libavfilter/af_channelmap.c:350: error: Use After Free
  accessing memory that was invalidated by call to `free()` on line 341 indirectly during the call to `av_free()`.

libavfilter/af_channelmap.c:332:17: invalidation part of the trace starts here
330.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
331.             uint8_t **new_extended_data =
332.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                     ^
333.             if (!new_extended_data) {
334.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:332:17: passed as argument to `av_mallocz`
  330.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  331.             uint8_t **new_extended_data =
  332.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                       ^
  333.             if (!new_extended_data) {
  334.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:332:17: return from call to `av_mallocz`
  330.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  331.             uint8_t **new_extended_data =
  332.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                       ^
  333.             if (!new_extended_data) {
  334.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:331:13: assigned
  329.     if (nch_out > nch_in) {
  330.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  331.             uint8_t **new_extended_data =
                   ^
  332.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
  333.             if (!new_extended_data) {

libavfilter/af_channelmap.c:340:17: assigned
  338.                 buf->extended_data = new_extended_data;
  339.             } else {
  340.                 buf->extended_data = new_extended_data;
                       ^
  341.                 av_free(buf->extended_data);
  342.             }

libavfilter/af_channelmap.c:341:17: when calling `av_free` here
  339.             } else {
  340.                 buf->extended_data = new_extended_data;
  341.                 av_free(buf->extended_data);
                       ^
  342.             }
  343.         } else if (buf->extended_data != buf->data) {

libavutil/mem.c:143:1: parameter `ptr` of av_free
    141. }
    142. 
    143. void av_free(void *ptr)
         ^
    144. {
    145. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:151:5: was invalidated by call to `free()`
    149.     _aligned_free(ptr);
    150. #else
    151.     free(ptr);
             ^
    152. #endif
    153. }

libavfilter/af_channelmap.c:332:17: use-after-lifetime part of the trace starts here
330.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
331.             uint8_t **new_extended_data =
332.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                     ^
333.             if (!new_extended_data) {
334.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:332:17: passed as argument to `av_mallocz`
  330.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  331.             uint8_t **new_extended_data =
  332.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                       ^
  333.             if (!new_extended_data) {
  334.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:332:17: return from call to `av_mallocz`
  330.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  331.             uint8_t **new_extended_data =
  332.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                       ^
  333.             if (!new_extended_data) {
  334.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:331:13: assigned
  329.     if (nch_out > nch_in) {
  330.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  331.             uint8_t **new_extended_data =
                   ^
  332.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
  333.             if (!new_extended_data) {

libavfilter/af_channelmap.c:340:17: assigned
  338.                 buf->extended_data = new_extended_data;
  339.             } else {
  340.                 buf->extended_data = new_extended_data;
                       ^
  341.                 av_free(buf->extended_data);
  342.             }

libavfilter/af_channelmap.c:350:9: invalid access occurs here
  348. 
  349.     for (ch = 0; ch < nch_out; ch++) {
  350.         buf->extended_data[s->map[ch].out_channel_idx] =
               ^
  351.             source_planes[s->map[ch].in_channel_idx];
  352.     }

static int channelmap_filter_samples(AVFilterLink *inlink, AVFilterBufferRef *buf)
{
    AVFilterContext  *ctx = inlink->dst;
    AVFilterLink *outlink = ctx->outputs[0];
    const ChannelMapContext *s = ctx->priv;
    const int nch_in = av_get_channel_layout_nb_channels(inlink->channel_layout);
    const int nch_out = s->nch;
    int ch;
    uint8_t *source_planes[MAX_CH];
    memcpy(source_planes, buf->extended_data,
           nch_in * sizeof(source_planes[0]));
    if (nch_out > nch_in) {
        if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
            uint8_t **new_extended_data =
                av_mallocz(nch_out * sizeof(*buf->extended_data));
            if (!new_extended_data) {
                avfilter_unref_buffer(buf);
                return AVERROR(ENOMEM);
            }
            if (buf->extended_data == buf->data) {
                buf->extended_data = new_extended_data;
            } else {
                buf->extended_data = new_extended_data;
                av_free(buf->extended_data);
            }
        } else if (buf->extended_data != buf->data) {
            av_free(buf->extended_data);
            buf->extended_data = buf->data;
        }
    }
    for (ch = 0; ch < nch_out; ch++) {
        buf->extended_data[s->map[ch].out_channel_idx] =
            source_planes[s->map[ch].in_channel_idx];
    }
    if (buf->data != buf->extended_data)
        memcpy(buf->data, buf->extended_data,
           FFMIN(FF_ARRAY_ELEMS(buf->data), nch_out) * sizeof(buf->data[0]));
    return ff_filter_samples(outlink, buf);
}
['static int channelmap_filter_samples(AVFilterLink *inlink, AVFilterBufferRef *buf)\n{\n    AVFilterContext  *ctx = inlink->dst;\n    AVFilterLink *outlink = ctx->outputs[0];\n    const ChannelMapContext *s = ctx->priv;\n    const int nch_in = av_get_channel_layout_nb_channels(inlink->channel_layout);\n    const int nch_out = s->nch;\n    int ch;\n    uint8_t *source_planes[MAX_CH];\n    memcpy(source_planes, buf->extended_data,\n           nch_in * sizeof(source_planes[0]));\n    if (nch_out > nch_in) {\n        if (nch_out > FF_ARRAY_ELEMS(buf->data)) {\n            uint8_t **new_extended_data =\n                av_mallocz(nch_out * sizeof(*buf->extended_data));\n            if (!new_extended_data) {\n                avfilter_unref_buffer(buf);\n                return AVERROR(ENOMEM);\n            }\n            if (buf->extended_data == buf->data) {\n                buf->extended_data = new_extended_data;\n            } else {\n                buf->extended_data = new_extended_data;\n                av_free(buf->extended_data);\n            }\n        } else if (buf->extended_data != buf->data) {\n            av_free(buf->extended_data);\n            buf->extended_data = buf->data;\n        }\n    }\n    for (ch = 0; ch < nch_out; ch++) {\n        buf->extended_data[s->map[ch].out_channel_idx] =\n            source_planes[s->map[ch].in_channel_idx];\n    }\n    if (buf->data != buf->extended_data)\n        memcpy(buf->data, buf->extended_data,\n           FFMIN(FF_ARRAY_ELEMS(buf->data), nch_out) * sizeof(buf->data[0]));\n    return ff_filter_samples(outlink, buf);\n}', 'void av_free(void *ptr)\n{\n#if CONFIG_MEMALIGN_HACK\n    if (ptr)\n        free((char*)ptr - ((char*)ptr)[-1]);\n#elif HAVE_ALIGNED_MALLOC\n    _aligned_free(ptr);\n#else\n    free(ptr);\n#endif\n}']