libavformat/smacker.c:322: error: Memory Leak
  memory dynamically allocated by call to `av_reallocp()` at line 322, column 28 is not reachable after line 322, column 28.

libavformat/smacker.c:244:1: start of procedure smacker_read_packet()
242. 
243. 
244. static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
     ^
245. {
246.     SmackerContext *smk = s->priv_data;

libavformat/smacker.c:246:5: 
244. static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
245. {
246.     SmackerContext *smk = s->priv_data;
         ^
247.     int flags;
248.     int ret;

libavformat/smacker.c:250:5: 
248.     int ret;
249.     int i;
250.     int frame_size = 0;
         ^
251.     int palchange = 0;
252. 

libavformat/smacker.c:251:5: 
249.     int i;
250.     int frame_size = 0;
251.     int palchange = 0;
         ^
252. 
253.     if (s->pb->eof_reached || smk->cur_frame >= smk->frames)

libavformat/smacker.c:253:9: Taking false branch
251.     int palchange = 0;
252. 
253.     if (s->pb->eof_reached || smk->cur_frame >= smk->frames)
             ^
254.         return AVERROR_EOF;
255. 

libavformat/smacker.c:253:31: Taking false branch
251.     int palchange = 0;
252. 
253.     if (s->pb->eof_reached || smk->cur_frame >= smk->frames)
                                   ^
254.         return AVERROR_EOF;
255. 

libavformat/smacker.c:257:8: Taking true branch
255. 
256.     /* if we demuxed all streams, pass another frame */
257.     if(smk->curstream < 0) {
            ^
258.         avio_seek(s->pb, smk->nextpos, 0);
259.         frame_size = smk->frm_size[smk->cur_frame] & (~3);

libavformat/smacker.c:258:9: Skipping avio_seek(): empty list of specs
256.     /* if we demuxed all streams, pass another frame */
257.     if(smk->curstream < 0) {
258.         avio_seek(s->pb, smk->nextpos, 0);
             ^
259.         frame_size = smk->frm_size[smk->cur_frame] & (~3);
260.         flags = smk->frm_flags[smk->cur_frame];

libavformat/smacker.c:259:9: 
257.     if(smk->curstream < 0) {
258.         avio_seek(s->pb, smk->nextpos, 0);
259.         frame_size = smk->frm_size[smk->cur_frame] & (~3);
             ^
260.         flags = smk->frm_flags[smk->cur_frame];
261.         /* handle palette change event */

libavformat/smacker.c:260:9: 
258.         avio_seek(s->pb, smk->nextpos, 0);
259.         frame_size = smk->frm_size[smk->cur_frame] & (~3);
260.         flags = smk->frm_flags[smk->cur_frame];
             ^
261.         /* handle palette change event */
262.         if(flags & SMACKER_PAL){

libavformat/smacker.c:262:12: Taking false branch
260.         flags = smk->frm_flags[smk->cur_frame];
261.         /* handle palette change event */
262.         if(flags & SMACKER_PAL){
                ^
263.             int size, sz, t, off, j, pos;
264.             uint8_t *pal = smk->pal;

libavformat/smacker.c:306:9: 
304.             palchange |= 1;
305.         }
306.         flags >>= 1;
             ^
307.         smk->curstream = -1;
308.         /* if audio chunks are present, put them to stack and retrieve later */

libavformat/smacker.c:307:9: 
305.         }
306.         flags >>= 1;
307.         smk->curstream = -1;
             ^
308.         /* if audio chunks are present, put them to stack and retrieve later */
309.         for(i = 0; i < 7; i++) {

libavformat/smacker.c:309:13: 
307.         smk->curstream = -1;
308.         /* if audio chunks are present, put them to stack and retrieve later */
309.         for(i = 0; i < 7; i++) {
                 ^
310.             if(flags & 1) {
311.                 uint32_t size;

libavformat/smacker.c:309:20: Loop condition is true. Entering loop body
307.         smk->curstream = -1;
308.         /* if audio chunks are present, put them to stack and retrieve later */
309.         for(i = 0; i < 7; i++) {
                        ^
310.             if(flags & 1) {
311.                 uint32_t size;

libavformat/smacker.c:310:16: Taking true branch
308.         /* if audio chunks are present, put them to stack and retrieve later */
309.         for(i = 0; i < 7; i++) {
310.             if(flags & 1) {
                    ^
311.                 uint32_t size;
312.                 int err;

libavformat/smacker.c:314:17: 
312.                 int err;
313. 
314.                 size = avio_rl32(s->pb) - 4;
                     ^
315.                 if (!size || size > frame_size) {
316.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");

libavformat/aviobuf.c:564:1: start of procedure avio_rl32()
  562. }
  563. 
  564. unsigned int avio_rl32(AVIOContext *s)
       ^
  565. {
  566.     unsigned int val;

libavformat/aviobuf.c:567:5: 
  565. {
  566.     unsigned int val;
  567.     val = avio_rl16(s);
           ^
  568.     val |= avio_rl16(s) << 16;
  569.     return val;

libavformat/aviobuf.c:548:1: start of procedure avio_rl16()
    546. }
    547. 
    548. unsigned int avio_rl16(AVIOContext *s)
         ^
    549. {
    550.     unsigned int val;

libavformat/aviobuf.c:551:5: 
    549. {
    550.     unsigned int val;
    551.     val = avio_r8(s);
             ^
    552.     val |= avio_r8(s) << 8;
    553.     return val;

libavformat/aviobuf.c:443:1: start of procedure avio_r8()
      441. 
      442. /* XXX: put an inline version */
      443. int avio_r8(AVIOContext *s)
           ^
      444. {
      445.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:445:9: Taking false branch
      443. int avio_r8(AVIOContext *s)
      444. {
      445.     if (s->buf_ptr >= s->buf_end)
                   ^
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:447:9: Taking true branch
      445.     if (s->buf_ptr >= s->buf_end)
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)
                   ^
      448.         return *s->buf_ptr++;
      449.     return 0;

libavformat/aviobuf.c:448:9: 
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)
      448.         return *s->buf_ptr++;
                   ^
      449.     return 0;
      450. }

libavformat/aviobuf.c:450:1: return from a call to avio_r8
      448.         return *s->buf_ptr++;
      449.     return 0;
      450. }
           ^
      451. 
      452. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:552:5: 
    550.     unsigned int val;
    551.     val = avio_r8(s);
    552.     val |= avio_r8(s) << 8;
             ^
    553.     return val;
    554. }

libavformat/aviobuf.c:443:1: start of procedure avio_r8()
      441. 
      442. /* XXX: put an inline version */
      443. int avio_r8(AVIOContext *s)
           ^
      444. {
      445.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:445:9: Taking false branch
      443. int avio_r8(AVIOContext *s)
      444. {
      445.     if (s->buf_ptr >= s->buf_end)
                   ^
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:447:9: Taking true branch
      445.     if (s->buf_ptr >= s->buf_end)
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)
                   ^
      448.         return *s->buf_ptr++;
      449.     return 0;

libavformat/aviobuf.c:448:9: 
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)
      448.         return *s->buf_ptr++;
                   ^
      449.     return 0;
      450. }

libavformat/aviobuf.c:450:1: return from a call to avio_r8
      448.         return *s->buf_ptr++;
      449.     return 0;
      450. }
           ^
      451. 
      452. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:553:5: 
    551.     val = avio_r8(s);
    552.     val |= avio_r8(s) << 8;
    553.     return val;
             ^
    554. }
    555. 

libavformat/aviobuf.c:554:1: return from a call to avio_rl16
    552.     val |= avio_r8(s) << 8;
    553.     return val;
    554. }
         ^
    555. 
    556. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:568:5: 
  566.     unsigned int val;
  567.     val = avio_rl16(s);
  568.     val |= avio_rl16(s) << 16;
           ^
  569.     return val;
  570. }

libavformat/aviobuf.c:548:1: start of procedure avio_rl16()
    546. }
    547. 
    548. unsigned int avio_rl16(AVIOContext *s)
         ^
    549. {
    550.     unsigned int val;

libavformat/aviobuf.c:551:5: 
    549. {
    550.     unsigned int val;
    551.     val = avio_r8(s);
             ^
    552.     val |= avio_r8(s) << 8;
    553.     return val;

libavformat/aviobuf.c:443:1: start of procedure avio_r8()
      441. 
      442. /* XXX: put an inline version */
      443. int avio_r8(AVIOContext *s)
           ^
      444. {
      445.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:445:9: Taking false branch
      443. int avio_r8(AVIOContext *s)
      444. {
      445.     if (s->buf_ptr >= s->buf_end)
                   ^
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:447:9: Taking true branch
      445.     if (s->buf_ptr >= s->buf_end)
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)
                   ^
      448.         return *s->buf_ptr++;
      449.     return 0;

libavformat/aviobuf.c:448:9: 
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)
      448.         return *s->buf_ptr++;
                   ^
      449.     return 0;
      450. }

libavformat/aviobuf.c:450:1: return from a call to avio_r8
      448.         return *s->buf_ptr++;
      449.     return 0;
      450. }
           ^
      451. 
      452. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:552:5: 
    550.     unsigned int val;
    551.     val = avio_r8(s);
    552.     val |= avio_r8(s) << 8;
             ^
    553.     return val;
    554. }

libavformat/aviobuf.c:443:1: start of procedure avio_r8()
      441. 
      442. /* XXX: put an inline version */
      443. int avio_r8(AVIOContext *s)
           ^
      444. {
      445.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:445:9: Taking false branch
      443. int avio_r8(AVIOContext *s)
      444. {
      445.     if (s->buf_ptr >= s->buf_end)
                   ^
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:447:9: Taking true branch
      445.     if (s->buf_ptr >= s->buf_end)
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)
                   ^
      448.         return *s->buf_ptr++;
      449.     return 0;

libavformat/aviobuf.c:448:9: 
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)
      448.         return *s->buf_ptr++;
                   ^
      449.     return 0;
      450. }

libavformat/aviobuf.c:450:1: return from a call to avio_r8
      448.         return *s->buf_ptr++;
      449.     return 0;
      450. }
           ^
      451. 
      452. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:553:5: 
    551.     val = avio_r8(s);
    552.     val |= avio_r8(s) << 8;
    553.     return val;
             ^
    554. }
    555. 

libavformat/aviobuf.c:554:1: return from a call to avio_rl16
    552.     val |= avio_r8(s) << 8;
    553.     return val;
    554. }
         ^
    555. 
    556. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:569:5: 
  567.     val = avio_rl16(s);
  568.     val |= avio_rl16(s) << 16;
  569.     return val;
           ^
  570. }
  571. 

libavformat/aviobuf.c:570:1: return from a call to avio_rl32
  568.     val |= avio_rl16(s) << 16;
  569.     return val;
  570. }
       ^
  571. 
  572. uint64_t avio_rl64(AVIOContext *s)

libavformat/smacker.c:315:22: Taking false branch
313. 
314.                 size = avio_rl32(s->pb) - 4;
315.                 if (!size || size > frame_size) {
                          ^
316.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");
317.                     return AVERROR_INVALIDDATA;

libavformat/smacker.c:315:30: Taking false branch
313. 
314.                 size = avio_rl32(s->pb) - 4;
315.                 if (!size || size > frame_size) {
                                  ^
316.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");
317.                     return AVERROR_INVALIDDATA;

libavformat/smacker.c:319:17: 
317.                     return AVERROR_INVALIDDATA;
318.                 }
319.                 frame_size -= size;
                     ^
320.                 frame_size -= 4;
321.                 smk->curstream++;

libavformat/smacker.c:320:17: 
318.                 }
319.                 frame_size -= size;
320.                 frame_size -= 4;
                     ^
321.                 smk->curstream++;
322.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0) {

libavformat/smacker.c:321:17: 
319.                 frame_size -= size;
320.                 frame_size -= 4;
321.                 smk->curstream++;
                     ^
322.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0) {
323.                     smk->buf_sizes[smk->curstream] = 0;

libavformat/smacker.c:322:21: 
320.                 frame_size -= 4;
321.                 smk->curstream++;
322.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0) {
                         ^
323.                     smk->buf_sizes[smk->curstream] = 0;
324.                     return err;

libavutil/mem.c:140:1: start of procedure av_reallocp()
  138. }
  139. 
  140. int av_reallocp(void *ptr, size_t size)
       ^
  141. {
  142.     void **ptrptr = ptr;

libavutil/mem.c:142:5: 
  140. int av_reallocp(void *ptr, size_t size)
  141. {
  142.     void **ptrptr = ptr;
           ^
  143.     void *ret;
  144. 

libavutil/mem.c:145:10: Taking false branch
  143.     void *ret;
  144. 
  145.     if (!size) {
                ^
  146.         av_freep(ptr);
  147.         return 0;

libavutil/mem.c:149:5: 
  147.         return 0;
  148.     }
  149.     ret = av_realloc(*ptrptr, size);
           ^
  150. 
  151.     if (!ret) {

libavutil/mem.c:117:1: start of procedure av_realloc()
    115. }
    116. 
    117. void *av_realloc(void *ptr, size_t size)
         ^
    118. {
    119. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:124:9: Taking false branch
    122. 
    123.     /* let's disallow possibly ambiguous cases */
    124.     if (size > (INT_MAX - 16))
                 ^
    125.         return NULL;
    126. 

libavutil/mem.c:136:5: 
    134.     return _aligned_realloc(ptr, size, 32);
    135. #else
    136.     return realloc(ptr, size);
             ^
    137. #endif
    138. }

libavutil/mem.c:138:1: return from a call to av_realloc
    136.     return realloc(ptr, size);
    137. #endif
    138. }
         ^
    139. 
    140. int av_reallocp(void *ptr, size_t size)

libavutil/mem.c:151:10: Taking false branch
  149.     ret = av_realloc(*ptrptr, size);
  150. 
  151.     if (!ret) {
                ^
  152.         av_freep(ptr);
  153.         return AVERROR(ENOMEM);

libavutil/mem.c:156:5: 
  154.     }
  155. 
  156.     *ptrptr = ret;
           ^
  157.     return 0;
  158. }

libavutil/mem.c:157:5: 
  155. 
  156.     *ptrptr = ret;
  157.     return 0;
           ^
  158. }
  159. 

libavutil/mem.c:158:1: return from a call to av_reallocp
  156.     *ptrptr = ret;
  157.     return 0;
  158. }
       ^
  159. 
  160. void *av_realloc_array(void *ptr, size_t nmemb, size_t size)

libavformat/smacker.c:322:21: Taking false branch
320.                 frame_size -= 4;
321.                 smk->curstream++;
322.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0) {
                         ^
323.                     smk->buf_sizes[smk->curstream] = 0;
324.                     return err;

libavformat/smacker.c:326:17: 
324.                     return err;
325.                 }
326.                 smk->buf_sizes[smk->curstream] = size;
                     ^
327.                 ret = avio_read(s->pb, smk->bufs[smk->curstream], size);
328.                 if(ret != size)

libavformat/smacker.c:327:17: Skipping avio_read(): empty list of specs
325.                 }
326.                 smk->buf_sizes[smk->curstream] = size;
327.                 ret = avio_read(s->pb, smk->bufs[smk->curstream], size);
                     ^
328.                 if(ret != size)
329.                     return AVERROR(EIO);

libavformat/smacker.c:328:20: Taking false branch
326.                 smk->buf_sizes[smk->curstream] = size;
327.                 ret = avio_read(s->pb, smk->bufs[smk->curstream], size);
328.                 if(ret != size)
                        ^
329.                     return AVERROR(EIO);
330.                 smk->stream_id[smk->curstream] = smk->indexes[i];

libavformat/smacker.c:330:17: 
328.                 if(ret != size)
329.                     return AVERROR(EIO);
330.                 smk->stream_id[smk->curstream] = smk->indexes[i];
                     ^
331.             }
332.             flags >>= 1;

libavformat/smacker.c:332:13: 
330.                 smk->stream_id[smk->curstream] = smk->indexes[i];
331.             }
332.             flags >>= 1;
                 ^
333.         }
334.         if (frame_size < 0 || frame_size >= INT_MAX/2)

libavformat/smacker.c:309:27: 
307.         smk->curstream = -1;
308.         /* if audio chunks are present, put them to stack and retrieve later */
309.         for(i = 0; i < 7; i++) {
                               ^
310.             if(flags & 1) {
311.                 uint32_t size;

libavformat/smacker.c:309:20: Loop condition is true. Entering loop body
307.         smk->curstream = -1;
308.         /* if audio chunks are present, put them to stack and retrieve later */
309.         for(i = 0; i < 7; i++) {
                        ^
310.             if(flags & 1) {
311.                 uint32_t size;

libavformat/smacker.c:310:16: Taking true branch
308.         /* if audio chunks are present, put them to stack and retrieve later */
309.         for(i = 0; i < 7; i++) {
310.             if(flags & 1) {
                    ^
311.                 uint32_t size;
312.                 int err;

libavformat/smacker.c:314:17: 
312.                 int err;
313. 
314.                 size = avio_rl32(s->pb) - 4;
                     ^
315.                 if (!size || size > frame_size) {
316.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");

libavformat/aviobuf.c:564:1: start of procedure avio_rl32()
  562. }
  563. 
  564. unsigned int avio_rl32(AVIOContext *s)
       ^
  565. {
  566.     unsigned int val;

libavformat/aviobuf.c:567:5: 
  565. {
  566.     unsigned int val;
  567.     val = avio_rl16(s);
           ^
  568.     val |= avio_rl16(s) << 16;
  569.     return val;

libavformat/aviobuf.c:548:1: start of procedure avio_rl16()
    546. }
    547. 
    548. unsigned int avio_rl16(AVIOContext *s)
         ^
    549. {
    550.     unsigned int val;

libavformat/aviobuf.c:551:5: 
    549. {
    550.     unsigned int val;
    551.     val = avio_r8(s);
             ^
    552.     val |= avio_r8(s) << 8;
    553.     return val;

libavformat/aviobuf.c:443:1: start of procedure avio_r8()
      441. 
      442. /* XXX: put an inline version */
      443. int avio_r8(AVIOContext *s)
           ^
      444. {
      445.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:445:9: Taking false branch
      443. int avio_r8(AVIOContext *s)
      444. {
      445.     if (s->buf_ptr >= s->buf_end)
                   ^
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:447:9: Taking true branch
      445.     if (s->buf_ptr >= s->buf_end)
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)
                   ^
      448.         return *s->buf_ptr++;
      449.     return 0;

libavformat/aviobuf.c:448:9: 
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)
      448.         return *s->buf_ptr++;
                   ^
      449.     return 0;
      450. }

libavformat/aviobuf.c:450:1: return from a call to avio_r8
      448.         return *s->buf_ptr++;
      449.     return 0;
      450. }
           ^
      451. 
      452. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:552:5: 
    550.     unsigned int val;
    551.     val = avio_r8(s);
    552.     val |= avio_r8(s) << 8;
             ^
    553.     return val;
    554. }

libavformat/aviobuf.c:443:1: start of procedure avio_r8()
      441. 
      442. /* XXX: put an inline version */
      443. int avio_r8(AVIOContext *s)
           ^
      444. {
      445.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:445:9: Taking false branch
      443. int avio_r8(AVIOContext *s)
      444. {
      445.     if (s->buf_ptr >= s->buf_end)
                   ^
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:447:9: Taking true branch
      445.     if (s->buf_ptr >= s->buf_end)
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)
                   ^
      448.         return *s->buf_ptr++;
      449.     return 0;

libavformat/aviobuf.c:448:9: 
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)
      448.         return *s->buf_ptr++;
                   ^
      449.     return 0;
      450. }

libavformat/aviobuf.c:450:1: return from a call to avio_r8
      448.         return *s->buf_ptr++;
      449.     return 0;
      450. }
           ^
      451. 
      452. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:553:5: 
    551.     val = avio_r8(s);
    552.     val |= avio_r8(s) << 8;
    553.     return val;
             ^
    554. }
    555. 

libavformat/aviobuf.c:554:1: return from a call to avio_rl16
    552.     val |= avio_r8(s) << 8;
    553.     return val;
    554. }
         ^
    555. 
    556. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:568:5: 
  566.     unsigned int val;
  567.     val = avio_rl16(s);
  568.     val |= avio_rl16(s) << 16;
           ^
  569.     return val;
  570. }

libavformat/aviobuf.c:548:1: start of procedure avio_rl16()
    546. }
    547. 
    548. unsigned int avio_rl16(AVIOContext *s)
         ^
    549. {
    550.     unsigned int val;

libavformat/aviobuf.c:551:5: 
    549. {
    550.     unsigned int val;
    551.     val = avio_r8(s);
             ^
    552.     val |= avio_r8(s) << 8;
    553.     return val;

libavformat/aviobuf.c:443:1: start of procedure avio_r8()
      441. 
      442. /* XXX: put an inline version */
      443. int avio_r8(AVIOContext *s)
           ^
      444. {
      445.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:445:9: Taking false branch
      443. int avio_r8(AVIOContext *s)
      444. {
      445.     if (s->buf_ptr >= s->buf_end)
                   ^
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:447:9: Taking true branch
      445.     if (s->buf_ptr >= s->buf_end)
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)
                   ^
      448.         return *s->buf_ptr++;
      449.     return 0;

libavformat/aviobuf.c:448:9: 
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)
      448.         return *s->buf_ptr++;
                   ^
      449.     return 0;
      450. }

libavformat/aviobuf.c:450:1: return from a call to avio_r8
      448.         return *s->buf_ptr++;
      449.     return 0;
      450. }
           ^
      451. 
      452. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:552:5: 
    550.     unsigned int val;
    551.     val = avio_r8(s);
    552.     val |= avio_r8(s) << 8;
             ^
    553.     return val;
    554. }

libavformat/aviobuf.c:443:1: start of procedure avio_r8()
      441. 
      442. /* XXX: put an inline version */
      443. int avio_r8(AVIOContext *s)
           ^
      444. {
      445.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:445:9: Taking false branch
      443. int avio_r8(AVIOContext *s)
      444. {
      445.     if (s->buf_ptr >= s->buf_end)
                   ^
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:447:9: Taking true branch
      445.     if (s->buf_ptr >= s->buf_end)
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)
                   ^
      448.         return *s->buf_ptr++;
      449.     return 0;

libavformat/aviobuf.c:448:9: 
      446.         fill_buffer(s);
      447.     if (s->buf_ptr < s->buf_end)
      448.         return *s->buf_ptr++;
                   ^
      449.     return 0;
      450. }

libavformat/aviobuf.c:450:1: return from a call to avio_r8
      448.         return *s->buf_ptr++;
      449.     return 0;
      450. }
           ^
      451. 
      452. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:553:5: 
    551.     val = avio_r8(s);
    552.     val |= avio_r8(s) << 8;
    553.     return val;
             ^
    554. }
    555. 

libavformat/aviobuf.c:554:1: return from a call to avio_rl16
    552.     val |= avio_r8(s) << 8;
    553.     return val;
    554. }
         ^
    555. 
    556. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:569:5: 
  567.     val = avio_rl16(s);
  568.     val |= avio_rl16(s) << 16;
  569.     return val;
           ^
  570. }
  571. 

libavformat/aviobuf.c:570:1: return from a call to avio_rl32
  568.     val |= avio_rl16(s) << 16;
  569.     return val;
  570. }
       ^
  571. 
  572. uint64_t avio_rl64(AVIOContext *s)

libavformat/smacker.c:315:22: Taking false branch
313. 
314.                 size = avio_rl32(s->pb) - 4;
315.                 if (!size || size > frame_size) {
                          ^
316.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");
317.                     return AVERROR_INVALIDDATA;

libavformat/smacker.c:315:30: Taking false branch
313. 
314.                 size = avio_rl32(s->pb) - 4;
315.                 if (!size || size > frame_size) {
                                  ^
316.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");
317.                     return AVERROR_INVALIDDATA;

libavformat/smacker.c:319:17: 
317.                     return AVERROR_INVALIDDATA;
318.                 }
319.                 frame_size -= size;
                     ^
320.                 frame_size -= 4;
321.                 smk->curstream++;

libavformat/smacker.c:320:17: 
318.                 }
319.                 frame_size -= size;
320.                 frame_size -= 4;
                     ^
321.                 smk->curstream++;
322.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0) {

libavformat/smacker.c:321:17: 
319.                 frame_size -= size;
320.                 frame_size -= 4;
321.                 smk->curstream++;
                     ^
322.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0) {
323.                     smk->buf_sizes[smk->curstream] = 0;

libavformat/smacker.c:322:21: 
320.                 frame_size -= 4;
321.                 smk->curstream++;
322.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0) {
                         ^
323.                     smk->buf_sizes[smk->curstream] = 0;
324.                     return err;

libavutil/mem.c:140:1: start of procedure av_reallocp()
  138. }
  139. 
  140. int av_reallocp(void *ptr, size_t size)
       ^
  141. {
  142.     void **ptrptr = ptr;

libavutil/mem.c:142:5: 
  140. int av_reallocp(void *ptr, size_t size)
  141. {
  142.     void **ptrptr = ptr;
           ^
  143.     void *ret;
  144. 

libavutil/mem.c:145:10: Taking false branch
  143.     void *ret;
  144. 
  145.     if (!size) {
                ^
  146.         av_freep(ptr);
  147.         return 0;

libavutil/mem.c:149:5: 
  147.         return 0;
  148.     }
  149.     ret = av_realloc(*ptrptr, size);
           ^
  150. 
  151.     if (!ret) {

libavutil/mem.c:117:1: start of procedure av_realloc()
    115. }
    116. 
    117. void *av_realloc(void *ptr, size_t size)
         ^
    118. {
    119. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:124:9: Taking false branch
    122. 
    123.     /* let's disallow possibly ambiguous cases */
    124.     if (size > (INT_MAX - 16))
                 ^
    125.         return NULL;
    126. 

libavutil/mem.c:136:5: 
    134.     return _aligned_realloc(ptr, size, 32);
    135. #else
    136.     return realloc(ptr, size);
             ^
    137. #endif
    138. }

libavutil/mem.c:138:1: return from a call to av_realloc
    136.     return realloc(ptr, size);
    137. #endif
    138. }
         ^
    139. 
    140. int av_reallocp(void *ptr, size_t size)

libavutil/mem.c:151:10: Taking false branch
  149.     ret = av_realloc(*ptrptr, size);
  150. 
  151.     if (!ret) {
                ^
  152.         av_freep(ptr);
  153.         return AVERROR(ENOMEM);

libavutil/mem.c:156:5: 
  154.     }
  155. 
  156.     *ptrptr = ret;
           ^
  157.     return 0;
  158. }

libavutil/mem.c:157:5: 
  155. 
  156.     *ptrptr = ret;
  157.     return 0;
           ^
  158. }
  159. 

libavutil/mem.c:158:1: return from a call to av_reallocp
  156.     *ptrptr = ret;
  157.     return 0;
  158. }
       ^
  159. 
  160. void *av_realloc_array(void *ptr, size_t nmemb, size_t size)
