size[smk->cur_frame] & (~3);
256.         flags = smk->frm_flags[smk->cur_frame];
             ^
257.         /* handle palette change event */
258.         if(flags & SMACKER_PAL){

libavformat/smacker.c:258:12: Taking false branch
256.         flags = smk->frm_flags[smk->cur_frame];
257.         /* handle palette change event */
258.         if(flags & SMACKER_PAL){
                ^
259.             int size, sz, t, off, j, pos;
260.             uint8_t *pal = smk->pal;

libavformat/smacker.c:302:9: 
300.             palchange |= 1;
301.         }
302.         flags >>= 1;
             ^
303.         smk->curstream = -1;
304.         /* if audio chunks are present, put them to stack and retrieve later */

libavformat/smacker.c:303:9: 
301.         }
302.         flags >>= 1;
303.         smk->curstream = -1;
             ^
304.         /* if audio chunks are present, put them to stack and retrieve later */
305.         for(i = 0; i < 7; i++) {

libavformat/smacker.c:305:13: 
303.         smk->curstream = -1;
304.         /* if audio chunks are present, put them to stack and retrieve later */
305.         for(i = 0; i < 7; i++) {
                 ^
306.             if(flags & 1) {
307.                 uint32_t size;

libavformat/smacker.c:305:20: Loop condition is true. Entering loop body
303.         smk->curstream = -1;
304.         /* if audio chunks are present, put them to stack and retrieve later */
305.         for(i = 0; i < 7; i++) {
                        ^
306.             if(flags & 1) {
307.                 uint32_t size;

libavformat/smacker.c:306:16: Taking true branch
304.         /* if audio chunks are present, put them to stack and retrieve later */
305.         for(i = 0; i < 7; i++) {
306.             if(flags & 1) {
                    ^
307.                 uint32_t size;
308.                 int err;

libavformat/smacker.c:310:17: 
308.                 int err;
309. 
310.                 size = avio_rl32(s->pb) - 4;
                     ^
311.                 if (!size || size > frame_size) {
312.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");

libavformat/aviobuf.c:558:1: start of procedure avio_rl32()
  556. }
  557. 
  558. unsigned int avio_rl32(AVIOContext *s)
       ^
  559. {
  560.     unsigned int val;

libavformat/aviobuf.c:561:5: 
  559. {
  560.     unsigned int val;
  561.     val = avio_rl16(s);
           ^
  562.     val |= avio_rl16(s) << 16;
  563.     return val;

libavformat/aviobuf.c:542:1: start of procedure avio_rl16()
    540. }
    541. 
    542. unsigned int avio_rl16(AVIOContext *s)
         ^
    543. {
    544.     unsigned int val;

libavformat/aviobuf.c:545:5: 
    543. {
    544.     unsigned int val;
    545.     val = avio_r8(s);
             ^
    546.     val |= avio_r8(s) << 8;
    547.     return val;

libavformat/aviobuf.c:437:1: start of procedure avio_r8()
      435. 
      436. /* XXX: put an inline version */
      437. int avio_r8(AVIOContext *s)
           ^
      438. {
      439.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:439:9: Taking false branch
      437. int avio_r8(AVIOContext *s)
      438. {
      439.     if (s->buf_ptr >= s->buf_end)
                   ^
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:441:9: Taking true branch
      439.     if (s->buf_ptr >= s->buf_end)
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
                   ^
      442.         return *s->buf_ptr++;
      443.     return 0;

libavformat/aviobuf.c:442:9: 
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
                   ^
      443.     return 0;
      444. }

libavformat/aviobuf.c:444:1: return from a call to avio_r8
      442.         return *s->buf_ptr++;
      443.     return 0;
      444. }
           ^
      445. 
      446. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:546:5: 
    544.     unsigned int val;
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
             ^
    547.     return val;
    548. }

libavformat/aviobuf.c:437:1: start of procedure avio_r8()
      435. 
      436. /* XXX: put an inline version */
      437. int avio_r8(AVIOContext *s)
           ^
      438. {
      439.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:439:9: Taking false branch
      437. int avio_r8(AVIOContext *s)
      438. {
      439.     if (s->buf_ptr >= s->buf_end)
                   ^
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:441:9: Taking true branch
      439.     if (s->buf_ptr >= s->buf_end)
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
                   ^
      442.         return *s->buf_ptr++;
      443.     return 0;

libavformat/aviobuf.c:442:9: 
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
                   ^
      443.     return 0;
      444. }

libavformat/aviobuf.c:444:1: return from a call to avio_r8
      442.         return *s->buf_ptr++;
      443.     return 0;
      444. }
           ^
      445. 
      446. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:547:5: 
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
    547.     return val;
             ^
    548. }
    549. 

libavformat/aviobuf.c:548:1: return from a call to avio_rl16
    546.     val |= avio_r8(s) << 8;
    547.     return val;
    548. }
         ^
    549. 
    550. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:562:5: 
  560.     unsigned int val;
  561.     val = avio_rl16(s);
  562.     val |= avio_rl16(s) << 16;
           ^
  563.     return val;
  564. }

libavformat/aviobuf.c:542:1: start of procedure avio_rl16()
    540. }
    541. 
    542. unsigned int avio_rl16(AVIOContext *s)
         ^
    543. {
    544.     unsigned int val;

libavformat/aviobuf.c:545:5: 
    543. {
    544.     unsigned int val;
    545.     val = avio_r8(s);
             ^
    546.     val |= avio_r8(s) << 8;
    547.     return val;

libavformat/aviobuf.c:437:1: start of procedure avio_r8()
      435. 
      436. /* XXX: put an inline version */
      437. int avio_r8(AVIOContext *s)
           ^
      438. {
      439.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:439:9: Taking false branch
      437. int avio_r8(AVIOContext *s)
      438. {
      439.     if (s->buf_ptr >= s->buf_end)
                   ^
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:441:9: Taking true branch
      439.     if (s->buf_ptr >= s->buf_end)
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
                   ^
      442.         return *s->buf_ptr++;
      443.     return 0;

libavformat/aviobuf.c:442:9: 
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
                   ^
      443.     return 0;
      444. }

libavformat/aviobuf.c:444:1: return from a call to avio_r8
      442.         return *s->buf_ptr++;
      443.     return 0;
      444. }
           ^
      445. 
      446. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:546:5: 
    544.     unsigned int val;
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
             ^
    547.     return val;
    548. }

libavformat/aviobuf.c:437:1: start of procedure avio_r8()
      435. 
      436. /* XXX: put an inline version */
      437. int avio_r8(AVIOContext *s)
           ^
      438. {
      439.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:439:9: Taking false branch
      437. int avio_r8(AVIOContext *s)
      438. {
      439.     if (s->buf_ptr >= s->buf_end)
                   ^
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:441:9: Taking true branch
      439.     if (s->buf_ptr >= s->buf_end)
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
                   ^
      442.         return *s->buf_ptr++;
      443.     return 0;

libavformat/aviobuf.c:442:9: 
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
                   ^
      443.     return 0;
      444. }

libavformat/aviobuf.c:444:1: return from a call to avio_r8
      442.         return *s->buf_ptr++;
      443.     return 0;
      444. }
           ^
      445. 
      446. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:547:5: 
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
    547.     return val;
             ^
    548. }
    549. 

libavformat/aviobuf.c:548:1: return from a call to avio_rl16
    546.     val |= avio_r8(s) << 8;
    547.     return val;
    548. }
         ^
    549. 
    550. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:563:5: 
  561.     val = avio_rl16(s);
  562.     val |= avio_rl16(s) << 16;
  563.     return val;
           ^
  564. }
  565. 

libavformat/aviobuf.c:564:1: return from a call to avio_rl32
  562.     val |= avio_rl16(s) << 16;
  563.     return val;
  564. }
       ^
  565. 
  566. uint64_t avio_rl64(AVIOContext *s)

libavformat/smacker.c:311:22: Taking false branch
309. 
310.                 size = avio_rl32(s->pb) - 4;
311.                 if (!size || size > frame_size) {
                          ^
312.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");
313.                     return AVERROR_INVALIDDATA;

libavformat/smacker.c:311:30: Taking false branch
309. 
310.                 size = avio_rl32(s->pb) - 4;
311.                 if (!size || size > frame_size) {
                                  ^
312.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");
313.                     return AVERROR_INVALIDDATA;

libavformat/smacker.c:315:17: 
313.                     return AVERROR_INVALIDDATA;
314.                 }
315.                 frame_size -= size;
                     ^
316.                 frame_size -= 4;
317.                 smk->curstream++;

libavformat/smacker.c:316:17: 
314.                 }
315.                 frame_size -= size;
316.                 frame_size -= 4;
                     ^
317.                 smk->curstream++;
318.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)

libavformat/smacker.c:317:17: 
315.                 frame_size -= size;
316.                 frame_size -= 4;
317.                 smk->curstream++;
                     ^
318.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)
319.                     return err;

libavformat/smacker.c:318:21: 
316.                 frame_size -= 4;
317.                 smk->curstream++;
318.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)
                         ^
319.                     return err;
320.                 smk->buf_sizes[smk->curstream] = size;

libavutil/mem.c:139:1: start of procedure av_reallocp()
  137. }
  138. 
  139. int av_reallocp(void *ptr, size_t size)
       ^
  140. {
  141.     void **ptrptr = ptr;

libavutil/mem.c:141:5: 
  139. int av_reallocp(void *ptr, size_t size)
  140. {
  141.     void **ptrptr = ptr;
           ^
  142.     void *ret;
  143. 

libavutil/mem.c:144:5: 
  142.     void *ret;
  143. 
  144.     ret = av_realloc(*ptrptr, size);
           ^
  145. 
  146.     if (!ret) {

libavutil/mem.c:116:1: start of procedure av_realloc()
    114. }
    115. 
    116. void *av_realloc(void *ptr, size_t size)
         ^
    117. {
    118. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:123:9: Taking false branch
    121. 
    122.     /* let's disallow possibly ambiguous cases */
    123.     if (size > (INT_MAX - 16))
                 ^
    124.         return NULL;
    125. 

libavutil/mem.c:135:5: 
    133.     return _aligned_realloc(ptr, size, 32);
    134. #else
    135.     return realloc(ptr, size);
             ^
    136. #endif
    137. }

libavutil/mem.c:137:1: return from a call to av_realloc
    135.     return realloc(ptr, size);
    136. #endif
    137. }
         ^
    138. 
    139. int av_reallocp(void *ptr, size_t size)

libavutil/mem.c:146:10: Taking false branch
  144.     ret = av_realloc(*ptrptr, size);
  145. 
  146.     if (!ret) {
                ^
  147.         av_freep(ptr);
  148.         return AVERROR(ENOMEM);

libavutil/mem.c:151:5: 
  149.     }
  150. 
  151.     *ptrptr = ret;
           ^
  152.     return 0;
  153. }

libavutil/mem.c:152:5: 
  150. 
  151.     *ptrptr = ret;
  152.     return 0;
           ^
  153. }
  154. 

libavutil/mem.c:153:1: return from a call to av_reallocp
  151.     *ptrptr = ret;
  152.     return 0;
  153. }
       ^
  154. 
  155. void *av_realloc_array(void *ptr, size_t nmemb, size_t size)

libavformat/smacker.c:318:21: Taking false branch
316.                 frame_size -= 4;
317.                 smk->curstream++;
318.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)
                         ^
319.                     return err;
320.                 smk->buf_sizes[smk->curstream] = size;

libavformat/smacker.c:320:17: 
318.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)
319.                     return err;
320.                 smk->buf_sizes[smk->curstream] = size;
                     ^
321.                 ret = avio_read(s->pb, smk->bufs[smk->curstream], size);
322.                 if(ret != size)

libavformat/smacker.c:321:17: Skipping avio_read(): empty list of specs
319.                     return err;
320.                 smk->buf_sizes[smk->curstream] = size;
321.                 ret = avio_read(s->pb, smk->bufs[smk->curstream], size);
                     ^
322.                 if(ret != size)
323.                     return AVERROR(EIO);

libavformat/smacker.c:322:20: Taking false branch
320.                 smk->buf_sizes[smk->curstream] = size;
321.                 ret = avio_read(s->pb, smk->bufs[smk->curstream], size);
322.                 if(ret != size)
                        ^
323.                     return AVERROR(EIO);
324.                 smk->stream_id[smk->curstream] = smk->indexes[i];

libavformat/smacker.c:324:17: 
322.                 if(ret != size)
323.                     return AVERROR(EIO);
324.                 smk->stream_id[smk->curstream] = smk->indexes[i];
                     ^
325.             }
326.             flags >>= 1;

libavformat/smacker.c:326:13: 
324.                 smk->stream_id[smk->curstream] = smk->indexes[i];
325.             }
326.             flags >>= 1;
                 ^
327.         }
328.         if (frame_size < 0 || frame_size >= INT_MAX/2)

libavformat/smacker.c:305:27: 
303.         smk->curstream = -1;
304.         /* if audio chunks are present, put them to stack and retrieve later */
305.         for(i = 0; i < 7; i++) {
                               ^
306.             if(flags & 1) {
307.                 uint32_t size;

libavformat/smacker.c:305:20: Loop condition is true. Entering loop body
303.         smk->curstream = -1;
304.         /* if audio chunks are present, put them to stack and retrieve later */
305.         for(i = 0; i < 7; i++) {
                        ^
306.             if(flags & 1) {
307.                 uint32_t size;

libavformat/smacker.c:306:16: Taking true branch
304.         /* if audio chunks are present, put them to stack and retrieve later */
305.         for(i = 0; i < 7; i++) {
306.             if(flags & 1) {
                    ^
307.                 uint32_t size;
308.                 int err;

libavformat/smacker.c:310:17: 
308.                 int err;
309. 
310.                 size = avio_rl32(s->pb) - 4;
                     ^
311.                 if (!size || size > frame_size) {
312.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");

libavformat/aviobuf.c:558:1: start of procedure avio_rl32()
  556. }
  557. 
  558. unsigned int avio_rl32(AVIOContext *s)
       ^
  559. {
  560.     unsigned int val;

libavformat/aviobuf.c:561:5: 
  559. {
  560.     unsigned int val;
  561.     val = avio_rl16(s);
           ^
  562.     val |= avio_rl16(s) << 16;
  563.     return val;

libavformat/aviobuf.c:542:1: start of procedure avio_rl16()
    540. }
    541. 
    542. unsigned int avio_rl16(AVIOContext *s)
         ^
    543. {
    544.     unsigned int val;

libavformat/aviobuf.c:545:5: 
    543. {
    544.     unsigned int val;
    545.     val = avio_r8(s);
             ^
    546.     val |= avio_r8(s) << 8;
    547.     return val;

libavformat/aviobuf.c:437:1: start of procedure avio_r8()
      435. 
      436. /* XXX: put an inline version */
      437. int avio_r8(AVIOContext *s)
           ^
      438. {
      439.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:439:9: Taking false branch
      437. int avio_r8(AVIOContext *s)
      438. {
      439.     if (s->buf_ptr >= s->buf_end)
                   ^
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:441:9: Taking true branch
      439.     if (s->buf_ptr >= s->buf_end)
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
                   ^
      442.         return *s->buf_ptr++;
      443.     return 0;

libavformat/aviobuf.c:442:9: 
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
                   ^
      443.     return 0;
      444. }

libavformat/aviobuf.c:444:1: return from a call to avio_r8
      442.         return *s->buf_ptr++;
      443.     return 0;
      444. }
           ^
      445. 
      446. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:546:5: 
    544.     unsigned int val;
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
             ^
    547.     return val;
    548. }

libavformat/aviobuf.c:437:1: start of procedure avio_r8()
      435. 
      436. /* XXX: put an inline version */
      437. int avio_r8(AVIOContext *s)
           ^
      438. {
      439.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:439:9: Taking false branch
      437. int avio_r8(AVIOContext *s)
      438. {
      439.     if (s->buf_ptr >= s->buf_end)
                   ^
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:441:9: Taking true branch
      439.     if (s->buf_ptr >= s->buf_end)
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
                   ^
      442.         return *s->buf_ptr++;
      443.     return 0;

libavformat/aviobuf.c:442:9: 
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
                   ^
      443.     return 0;
      444. }

libavformat/aviobuf.c:444:1: return from a call to avio_r8
      442.         return *s->buf_ptr++;
      443.     return 0;
      444. }
           ^
      445. 
      446. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:547:5: 
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
    547.     return val;
             ^
    548. }
    549. 

libavformat/aviobuf.c:548:1: return from a call to avio_rl16
    546.     val |= avio_r8(s) << 8;
    547.     return val;
    548. }
         ^
    549. 
    550. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:562:5: 
  560.     unsigned int val;
  561.     val = avio_rl16(s);
  562.     val |= avio_rl16(s) << 16;
           ^
  563.     return val;
  564. }

libavformat/aviobuf.c:542:1: start of procedure avio_rl16()
    540. }
    541. 
    542. unsigned int avio_rl16(AVIOContext *s)
         ^
    543. {
    544.     unsigned int val;

libavformat/aviobuf.c:545:5: 
    543. {
    544.     unsigned int val;
    545.     val = avio_r8(s);
             ^
    546.     val |= avio_r8(s) << 8;
    547.     return val;

libavformat/aviobuf.c:437:1: start of procedure avio_r8()
      435. 
      436. /* XXX: put an inline version */
      437. int avio_r8(AVIOContext *s)
           ^
      438. {
      439.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:439:9: Taking false branch
      437. int avio_r8(AVIOContext *s)
      438. {
      439.     if (s->buf_ptr >= s->buf_end)
                   ^
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:441:9: Taking true branch
      439.     if (s->buf_ptr >= s->buf_end)
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
                   ^
      442.         return *s->buf_ptr++;
      443.     return 0;

libavformat/aviobuf.c:442:9: 
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
                   ^
      443.     return 0;
      444. }

libavformat/aviobuf.c:444:1: return from a call to avio_r8
      442.         return *s->buf_ptr++;
      443.     return 0;
      444. }
           ^
      445. 
      446. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:546:5: 
    544.     unsigned int val;
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
             ^
    547.     return val;
    548. }

libavformat/aviobuf.c:437:1: start of procedure avio_r8()
      435. 
      436. /* XXX: put an inline version */
      437. int avio_r8(AVIOContext *s)
           ^
      438. {
      439.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:439:9: Taking false branch
      437. int avio_r8(AVIOContext *s)
      438. {
      439.     if (s->buf_ptr >= s->buf_end)
                   ^
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:441:9: Taking true branch
      439.     if (s->buf_ptr >= s->buf_end)
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
                   ^
      442.         return *s->buf_ptr++;
      443.     return 0;

libavformat/aviobuf.c:442:9: 
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
                   ^
      443.     return 0;
      444. }

libavformat/aviobuf.c:444:1: return from a call to avio_r8
      442.         return *s->buf_ptr++;
      443.     return 0;
      444. }
           ^
      445. 
      446. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:547:5: 
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
    547.     return val;
             ^
    548. }
    549. 

libavformat/aviobuf.c:548:1: return from a call to avio_rl16
    546.     val |= avio_r8(s) << 8;
    547.     return val;
    548. }
         ^
    549. 
    550. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:563:5: 
  561.     val = avio_rl16(s);
  562.     val |= avio_rl16(s) << 16;
  563.     return val;
           ^
  564. }
  565. 

libavformat/aviobuf.c:564:1: return from a call to avio_rl32
  562.     val |= avio_rl16(s) << 16;
  563.     return val;
  564. }
       ^
  565. 
  566. uint64_t avio_rl64(AVIOContext *s)

libavformat/smacker.c:311:22: Taking false branch
309. 
310.                 size = avio_rl32(s->pb) - 4;
311.                 if (!size || size > frame_size) {
                          ^
312.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");
313.                     return AVERROR_INVALIDDATA;

libavformat/smacker.c:311:30: Taking false branch
309. 
310.                 size = avio_rl32(s->pb) - 4;
311.                 if (!size || size > frame_size) {
                                  ^
312.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");
313.                     return AVERROR_INVALIDDATA;

libavformat/smacker.c:315:17: 
313.                     return AVERROR_INVALIDDATA;
314.                 }
315.                 frame_size -= size;
                     ^
316.                 frame_size -= 4;
317.                 smk->curstream++;

libavformat/smacker.c:316:17: 
314.                 }
315.                 frame_size -= size;
316.                 frame_size -= 4;
                     ^
317.                 smk->curstream++;
318.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)

libavformat/smacker.c:317:17: 
315.                 frame_size -= size;
316.                 frame_size -= 4;
317.                 smk->curstream++;
                     ^
318.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)
319.                     return err;

libavformat/smacker.c:318:21: 
316.                 frame_size -= 4;
317.                 smk->curstream++;
318.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)
                         ^
319.                     return err;
320.                 smk->buf_sizes[smk->curstream] = size;

libavutil/mem.c:139:1: start of procedure av_reallocp()
  137. }
  138. 
  139. int av_reallocp(void *ptr, size_t size)
       ^
  140. {
  141.     void **ptrptr = ptr;

libavutil/mem.c:141:5: 
  139. int av_reallocp(void *ptr, size_t size)
  140. {
  141.     void **ptrptr = ptr;
           ^
  142.     void *ret;
  143. 

libavutil/mem.c:144:5: 
  142.     void *ret;
  143. 
  144.     ret = av_realloc(*ptrptr, size);
           ^
  145. 
  146.     if (!ret) {

libavutil/mem.c:116:1: start of procedure av_realloc()
    114. }
    115. 
    116. void *av_realloc(void *ptr, size_t size)
         ^
    117. {
    118. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:123:9: Taking false branch
    121. 
    122.     /* let's disallow possibly ambiguous cases */
    123.     if (size > (INT_MAX - 16))
                 ^
    124.         return NULL;
    125. 

libavutil/mem.c:135:5: 
    133.     return _aligned_realloc(ptr, size, 32);
    134. #else
    135.     return realloc(ptr, size);
             ^
    136. #endif
    137. }

libavutil/mem.c:137:1: return from a call to av_realloc
    135.     return realloc(ptr, size);
    136. #endif
    137. }
         ^
    138. 
    139. int av_reallocp(void *ptr, size_t size)

libavutil/mem.c:146:10: Taking false branch
  144.     ret = av_realloc(*ptrptr, size);
  145. 
  146.     if (!ret) {
                ^
  147.         av_freep(ptr);
  148.         return AVERROR(ENOMEM);

libavutil/mem.c:151:5: 
  149.     }
  150. 
  151.     *ptrptr = ret;
           ^
  152.     return 0;
  153. }

libavutil/mem.c:152:5: 
  150. 
  151.     *ptrptr = ret;
  152.     return 0;
           ^
  153. }
  154. 

libavutil/mem.c:153:1: return from a call to av_reallocp
  151.     *ptrptr = ret;
  152.     return 0;
  153. }
       ^
  154. 
  155. void *av_realloc_array(void *ptr, size_t nmemb, size_t size)

static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
{
    SmackerContext *smk = s->priv_data;
    int flags;
    int ret;
    int i;
    int frame_size = 0;
    int palchange = 0;
    if (s->pb->eof_reached || smk->cur_frame >= smk->frames)
        return AVERROR_EOF;
    if(smk->curstream < 0) {
        avio_seek(s->pb, smk->nextpos, 0);
        frame_size = smk->frm_size[smk->cur_frame] & (~3);
        flags = smk->frm_flags[smk->cur_frame];
        if(flags & SMACKER_PAL){
            int size, sz, t, off, j, pos;
            uint8_t *pal = smk->pal;
            uint8_t oldpal[768];
            memcpy(oldpal, pal, 768);
            size = avio_r8(s->pb);
            size = size * 4 - 1;
            frame_size -= size;
            frame_size--;
            sz = 0;
            pos = avio_tell(s->pb) + size;
            while(sz < 256){
                t = avio_r8(s->pb);
                if(t & 0x80){
                    sz += (t & 0x7F) + 1;
                    pal += ((t & 0x7F) + 1) * 3;
                } else if(t & 0x40){
                    off = avio_r8(s->pb);
                    j = (t & 0x3F) + 1;
                    if (off + j > 0x100) {
                        av_log(s, AV_LOG_ERROR,
                               "Invalid palette update, offset=%d length=%d extends beyond palette size\n",
                               off, j);
                        return AVERROR_INVALIDDATA;
                    }
                    off *= 3;
                    while(j-- && sz < 256) {
                        *pal++ = oldpal[off + 0];
                        *pal++ = oldpal[off + 1];
                        *pal++ = oldpal[off + 2];
                        sz++;
                        off += 3;
                    }
                } else {
                    *pal++ = smk_pal[t];
                    *pal++ = smk_pal[avio_r8(s->pb) & 0x3F];
                    *pal++ = smk_pal[avio_r8(s->pb) & 0x3F];
                    sz++;
                }
            }
            avio_seek(s->pb, pos, 0);
            palchange |= 1;
        }
        flags >>= 1;
        smk->curstream = -1;
        for(i = 0; i < 7; i++) {
            if(flags & 1) {
                uint32_t size;
                int err;
                size = avio_rl32(s->pb) - 4;
                if (!size || size > frame_size) {
                    av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");
                    return AVERROR_INVALIDDATA;
                }
                frame_size -= size;
                frame_size -= 4;
                smk->curstream++;
                if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)
                    return err;
                smk->buf_sizes[smk->curstream] = size;
                ret = avio_read(s->pb, smk->bufs[smk->curstream], size);
                if(ret != size)
                    return AVERROR(EIO);
                smk->stream_id[smk->curstream] = smk->indexes[i];
            }
            flags >>= 1;
        }
        if (frame_size < 0 || frame_size >= INT_MAX/2)
            return AVERROR_INVALIDDATA;
        if (av_new_packet(pkt, frame_size + 769))
            return AVERROR(ENOMEM);
        if(smk->frm_size[smk->cur_frame] & 1)
            palchange |= 2;
        pkt->data[0] = palchange;
        memcpy(pkt->data + 1, smk->pal, 768);
        ret = avio_read(s->pb, pkt->data + 769, frame_size);
        if(ret != frame_size)
            return AVERROR(EIO);
        pkt->stream_index = smk->videoindex;
        pkt->pts          = smk->cur_frame;
        pkt->size = ret + 769;
        smk->cur_frame++;
        smk->nextpos = avio_tell(s->pb);
    } else {
        if (smk->stream_id[smk->curstream] < 0)
            return AVERROR_INVALIDDATA;
        if (av_new_packet(pkt, smk->buf_sizes[smk->curstream]))
            return AVERROR(ENOMEM);
        memcpy(pkt->data, smk->bufs[smk->curstream], smk->buf_sizes[smk->curstream]);
        pkt->size = smk->buf_sizes[smk->curstream];
        pkt->stream_index = smk->stream_id[smk->curstream];
        pkt->pts = smk->aud_pts[smk->curstream];
        smk->aud_pts[smk->curstream] += AV_RL32(pkt->data);
        smk->curstream--;
    }
    return 0;
}
['static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)\n{\n    SmackerContext *smk = s->priv_data;\n    int flags;\n    int ret;\n    int i;\n    int frame_size = 0;\n    int palchange = 0;\n    if (s->pb->eof_reached || smk->cur_frame >= smk->frames)\n        return AVERROR_EOF;\n    if(smk->curstream < 0) {\n        avio_seek(s->pb, smk->nextpos, 0);\n        frame_size = smk->frm_size[smk->cur_frame] & (~3);\n        flags = smk->frm_flags[smk->cur_frame];\n        if(flags & SMACKER_PAL){\n            int size, sz, t, off, j, pos;\n            uint8_t *pal = smk->pal;\n            uint8_t oldpal[768];\n            memcpy(oldpal, pal, 768);\n            size = avio_r8(s->pb);\n            size = size * 4 - 1;\n            frame_size -= size;\n            frame_size--;\n            sz = 0;\n            pos = avio_tell(s->pb) + size;\n            while(sz < 256){\n                t = avio_r8(s->pb);\n                if(t & 0x80){\n                    sz += (t & 0x7F) + 1;\n                    pal += ((t & 0x7F) + 1) * 3;\n                } else if(t & 0x40){\n                    off = avio_r8(s->pb);\n                    j = (t & 0x3F) + 1;\n                    if (off + j > 0x100) {\n                        av_log(s, AV_LOG_ERROR,\n                               "Invalid palette update, offset=%d length=%d extends beyond palette size\\n",\n                               off, j);\n                        return AVERROR_INVALIDDATA;\n                    }\n                    off *= 3;\n                    while(j-- && sz < 256) {\n                        *pal++ = oldpal[off + 0];\n                        *pal++ = oldpal[off + 1];\n                        *pal++ = oldpal[off + 2];\n                        sz++;\n                        off += 3;\n                    }\n                } else {\n                    *pal++ = smk_pal[t];\n                    *pal++ = smk_pal[avio_r8(s->pb) & 0x3F];\n                    *pal++ = smk_pal[avio_r8(s->pb) & 0x3F];\n                    sz++;\n                }\n            }\n            avio_seek(s->pb, pos, 0);\n            palchange |= 1;\n        }\n        flags >>= 1;\n        smk->curstream = -1;\n        for(i = 0; i < 7; i++) {\n            if(flags & 1) {\n                uint32_t size;\n                int err;\n                size = avio_rl32(s->pb) - 4;\n                if (!size || size > frame_size) {\n                    av_log(s, AV_LOG_ERROR, "Invalid audio part size\\n");\n                    return AVERROR_INVALIDDATA;\n                }\n                frame_size -= size;\n                frame_size -= 4;\n                smk->curstream++;\n                if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)\n                    return err;\n                smk->buf_sizes[smk->curstream] = size;\n                ret = avio_read(s->pb, smk->bufs[smk->curstream], size);\n                if(ret != size)\n                    return AVERROR(EIO);\n                smk->stream_id[smk->curstream] = smk->indexes[i];\n            }\n            flags >>= 1;\n        }\n        if (frame_size < 0 || frame_size >= INT_MAX/2)\n            return AVERROR_INVALIDDATA;\n        if (av_new_packet(pkt, frame_size + 769))\n            return AVERROR(ENOMEM);\n        if(smk->frm_size[smk->cur_frame] & 1)\n            palchange |= 2;\n        pkt->data[0] = palchange;\n        memcpy(pkt->data + 1, smk->pal, 768);\n        ret = avio_read(s->pb, pkt->data + 769, frame_size);\n        if(ret != frame_size)\n            return AVERROR(EIO);\n        pkt->stream_index = smk->videoindex;\n        pkt->pts          = smk->cur_frame;\n        pkt->size = ret + 769;\n        smk->cur_frame++;\n        smk->nextpos = avio_tell(s->pb);\n    } else {\n        if (smk->stream_id[smk->curstream] < 0)\n            return AVERROR_INVALIDDATA;\n        if (av_new_packet(pkt, smk->buf_sizes[smk->curstream]))\n            return AVERROR(ENOMEM);\n        memcpy(pkt->data, smk->bufs[smk->curstream], smk->buf_sizes[smk->curstream]);\n        pkt->size = smk->buf_sizes[smk->curstream];\n        pkt->stream_index = smk->stream_id[smk->curstream];\n        pkt->pts = smk->aud_pts[smk->curstream];\n        smk->aud_pts[smk->curstream] += AV_RL32(pkt->data);\n        smk->curstream--;\n    }\n    return 0;\n}', 'unsigned int avio_rl32(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_rl16(s);\n    val |= avio_rl16(s) << 16;\n    return val;\n}', 'unsigned int avio_rl16(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_r8(s);\n    val |= avio_r8(s) << 8;\n    return val;\n}', 'int avio_r8(AVIOContext *s)\n{\n    if (s->buf_ptr >= s->buf_end)\n        fill_buffer(s);\n    if (s->buf_ptr < s->buf_end)\n        return *s->buf_ptr++;\n    return 0;\n}', 'int av_reallocp(void *ptr, size_t size)\n{\n    void **ptrptr = ptr;\n    void *ret;\n    ret = av_realloc(*ptrptr, size);\n    if (!ret) {\n        av_freep(ptr);\n        return AVERROR(ENOMEM);\n    }\n    *ptrptr = ret;\n    return 0;\n}', 'void *av_realloc(void *ptr, size_t size)\n{\n#if CONFIG_MEMALIGN_HACK\n    int diff;\n#endif\n    if (size > (INT_MAX - 16))\n        return NULL;\n#if CONFIG_MEMALIGN_HACK\n    if (!ptr)\n        return av_malloc(size);\n    diff = ((char *)ptr)[-1];\n    return (char *)realloc((char *)ptr - diff, size + diff) + diff;\n#elif HAVE_ALIGNED_MALLOC\n    return _aligned_realloc(ptr, size, 32);\n#else\n    return realloc(ptr, size);\n#endif\n}']