libavformat/smacker.c:318: error: Memory Leak
  memory dynamically allocated by call to `av_reallocp()` at line 318, column 28 is not reachable after line 318, column 28.

libavformat/smacker.c:240:1: start of procedure smacker_read_packet()
238. 
239. 
240. static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
     ^
241. {
242.     SmackerContext *smk = s->priv_data;

libavformat/smacker.c:242:5: 
240. static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
241. {
242.     SmackerContext *smk = s->priv_data;
         ^
243.     int flags;
244.     int ret;

libavformat/smacker.c:246:5: 
244.     int ret;
245.     int i;
246.     int frame_size = 0;
         ^
247.     int palchange = 0;
248. 

libavformat/smacker.c:247:5: 
245.     int i;
246.     int frame_size = 0;
247.     int palchange = 0;
         ^
248. 
249.     if (s->pb->eof_reached || smk->cur_frame >= smk->frames)

libavformat/smacker.c:249:9: Taking false branch
247.     int palchange = 0;
248. 
249.     if (s->pb->eof_reached || smk->cur_frame >= smk->frames)
             ^
250.         return AVERROR_EOF;
251. 

libavformat/smacker.c:249:31: Taking false branch
247.     int palchange = 0;
248. 
249.     if (s->pb->eof_reached || smk->cur_frame >= smk->frames)
                                   ^
250.         return AVERROR_EOF;
251. 

libavformat/smacker.c:253:8: Taking true branch
251. 
252.     /* if we demuxed all streams, pass another frame */
253.     if(smk->curstream < 0) {
            ^
254.         avio_seek(s->pb, smk->nextpos, 0);
255.         frame_size = smk->frm_size[smk->cur_frame] & (~3);

libavformat/smacker.c:254:9: Skipping avio_seek(): empty list of specs
252.     /* if we demuxed all streams, pass another frame */
253.     if(smk->curstream < 0) {
254.         avio_seek(s->pb, smk->nextpos, 0);
             ^
255.         frame_size = smk->frm_size[smk->cur_frame] & (~3);
256.         flags = smk->frm_flags[smk->cur_frame];

libavformat/smacker.c:255:9: 
253.     if(smk->curstream < 0) {
254.         avio_seek(s->pb, smk->nextpos, 0);
255.         frame_size = smk->frm_size[smk->cur_frame] & (~3);
             ^
256.         flags = smk->frm_flags[smk->cur_frame];
257.         /* handle palette change event */

libavformat/smacker.c:256:9: 
254.         avio_seek(s->pb, smk->nextpos, 0);
255.         frame_size = smk->frm_size[smk->cur_frame] & (~3);
256.         flags = smk->frm_flags[smk->cur_frame];
             ^
257.         /* handle palette change event */
258.         if(flags & SMACKER_PAL){

libavformat/smacker.c:258:12: Taking false branch
256.         flags = smk->frm_flags[smk->cur_frame];
257.         /* handle palette change event */
258.         if(flags & SMACKER_PAL){
                ^
259.             int size, sz, t, off, j, pos;
260.             uint8_t *pal = smk->pal;

libavformat/smacker.c:302:9: 
300.             palchange |= 1;
301.         }
302.         flags >>= 1;
             ^
303.         smk->curstream = -1;
304.         /* if audio chunks are present, put them to stack and retrieve later */

libavformat/smacker.c:303:9: 
301.         }
302.         flags >>= 1;
303.         smk->curstream = -1;
             ^
304.         /* if audio chunks are present, put them to stack and retrieve later */
305.         for(i = 0; i < 7; i++) {

libavformat/smacker.c:305:13: 
303.         smk->curstream = -1;
304.         /* if audio chunks are present, put them to stack and retrieve later */
305.         for(i = 0; i < 7; i++) {
                 ^
306.             if(flags & 1) {
307.                 uint32_t size;

libavformat/smacker.c:305:20: Loop condition is true. Entering loop body
303.         smk->curstream = -1;
304.         /* if audio chunks are present, put them to stack and retrieve later */
305.         for(i = 0; i < 7; i++) {
                        ^
306.             if(flags & 1) {
307.                 uint32_t size;

libavformat/smacker.c:306:16: Taking true branch
304.         /* if audio chunks are present, put them to stack and retrieve later */
305.         for(i = 0; i < 7; i++) {
306.             if(flags & 1) {
                    ^
307.                 uint32_t size;
308.                 int err;

libavformat/smacker.c:310:17: 
308.                 int err;
309. 
310.                 size = avio_rl32(s->pb) - 4;
                     ^
311.                 if (!size || size > frame_size) {
312.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");

libavformat/aviobuf.c:558:1: start of procedure avio_rl32()
  556. }
  557. 
  558. unsigned int avio_rl32(AVIOContext *s)
       ^
  559. {
  560.     unsigned int val;

libavformat/aviobuf.c:561:5: 
  559. {
  560.     unsigned int val;
  561.     val = avio_rl16(s);
           ^
  562.     val |= avio_rl16(s) << 16;
  563.     return val;

libavformat/aviobuf.c:542:1: start of procedure avio_rl16()
    540. }
    541. 
    542. unsigned int avio_rl16(AVIOContext *s)
         ^
    543. {
    544.     unsigned int val;

libavformat/aviobuf.c:545:5: 
    543. {
    544.     unsigned int val;
    545.     val = avio_r8(s);
             ^
    546.     val |= avio_r8(s) << 8;
    547.     return val;

libavformat/aviobuf.c:437:1: start of procedure avio_r8()
      435. 
      436. /* XXX: put an inline version */
      437. int avio_r8(AVIOContext *s)
           ^
      438. {
      439.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:439:9: Taking false branch
      437. int avio_r8(AVIOContext *s)
      438. {
      439.     if (s->buf_ptr >= s->buf_end)
                   ^
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:441:9: Taking true branch
      439.     if (s->buf_ptr >= s->buf_end)
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
                   ^
      442.         return *s->buf_ptr++;
      443.     return 0;

libavformat/aviobuf.c:442:9: 
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
                   ^
      443.     return 0;
      444. }

libavformat/aviobuf.c:444:1: return from a call to avio_r8
      442.         return *s->buf_ptr++;
      443.     return 0;
      444. }
           ^
      445. 
      446. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:546:5: 
    544.     unsigned int val;
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
             ^
    547.     return val;
    548. }

libavformat/aviobuf.c:437:1: start of procedure avio_r8()
      435. 
      436. /* XXX: put an inline version */
      437. int avio_r8(AVIOContext *s)
           ^
      438. {
      439.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:439:9: Taking false branch
      437. int avio_r8(AVIOContext *s)
      438. {
      439.     if (s->buf_ptr >= s->buf_end)
                   ^
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:441:9: Taking true branch
      439.     if (s->buf_ptr >= s->buf_end)
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
                   ^
      442.         return *s->buf_ptr++;
      443.     return 0;

libavformat/aviobuf.c:442:9: 
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
                   ^
      443.     return 0;
      444. }

libavformat/aviobuf.c:444:1: return from a call to avio_r8
      442.         return *s->buf_ptr++;
      443.     return 0;
      444. }
           ^
      445. 
      446. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:547:5: 
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
    547.     return val;
             ^
    548. }
    549. 

libavformat/aviobuf.c:548:1: return from a call to avio_rl16
    546.     val |= avio_r8(s) << 8;
    547.     return val;
    548. }
         ^
    549. 
    550. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:562:5: 
  560.     unsigned int val;
  561.     val = avio_rl16(s);
  562.     val |= avio_rl16(s) << 16;
           ^
  563.     return val;
  564. }

libavformat/aviobuf.c:542:1: start of procedure avio_rl16()
    540. }
    541. 
    542. unsigned int avio_rl16(AVIOContext *s)
         ^
    543. {
    544.     unsigned int val;

libavformat/aviobuf.c:545:5: 
    543. {
    544.     unsigned int val;
    545.     val = avio_r8(s);
             ^
    546.     val |= avio_r8(s) << 8;
    547.     return val;

libavformat/aviobuf.c:437:1: start of procedure avio_r8()
      435. 
      436. /* XXX: put an inline version */
      437. int avio_r8(AVIOContext *s)
           ^
      438. {
      439.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:439:9: Taking false branch
      437. int avio_r8(AVIOContext *s)
      438. {
      439.     if (s->buf_ptr >= s->buf_end)
                   ^
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:441:9: Taking true branch
      439.     if (s->buf_ptr >= s->buf_end)
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
                   ^
      442.         return *s->buf_ptr++;
      443.     return 0;

libavformat/aviobuf.c:442:9: 
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
                   ^
      443.     return 0;
      444. }

libavformat/aviobuf.c:444:1: return from a call to avio_r8
      442.         return *s->buf_ptr++;
      443.     return 0;
      444. }
           ^
      445. 
      446. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:546:5: 
    544.     unsigned int val;
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
             ^
    547.     return val;
    548. }

libavformat/aviobuf.c:437:1: start of procedure avio_r8()
      435. 
      436. /* XXX: put an inline version */
      437. int avio_r8(AVIOContext *s)
           ^
      438. {
      439.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:439:9: Taking false branch
      437. int avio_r8(AVIOContext *s)
      438. {
      439.     if (s->buf_ptr >= s->buf_end)
                   ^
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:441:9: Taking true branch
      439.     if (s->buf_ptr >= s->buf_end)
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
                   ^
      442.         return *s->buf_ptr++;
      443.     return 0;

libavformat/aviobuf.c:442:9: 
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
                   ^
      443.     return 0;
      444. }

libavformat/aviobuf.c:444:1: return from a call to avio_r8
      442.         return *s->buf_ptr++;
      443.     return 0;
      444. }
           ^
      445. 
      446. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:547:5: 
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
    547.     return val;
             ^
    548. }
    549. 

libavformat/aviobuf.c:548:1: return from a call to avio_rl16
    546.     val |= avio_r8(s) << 8;
    547.     return val;
    548. }
         ^
    549. 
    550. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:563:5: 
  561.     val = avio_rl16(s);
  562.     val |= avio_rl16(s) << 16;
  563.     return val;
           ^
  564. }
  565. 

libavformat/aviobuf.c:564:1: return from a call to avio_rl32
  562.     val |= avio_rl16(s) << 16;
  563.     return val;
  564. }
       ^
  565. 
  566. uint64_t avio_rl64(AVIOContext *s)

libavformat/smacker.c:311:22: Taking false branch
309. 
310.                 size = avio_rl32(s->pb) - 4;
311.                 if (!size || size > frame_size) {
                          ^
312.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");
313.                     return AVERROR_INVALIDDATA;

libavformat/smacker.c:311:30: Taking false branch
309. 
310.                 size = avio_rl32(s->pb) - 4;
311.                 if (!size || size > frame_size) {
                                  ^
312.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");
313.                     return AVERROR_INVALIDDATA;

libavformat/smacker.c:315:17: 
313.                     return AVERROR_INVALIDDATA;
314.                 }
315.                 frame_size -= size;
                     ^
316.                 frame_size -= 4;
317.                 smk->curstream++;

libavformat/smacker.c:316:17: 
314.                 }
315.                 frame_size -= size;
316.                 frame_size -= 4;
                     ^
317.                 smk->curstream++;
318.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)

libavformat/smacker.c:317:17: 
315.                 frame_size -= size;
316.                 frame_size -= 4;
317.                 smk->curstream++;
                     ^
318.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)
319.                     return err;

libavformat/smacker.c:318:21: 
316.                 frame_size -= 4;
317.                 smk->curstream++;
318.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)
                         ^
319.                     return err;
320.                 smk->buf_sizes[smk->curstream] = size;

libavutil/mem.c:139:1: start of procedure av_reallocp()
  137. }
  138. 
  139. int av_reallocp(void *ptr, size_t size)
       ^
  140. {
  141.     void **ptrptr = ptr;

libavutil/mem.c:141:5: 
  139. int av_reallocp(void *ptr, size_t size)
  140. {
  141.     void **ptrptr = ptr;
           ^
  142.     void *ret;
  143. 

libavutil/mem.c:144:10: Taking false branch
  142.     void *ret;
  143. 
  144.     if (!size) {
                ^
  145.         av_freep(ptr);
  146.         return 0;

libavutil/mem.c:148:5: 
  146.         return 0;
  147.     }
  148.     ret = av_realloc(*ptrptr, size);
           ^
  149. 
  150.     if (!ret) {

libavutil/mem.c:116:1: start of procedure av_realloc()
    114. }
    115. 
    116. void *av_realloc(void *ptr, size_t size)
         ^
    117. {
    118. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:123:9: Taking false branch
    121. 
    122.     /* let's disallow possibly ambiguous cases */
    123.     if (size > (INT_MAX - 16))
                 ^
    124.         return NULL;
    125. 

libavutil/mem.c:135:5: 
    133.     return _aligned_realloc(ptr, size, 32);
    134. #else
    135.     return realloc(ptr, size);
             ^
    136. #endif
    137. }

libavutil/mem.c:137:1: return from a call to av_realloc
    135.     return realloc(ptr, size);
    136. #endif
    137. }
         ^
    138. 
    139. int av_reallocp(void *ptr, size_t size)

libavutil/mem.c:150:10: Taking false branch
  148.     ret = av_realloc(*ptrptr, size);
  149. 
  150.     if (!ret) {
                ^
  151.         av_freep(ptr);
  152.         return AVERROR(ENOMEM);

libavutil/mem.c:155:5: 
  153.     }
  154. 
  155.     *ptrptr = ret;
           ^
  156.     return 0;
  157. }

libavutil/mem.c:156:5: 
  154. 
  155.     *ptrptr = ret;
  156.     return 0;
           ^
  157. }
  158. 

libavutil/mem.c:157:1: return from a call to av_reallocp
  155.     *ptrptr = ret;
  156.     return 0;
  157. }
       ^
  158. 
  159. void *av_realloc_array(void *ptr, size_t nmemb, size_t size)

libavformat/smacker.c:318:21: Taking false branch
316.                 frame_size -= 4;
317.                 smk->curstream++;
318.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)
                         ^
319.                     return err;
320.                 smk->buf_sizes[smk->curstream] = size;

libavformat/smacker.c:320:17: 
318.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)
319.                     return err;
320.                 smk->buf_sizes[smk->curstream] = size;
                     ^
321.                 ret = avio_read(s->pb, smk->bufs[smk->curstream], size);
322.                 if(ret != size)

libavformat/smacker.c:321:17: Skipping avio_read(): empty list of specs
319.                     return err;
320.                 smk->buf_sizes[smk->curstream] = size;
321.                 ret = avio_read(s->pb, smk->bufs[smk->curstream], size);
                     ^
322.                 if(ret != size)
323.                     return AVERROR(EIO);

libavformat/smacker.c:322:20: Taking false branch
320.                 smk->buf_sizes[smk->curstream] = size;
321.                 ret = avio_read(s->pb, smk->bufs[smk->curstream], size);
322.                 if(ret != size)
                        ^
323.                     return AVERROR(EIO);
324.                 smk->stream_id[smk->curstream] = smk->indexes[i];

libavformat/smacker.c:324:17: 
322.                 if(ret != size)
323.                     return AVERROR(EIO);
324.                 smk->stream_id[smk->curstream] = smk->indexes[i];
                     ^
325.             }
326.             flags >>= 1;

libavformat/smacker.c:326:13: 
324.                 smk->stream_id[smk->curstream] = smk->indexes[i];
325.             }
326.             flags >>= 1;
                 ^
327.         }
328.         if (frame_size < 0 || frame_size >= INT_MAX/2)

libavformat/smacker.c:305:27: 
303.         smk->curstream = -1;
304.         /* if audio chunks are present, put them to stack and retrieve later */
305.         for(i = 0; i < 7; i++) {
                               ^
306.             if(flags & 1) {
307.                 uint32_t size;

libavformat/smacker.c:305:20: Loop condition is true. Entering loop body
303.         smk->curstream = -1;
304.         /* if audio chunks are present, put them to stack and retrieve later */
305.         for(i = 0; i < 7; i++) {
                        ^
306.             if(flags & 1) {
307.                 uint32_t size;

libavformat/smacker.c:306:16: Taking true branch
304.         /* if audio chunks are present, put them to stack and retrieve later */
305.         for(i = 0; i < 7; i++) {
306.             if(flags & 1) {
                    ^
307.                 uint32_t size;
308.                 int err;

libavformat/smacker.c:310:17: 
308.                 int err;
309. 
310.                 size = avio_rl32(s->pb) - 4;
                     ^
311.                 if (!size || size > frame_size) {
312.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");

libavformat/aviobuf.c:558:1: start of procedure avio_rl32()
  556. }
  557. 
  558. unsigned int avio_rl32(AVIOContext *s)
       ^
  559. {
  560.     unsigned int val;

libavformat/aviobuf.c:561:5: 
  559. {
  560.     unsigned int val;
  561.     val = avio_rl16(s);
           ^
  562.     val |= avio_rl16(s) << 16;
  563.     return val;

libavformat/aviobuf.c:542:1: start of procedure avio_rl16()
    540. }
    541. 
    542. unsigned int avio_rl16(AVIOContext *s)
         ^
    543. {
    544.     unsigned int val;

libavformat/aviobuf.c:545:5: 
    543. {
    544.     unsigned int val;
    545.     val = avio_r8(s);
             ^
    546.     val |= avio_r8(s) << 8;
    547.     return val;

libavformat/aviobuf.c:437:1: start of procedure avio_r8()
      435. 
      436. /* XXX: put an inline version */
      437. int avio_r8(AVIOContext *s)
           ^
      438. {
      439.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:439:9: Taking false branch
      437. int avio_r8(AVIOContext *s)
      438. {
      439.     if (s->buf_ptr >= s->buf_end)
                   ^
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:441:9: Taking true branch
      439.     if (s->buf_ptr >= s->buf_end)
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
                   ^
      442.         return *s->buf_ptr++;
      443.     return 0;

libavformat/aviobuf.c:442:9: 
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
                   ^
      443.     return 0;
      444. }

libavformat/aviobuf.c:444:1: return from a call to avio_r8
      442.         return *s->buf_ptr++;
      443.     return 0;
      444. }
           ^
      445. 
      446. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:546:5: 
    544.     unsigned int val;
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
             ^
    547.     return val;
    548. }

libavformat/aviobuf.c:437:1: start of procedure avio_r8()
      435. 
      436. /* XXX: put an inline version */
      437. int avio_r8(AVIOContext *s)
           ^
      438. {
      439.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:439:9: Taking false branch
      437. int avio_r8(AVIOContext *s)
      438. {
      439.     if (s->buf_ptr >= s->buf_end)
                   ^
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:441:9: Taking true branch
      439.     if (s->buf_ptr >= s->buf_end)
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
                   ^
      442.         return *s->buf_ptr++;
      443.     return 0;

libavformat/aviobuf.c:442:9: 
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
                   ^
      443.     return 0;
      444. }

libavformat/aviobuf.c:444:1: return from a call to avio_r8
      442.         return *s->buf_ptr++;
      443.     return 0;
      444. }
           ^
      445. 
      446. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:547:5: 
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
    547.     return val;
             ^
    548. }
    549. 

libavformat/aviobuf.c:548:1: return from a call to avio_rl16
    546.     val |= avio_r8(s) << 8;
    547.     return val;
    548. }
         ^
    549. 
    550. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:562:5: 
  560.     unsigned int val;
  561.     val = avio_rl16(s);
  562.     val |= avio_rl16(s) << 16;
           ^
  563.     return val;
  564. }

libavformat/aviobuf.c:542:1: start of procedure avio_rl16()
    540. }
    541. 
    542. unsigned int avio_rl16(AVIOContext *s)
         ^
    543. {
    544.     unsigned int val;

libavformat/aviobuf.c:545:5: 
    543. {
    544.     unsigned int val;
    545.     val = avio_r8(s);
             ^
    546.     val |= avio_r8(s) << 8;
    547.     return val;

libavformat/aviobuf.c:437:1: start of procedure avio_r8()
      435. 
      436. /* XXX: put an inline version */
      437. int avio_r8(AVIOContext *s)
           ^
      438. {
      439.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:439:9: Taking false branch
      437. int avio_r8(AVIOContext *s)
      438. {
      439.     if (s->buf_ptr >= s->buf_end)
                   ^
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:441:9: Taking true branch
      439.     if (s->buf_ptr >= s->buf_end)
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
                   ^
      442.         return *s->buf_ptr++;
      443.     return 0;

libavformat/aviobuf.c:442:9: 
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
                   ^
      443.     return 0;
      444. }

libavformat/aviobuf.c:444:1: return from a call to avio_r8
      442.         return *s->buf_ptr++;
      443.     return 0;
      444. }
           ^
      445. 
      446. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:546:5: 
    544.     unsigned int val;
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
             ^
    547.     return val;
    548. }

libavformat/aviobuf.c:437:1: start of procedure avio_r8()
      435. 
      436. /* XXX: put an inline version */
      437. int avio_r8(AVIOContext *s)
           ^
      438. {
      439.     if (s->buf_ptr >= s->buf_end)

libavformat/aviobuf.c:439:9: Taking false branch
      437. int avio_r8(AVIOContext *s)
      438. {
      439.     if (s->buf_ptr >= s->buf_end)
                   ^
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)

libavformat/aviobuf.c:441:9: Taking true branch
      439.     if (s->buf_ptr >= s->buf_end)
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
                   ^
      442.         return *s->buf_ptr++;
      443.     return 0;

libavformat/aviobuf.c:442:9: 
      440.         fill_buffer(s);
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
                   ^
      443.     return 0;
      444. }

libavformat/aviobuf.c:444:1: return from a call to avio_r8
      442.         return *s->buf_ptr++;
      443.     return 0;
      444. }
           ^
      445. 
      446. int avio_read(AVIOContext *s, unsigned char *buf, int size)

libavformat/aviobuf.c:547:5: 
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
    547.     return val;
             ^
    548. }
    549. 

libavformat/aviobuf.c:548:1: return from a call to avio_rl16
    546.     val |= avio_r8(s) << 8;
    547.     return val;
    548. }
         ^
    549. 
    550. unsigned int avio_rl24(AVIOContext *s)

libavformat/aviobuf.c:563:5: 
  561.     val = avio_rl16(s);
  562.     val |= avio_rl16(s) << 16;
  563.     return val;
           ^
  564. }
  565. 

libavformat/aviobuf.c:564:1: return from a call to avio_rl32
  562.     val |= avio_rl16(s) << 16;
  563.     return val;
  564. }
       ^
  565. 
  566. uint64_t avio_rl64(AVIOContext *s)

libavformat/smacker.c:311:22: Taking false branch
309. 
310.                 size = avio_rl32(s->pb) - 4;
311.                 if (!size || size > frame_size) {
                          ^
312.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");
313.                     return AVERROR_INVALIDDATA;

libavformat/smacker.c:311:30: Taking false branch
309. 
310.                 size = avio_rl32(s->pb) - 4;
311.                 if (!size || size > frame_size) {
                                  ^
312.                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");
313.                     return AVERROR_INVALIDDATA;

libavformat/smacker.c:315:17: 
313.                     return AVERROR_INVALIDDATA;
314.                 }
315.                 frame_size -= size;
                     ^
316.                 frame_size -= 4;
317.                 smk->curstream++;

libavformat/smacker.c:316:17: 
314.                 }
315.                 frame_size -= size;
316.                 frame_size -= 4;
                     ^
317.                 smk->curstream++;
318.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)

libavformat/smacker.c:317:17: 
315.                 frame_size -= size;
316.                 frame_size -= 4;
317.                 smk->curstream++;
                     ^
318.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)
319.                     return err;

libavformat/smacker.c:318:21: 
316.                 frame_size -= 4;
317.                 smk->curstream++;
318.                 if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)
                         ^
319.                     return err;
320.                 smk->buf_sizes[smk->curstream] = size;

libavutil/mem.c:139:1: start of procedure av_reallocp()
  137. }
  138. 
  139. int av_reallocp(void *ptr, size_t size)
       ^
  140. {
  141.     void **ptrptr = ptr;

libavutil/mem.c:141:5: 
  139. int av_reallocp(void *ptr, size_t size)
  140. {
  141.     void **ptrptr = ptr;
           ^
  142.     void *ret;
  143. 

libavutil/mem.c:144:10: Taking false branch
  142.     void *ret;
  143. 
  144.     if (!size) {
                ^
  145.         av_freep(ptr);
  146.         return 0;

libavutil/mem.c:148:5: 
  146.         return 0;
  147.     }
  148.     ret = av_realloc(*ptrptr, size);
           ^
  149. 
  150.     if (!ret) {

libavutil/mem.c:116:1: start of procedure av_realloc()
    114. }
    115. 
    116. void *av_realloc(void *ptr, size_t size)
         ^
    117. {
    118. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:123:9: Taking false branch
    121. 
    122.     /* let's disallow possibly ambiguous cases */
    123.     if (size > (INT_MAX - 16))
                 ^
    124.         return NULL;
    125. 

libavutil/mem.c:135:5: 
    133.     return _aligned_realloc(ptr, size, 32);
    134. #else
    135.     return realloc(ptr, size);
             ^
    136. #endif
    137. }

libavutil/mem.c:137:1: return from a call to av_realloc
    135.     return realloc(ptr, size);
    136. #endif
    137. }
         ^
    138. 
    139. int av_reallocp(void *ptr, size_t size)

libavutil/mem.c:150:10: Taking false branch
  148.     ret = av_realloc(*ptrptr, size);
  149. 
  150.     if (!ret) {
                ^
  151.         av_freep(ptr);
  152.         return AVERROR(ENOMEM);

libavutil/mem.c:155:5: 
  153.     }
  154. 
  155.     *ptrptr = ret;
           ^
  156.     return 0;
  157. }

libavutil/mem.c:156:5: 
  154. 
  155.     *ptrptr = ret;
  156.     return 0;
           ^
  157. }
  158. 

libavutil/mem.c:157:1: return from a call to av_reallocp
  155.     *ptrptr = ret;
  156.     return 0;
  157. }
       ^
  158. 
  159. void *av_realloc_array(void *ptr, size_t nmemb, size_t size)
