libavfilter/af_channelmap.c:350: error: Use After Free
  accessing memory that was invalidated by call to `free()` on line 341 indirectly during the call to `av_free()`.

libavfilter/af_channelmap.c:332:17: invalidation part of the trace starts here
330.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
331.             uint8_t **new_extended_data =
332.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                     ^
333.             if (!new_extended_data) {
334.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:332:17: passed as argument to `av_mallocz`
  330.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  331.             uint8_t **new_extended_data =
  332.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                       ^
  333.             if (!new_extended_data) {
  334.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:332:17: return from call to `av_mallocz`
  330.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  331.             uint8_t **new_extended_data =
  332.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                       ^
  333.             if (!new_extended_data) {
  334.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:331:13: assigned
  329.     if (nch_out > nch_in) {
  330.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  331.             uint8_t **new_extended_data =
                   ^
  332.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
  333.             if (!new_extended_data) {

libavfilter/af_channelmap.c:340:17: assigned
  338.                 buf->extended_data = new_extended_data;
  339.             } else {
  340.                 buf->extended_data = new_extended_data;
                       ^
  341.                 av_free(buf->extended_data);
  342.             }

libavfilter/af_channelmap.c:341:17: when calling `av_free` here
  339.             } else {
  340.                 buf->extended_data = new_extended_data;
  341.                 av_free(buf->extended_data);
                       ^
  342.             }
  343.         } else if (buf->extended_data != buf->data) {

libavutil/mem.c:143:1: parameter `ptr` of av_free
    141. }
    142. 
    143. void av_free(void *ptr)
         ^
    144. {
    145. #if CONFIG_MEMALIGN_HACK

libavutil/mem.c:151:5: was invalidated by call to `free()`
    149.     _aligned_free(ptr);
    150. #else
    151.     free(ptr);
             ^
    152. #endif
    153. }

libavfilter/af_channelmap.c:332:17: use-after-lifetime part of the trace starts here
330.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
331.             uint8_t **new_extended_data =
332.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                     ^
333.             if (!new_extended_data) {
334.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:332:17: passed as argument to `av_mallocz`
  330.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  331.             uint8_t **new_extended_data =
  332.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                       ^
  333.             if (!new_extended_data) {
  334.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:332:17: return from call to `av_mallocz`
  330.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  331.             uint8_t **new_extended_data =
  332.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
                       ^
  333.             if (!new_extended_data) {
  334.                 avfilter_unref_buffer(buf);

libavfilter/af_channelmap.c:331:13: assigned
  329.     if (nch_out > nch_in) {
  330.         if (nch_out > FF_ARRAY_ELEMS(buf->data)) {
  331.             uint8_t **new_extended_data =
                   ^
  332.                 av_mallocz(nch_out * sizeof(*buf->extended_data));
  333.             if (!new_extended_data) {

libavfilter/af_channelmap.c:340:17: assigned
  338.                 buf->extended_data = new_extended_data;
  339.             } else {
  340.                 buf->extended_data = new_extended_data;
                       ^
  341.                 av_free(buf->extended_data);
  342.             }

libavfilter/af_channelmap.c:350:9: invalid access occurs here
  348. 
  349.     for (ch = 0; ch < nch_out; ch++) {
  350.         buf->extended_data[s->map[ch].out_channel_idx] =
               ^
  351.             source_planes[s->map[ch].in_channel_idx];
  352.     }
