libavcodec/utils.c:273: error: Use After Free
  accessing memory that was invalidated by call to `free()` on line 272 indirectly during the call to `av_free()`.

libavcodec/utils.c:259:24: invalidation part of the trace starts here
257.     /* allocate InternalBuffer if needed */
258.     if (!avci->buffer) {
259.         avci->buffer = av_mallocz(sizeof(InternalBuffer));
                            ^
260.         if (!avci->buffer)
261.             return AVERROR(ENOMEM);

libavcodec/utils.c:259:24: passed as argument to `av_mallocz`
  257.     /* allocate InternalBuffer if needed */
  258.     if (!avci->buffer) {
  259.         avci->buffer = av_mallocz(sizeof(InternalBuffer));
                              ^
  260.         if (!avci->buffer)
  261.             return AVERROR(ENOMEM);

libavcodec/utils.c:259:24: return from call to `av_mallocz`
  257.     /* allocate InternalBuffer if needed */
  258.     if (!avci->buffer) {
  259.         avci->buffer = av_mallocz(sizeof(InternalBuffer));
                              ^
  260.         if (!avci->buffer)
  261.             return AVERROR(ENOMEM);

libavcodec/utils.c:259:9: assigned
  257.     /* allocate InternalBuffer if needed */
  258.     if (!avci->buffer) {
  259.         avci->buffer = av_mallocz(sizeof(InternalBuffer));
               ^
  260.         if (!avci->buffer)
  261.             return AVERROR(ENOMEM);

libavcodec/utils.c:263:5: assigned
  261.             return AVERROR(ENOMEM);
  262.     }
  263.     buf = avci->buffer;
           ^
  264. 
  265.     /* if there is a previously-used internal buffer, check its size and

libavcodec/utils.c:272:17: when calling `av_free` here
  270.             av_free(buf->extended_data[0]);
  271.             if (buf->extended_data != buf->data)
  272.                 av_free(&buf->extended_data);
                       ^
  273.             buf->extended_data = NULL;
  274.             buf->data[0] = NULL;

libavutil/mem.c:137:1: parameter `ptr` of av_free
    135. }
    136. 
    137. void av_free(void *ptr)
         ^
    138. {
    139. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:143:5: was invalidated by call to `free()`
    141.         free((char*)ptr - ((char*)ptr)[-1]);
    142. #else
    143.     free(ptr);
             ^
    144. #endif
    145. }

libavcodec/utils.c:259:24: use-after-lifetime part of the trace starts here
257.     /* allocate InternalBuffer if needed */
258.     if (!avci->buffer) {
259.         avci->buffer = av_mallocz(sizeof(InternalBuffer));
                            ^
260.         if (!avci->buffer)
261.             return AVERROR(ENOMEM);

libavcodec/utils.c:259:24: passed as argument to `av_mallocz`
  257.     /* allocate InternalBuffer if needed */
  258.     if (!avci->buffer) {
  259.         avci->buffer = av_mallocz(sizeof(InternalBuffer));
                              ^
  260.         if (!avci->buffer)
  261.             return AVERROR(ENOMEM);

libavcodec/utils.c:259:24: return from call to `av_mallocz`
  257.     /* allocate InternalBuffer if needed */
  258.     if (!avci->buffer) {
  259.         avci->buffer = av_mallocz(sizeof(InternalBuffer));
                              ^
  260.         if (!avci->buffer)
  261.             return AVERROR(ENOMEM);

libavcodec/utils.c:259:9: assigned
  257.     /* allocate InternalBuffer if needed */
  258.     if (!avci->buffer) {
  259.         avci->buffer = av_mallocz(sizeof(InternalBuffer));
               ^
  260.         if (!avci->buffer)
  261.             return AVERROR(ENOMEM);

libavcodec/utils.c:263:5: assigned
  261.             return AVERROR(ENOMEM);
  262.     }
  263.     buf = avci->buffer;
           ^
  264. 
  265.     /* if there is a previously-used internal buffer, check its size and

libavcodec/utils.c:273:13: invalid access occurs here
  271.             if (buf->extended_data != buf->data)
  272.                 av_free(&buf->extended_data);
  273.             buf->extended_data = NULL;
                   ^
  274.             buf->data[0] = NULL;
  275.         }

static int audio_get_buffer(AVCodecContext *avctx, AVFrame *frame)
{
    AVCodecInternal *avci = avctx->internal;
    InternalBuffer *buf;
    int buf_size, ret, i, needs_extended_data;
    buf_size = av_samples_get_buffer_size(NULL, avctx->channels,
                                          frame->nb_samples, avctx->sample_fmt,
                                          32);
    if (buf_size < 0)
        return AVERROR(EINVAL);
    needs_extended_data = av_sample_fmt_is_planar(avctx->sample_fmt) &&
                          avctx->channels > AV_NUM_DATA_POINTERS;
    if (!avci->buffer) {
        avci->buffer = av_mallocz(sizeof(InternalBuffer));
        if (!avci->buffer)
            return AVERROR(ENOMEM);
    }
    buf = avci->buffer;
    if (buf->extended_data) {
        if (buf->extended_data[0] && buf_size > buf->audio_data_size) {
            av_free(buf->extended_data[0]);
            if (buf->extended_data != buf->data)
                av_free(&buf->extended_data);
            buf->extended_data = NULL;
            buf->data[0] = NULL;
        }
        if (buf->nb_channels != avctx->channels) {
            if (buf->extended_data != buf->data)
                av_free(buf->extended_data);
            buf->extended_data = NULL;
        }
    }
    if (!buf->extended_data) {
        if (needs_extended_data) {
            buf->extended_data = av_mallocz(avctx->channels *
                                            sizeof(*buf->extended_data));
            if (!buf->extended_data)
                return AVERROR(ENOMEM);
        } else {
            buf->extended_data = buf->data;
        }
        if (buf->extended_data[0]) {
            ret = av_samples_fill_arrays(buf->extended_data, &buf->linesize[0],
                                         buf->extended_data[0], avctx->channels,
                                         frame->nb_samples, avctx->sample_fmt,
                                         32);
        } else {
            ret = av_samples_alloc(buf->extended_data, &buf->linesize[0],
                                   avctx->channels, frame->nb_samples,
                                   avctx->sample_fmt, 32);
        }
        if (ret)
            return ret;
        if (needs_extended_data) {
            for (i = 0; i < AV_NUM_DATA_POINTERS; i++)
                buf->data[i] = buf->extended_data[i];
        }
        buf->audio_data_size = buf_size;
        buf->nb_channels     = avctx->channels;
    }
    frame->type          = FF_BUFFER_TYPE_INTERNAL;
    frame->extended_data = buf->extended_data;
    frame->linesize[0]   = buf->linesize[0];
    memcpy(frame->data, buf->data, sizeof(frame->data));
    if (avctx->pkt) frame->pkt_pts = avctx->pkt->pts;
    else            frame->pkt_pts = AV_NOPTS_VALUE;
    frame->reordered_opaque = avctx->reordered_opaque;
    if (avctx->debug & FF_DEBUG_BUFFERS)
        av_log(avctx, AV_LOG_DEBUG, "default_get_buffer called on frame %p, "
               "internal audio buffer used\n", frame);
    return 0;
}
['static int audio_get_buffer(AVCodecContext *avctx, AVFrame *frame)\n{\n    AVCodecInternal *avci = avctx->internal;\n    InternalBuffer *buf;\n    int buf_size, ret, i, needs_extended_data;\n    buf_size = av_samples_get_buffer_size(NULL, avctx->channels,\n                                          frame->nb_samples, avctx->sample_fmt,\n                                          32);\n    if (buf_size < 0)\n        return AVERROR(EINVAL);\n    needs_extended_data = av_sample_fmt_is_planar(avctx->sample_fmt) &&\n                          avctx->channels > AV_NUM_DATA_POINTERS;\n    if (!avci->buffer) {\n        avci->buffer = av_mallocz(sizeof(InternalBuffer));\n        if (!avci->buffer)\n            return AVERROR(ENOMEM);\n    }\n    buf = avci->buffer;\n    if (buf->extended_data) {\n        if (buf->extended_data[0] && buf_size > buf->audio_data_size) {\n            av_free(buf->extended_data[0]);\n            if (buf->extended_data != buf->data)\n                av_free(&buf->extended_data);\n            buf->extended_data = NULL;\n            buf->data[0] = NULL;\n        }\n        if (buf->nb_channels != avctx->channels) {\n            if (buf->extended_data != buf->data)\n                av_free(buf->extended_data);\n            buf->extended_data = NULL;\n        }\n    }\n    if (!buf->extended_data) {\n        if (needs_extended_data) {\n            buf->extended_data = av_mallocz(avctx->channels *\n                                            sizeof(*buf->extended_data));\n            if (!buf->extended_data)\n                return AVERROR(ENOMEM);\n        } else {\n            buf->extended_data = buf->data;\n        }\n        if (buf->extended_data[0]) {\n            ret = av_samples_fill_arrays(buf->extended_data, &buf->linesize[0],\n                                         buf->extended_data[0], avctx->channels,\n                                         frame->nb_samples, avctx->sample_fmt,\n                                         32);\n        } else {\n            ret = av_samples_alloc(buf->extended_data, &buf->linesize[0],\n                                   avctx->channels, frame->nb_samples,\n                                   avctx->sample_fmt, 32);\n        }\n        if (ret)\n            return ret;\n        if (needs_extended_data) {\n            for (i = 0; i < AV_NUM_DATA_POINTERS; i++)\n                buf->data[i] = buf->extended_data[i];\n        }\n        buf->audio_data_size = buf_size;\n        buf->nb_channels     = avctx->channels;\n    }\n    frame->type          = FF_BUFFER_TYPE_INTERNAL;\n    frame->extended_data = buf->extended_data;\n    frame->linesize[0]   = buf->linesize[0];\n    memcpy(frame->data, buf->data, sizeof(frame->data));\n    if (avctx->pkt) frame->pkt_pts = avctx->pkt->pts;\n    else            frame->pkt_pts = AV_NOPTS_VALUE;\n    frame->reordered_opaque = avctx->reordered_opaque;\n    if (avctx->debug & FF_DEBUG_BUFFERS)\n        av_log(avctx, AV_LOG_DEBUG, "default_get_buffer called on frame %p, "\n               "internal audio buffer used\\n", frame);\n    return 0;\n}', 'void av_free(void *ptr)\n{\n#if CONFIG_MEMALIGN_HACK\n    if (ptr)\n        free((char*)ptr - ((char*)ptr)[-1]);\n#else\n    free(ptr);\n#endif\n}']