libavformat/movenchint.c:278: error: Use After Free
  call to `sample_queue_pop()` eventually accesses memory that was invalidated by call to `free()` on line 278 indirectly during the call to `sample_queue_pop()`.

libavformat/movenchint.c:249:1: invalidation part of the trace starts here
247.  * @return 0 if a match was found, < 0 if no match was found
248.  */
249. static int find_sample_match(const uint8_t *data, int len,
     ^
250.                              HintSampleQueue *queue, int *pos,
251.                              int *match_sample, int *match_offset,

libavformat/movenchint.c:249:1: parameter `queue` of find_sample_match
  247.  * @return 0 if a match was found, < 0 if no match was found
  248.  */
  249. static int find_sample_match(const uint8_t *data, int len,
       ^
  250.                              HintSampleQueue *queue, int *pos,
  251.                              int *match_sample, int *match_offset,

libavformat/movenchint.c:278:13: when calling `sample_queue_pop` here
  276.         } else {
  277.             /* No match for this sample, remove it */
  278.             sample_queue_pop(queue);
                   ^
  279.         }
  280.     }

libavformat/movenchint.c:105:1: parameter `queue` of sample_queue_pop
    103.  * Remove the first sample from the sample queue.
    104.  */
    105. static void sample_queue_pop(HintSampleQueue *queue)
         ^
    106. {
    107.     if (queue->len <= 0)

libavformat/movenchint.c:110:9: when calling `av_free` here
    108.         return;
    109.     if (queue->samples[0].own_data)
    110.         av_free(queue->samples[0].data);
                 ^
    111.     queue->len--;
    112.     memmove(queue->samples, queue->samples + 1, sizeof(HintSample)*queue->len);

libavutil/mem.c:139:1: parameter `ptr` of av_free
      137. }
      138. 
      139. void av_free(void *ptr)
           ^
      140. {
      141.     /* XXX: this test should not be needed on most libcs */

libavutil/mem.c:146:9: was invalidated by call to `free()`
      144.         free((char*)ptr - ((char*)ptr)[-1]);
      145. #else
      146.         free(ptr);
                   ^
      147. #endif
      148. }

libavformat/movenchint.c:249:1: use-after-lifetime part of the trace starts here
247.  * @return 0 if a match was found, < 0 if no match was found
248.  */
249. static int find_sample_match(const uint8_t *data, int len,
     ^
250.                              HintSampleQueue *queue, int *pos,
251.                              int *match_sample, int *match_offset,

libavformat/movenchint.c:249:1: parameter `queue` of find_sample_match
  247.  * @return 0 if a match was found, < 0 if no match was found
  248.  */
  249. static int find_sample_match(const uint8_t *data, int len,
       ^
  250.                              HintSampleQueue *queue, int *pos,
  251.                              int *match_sample, int *match_offset,

libavformat/movenchint.c:278:13: when calling `sample_queue_pop` here
  276.         } else {
  277.             /* No match for this sample, remove it */
  278.             sample_queue_pop(queue);
                   ^
  279.         }
  280.     }

libavformat/movenchint.c:105:1: parameter `queue` of sample_queue_pop
    103.  * Remove the first sample from the sample queue.
    104.  */
    105. static void sample_queue_pop(HintSampleQueue *queue)
         ^
    106. {
    107.     if (queue->len <= 0)

libavformat/movenchint.c:110:9: when calling `av_free` here
    108.         return;
    109.     if (queue->samples[0].own_data)
    110.         av_free(queue->samples[0].data);
                 ^
    111.     queue->len--;
    112.     memmove(queue->samples, queue->samples + 1, sizeof(HintSample)*queue->len);

libavutil/mem.c:139:1: parameter `ptr` of av_free
      137. }
      138. 
      139. void av_free(void *ptr)
           ^
      140. {
      141.     /* XXX: this test should not be needed on most libcs */

libavutil/mem.c:146:9: invalid access occurs here
      144.         free((char*)ptr - ((char*)ptr)[-1]);
      145. #else
      146.         free(ptr);
                   ^
      147. #endif
      148. }
