libavformat/movenchint.c:243: error: Use After Free
  call to `sample_queue_pop()` eventually accesses memory that was invalidated by call to `free()` on line 243 indirectly during the call to `sample_queue_pop()`.

libavformat/movenchint.c:214:1: invalidation part of the trace starts here
212.  * @return 0 if a match was found, < 0 if no match was found
213.  */
214. static int find_sample_match(const uint8_t *data, int len,
     ^
215.                              HintSampleQueue *queue, int *pos,
216.                              int *match_sample, int *match_offset,

libavformat/movenchint.c:214:1: parameter `queue` of find_sample_match
  212.  * @return 0 if a match was found, < 0 if no match was found
  213.  */
  214. static int find_sample_match(const uint8_t *data, int len,
       ^
  215.                              HintSampleQueue *queue, int *pos,
  216.                              int *match_sample, int *match_offset,

libavformat/movenchint.c:243:13: when calling `sample_queue_pop` here
  241.         } else {
  242.             /* No match for this sample, remove it */
  243.             sample_queue_pop(queue);
                   ^
  244.         }
  245.     }

libavformat/movenchint.c:70:1: parameter `queue` of sample_queue_pop
    68.  * Remove the first sample from the sample queue.
    69.  */
    70. static void sample_queue_pop(HintSampleQueue *queue)
        ^
    71. {
    72.     if (queue->len <= 0)

libavformat/movenchint.c:75:9: when calling `av_free` here
    73.         return;
    74.     if (queue->samples[0].own_data)
    75.         av_free(queue->samples[0].data);
                ^
    76.     queue->len--;
    77.     memmove(queue->samples, queue->samples + 1, sizeof(HintSample)*queue->len);

libavutil/mem.c:170:1: parameter `ptr` of av_free
      168. }
      169. 
      170. void av_free(void *ptr)
           ^
      171. {
      172. #if HAVE_ALIGNED_MALLOC

libavutil/mem.c:175:5: was invalidated by call to `free()`
      173.     _aligned_free(ptr);
      174. #else
      175.     free(ptr);
               ^
      176. #endif
      177. }

libavformat/movenchint.c:214:1: use-after-lifetime part of the trace starts here
212.  * @return 0 if a match was found, < 0 if no match was found
213.  */
214. static int find_sample_match(const uint8_t *data, int len,
     ^
215.                              HintSampleQueue *queue, int *pos,
216.                              int *match_sample, int *match_offset,

libavformat/movenchint.c:214:1: parameter `queue` of find_sample_match
  212.  * @return 0 if a match was found, < 0 if no match was found
  213.  */
  214. static int find_sample_match(const uint8_t *data, int len,
       ^
  215.                              HintSampleQueue *queue, int *pos,
  216.                              int *match_sample, int *match_offset,

libavformat/movenchint.c:243:13: when calling `sample_queue_pop` here
  241.         } else {
  242.             /* No match for this sample, remove it */
  243.             sample_queue_pop(queue);
                   ^
  244.         }
  245.     }

libavformat/movenchint.c:70:1: parameter `queue` of sample_queue_pop
    68.  * Remove the first sample from the sample queue.
    69.  */
    70. static void sample_queue_pop(HintSampleQueue *queue)
        ^
    71. {
    72.     if (queue->len <= 0)

libavformat/movenchint.c:75:9: when calling `av_free` here
    73.         return;
    74.     if (queue->samples[0].own_data)
    75.         av_free(queue->samples[0].data);
                ^
    76.     queue->len--;
    77.     memmove(queue->samples, queue->samples + 1, sizeof(HintSample)*queue->len);

libavutil/mem.c:170:1: parameter `ptr` of av_free
      168. }
      169. 
      170. void av_free(void *ptr)
           ^
      171. {
      172. #if HAVE_ALIGNED_MALLOC

libavutil/mem.c:175:5: invalid access occurs here
      173.     _aligned_free(ptr);
      174. #else
      175.     free(ptr);
               ^
      176. #endif
      177. }
