Merge remote-tracking branch 'aosp/master'

20 files changed, 188 insertions, 154 deletions

diff --git a/libAACdec/src/aacdec_hcr.cpp b/libAACdec/src/aacdec_hcr.cpp
index 84e05b0..6114756 100644
--- a/libAACdec/src/aacdec_hcr.cpp
+++ b/libAACdec/src/aacdec_hcr.cpp
@@ -134,17 +134,18 @@ static void DeriveNumberOfExtendedSortedSectionsInSets(
     USHORT *pNumExtendedSortedSectionsInSets,
     int numExtendedSortedSectionsInSetsIdx);
 
-static INT DecodeEscapeSequence(HANDLE_FDK_BITSTREAM bs, INT quantSpecCoef,
-                                INT *pLeftStartOfSegment,
+static INT DecodeEscapeSequence(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
+                                INT quantSpecCoef, INT *pLeftStartOfSegment,
                                 SCHAR *pRemainingBitsInSegment,
                                 int *pNumDecodedBits);
 
-static int DecodePCW_Sign(HANDLE_FDK_BITSTREAM bs, UINT codebookDim,
-                          const SCHAR *pQuantVal, FIXP_DBL *pQuantSpecCoef,
-                          int *quantSpecCoefIdx, INT *pLeftStartOfSegment,
+static int DecodePCW_Sign(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
+                          UINT codebookDim, const SCHAR *pQuantVal,
+                          FIXP_DBL *pQuantSpecCoef, int *quantSpecCoefIdx,
+                          INT *pLeftStartOfSegment,
                           SCHAR *pRemainingBitsInSegment, int *pNumDecodedBits);
 
-static const SCHAR *DecodePCW_Body(HANDLE_FDK_BITSTREAM bs,
+static const SCHAR *DecodePCW_Body(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
                                    const UINT *pCurrentTree,
                                    const SCHAR *pQuantValBase,
                                    INT *pLeftStartOfSegment,
@@ -291,7 +292,7 @@ UINT HcrInit(H_HCR_INFO pHcr, CAacDecoderChannelInfo *pAacDecoderChannelInfo,
       SPEC_LONG(pAacDecoderChannelInfo->pSpectralCoefficient);
 
   FDKsyncCache(bs);
-  pHcr->decInOut.bitstreamIndex = FDKgetBitCnt(bs);
+  pHcr->decInOut.bitstreamAnchor = (INT)FDKgetValidBits(bs);
 
   if (!IsLongBlock(&pAacDecoderChannelInfo->icsInfo)) /* short block */
   {
@@ -436,7 +437,7 @@ UINT HcrDecoder(H_HCR_INFO pHcr, CAacDecoderChannelInfo *pAacDecoderChannelInfo,
   int pTmp5;
 
   INT bitCntOffst;
-  INT saveBitCnt = FDKgetBitCnt(bs); /* save bitstream position */
+  INT saveBitCnt = (INT)FDKgetValidBits(bs); /* save bitstream position */
 
   HcrCalcNumCodeword(pHcr);
 
@@ -487,7 +488,7 @@ UINT HcrDecoder(H_HCR_INFO pHcr, CAacDecoderChannelInfo *pAacDecoderChannelInfo,
                                           pSamplingRateInfo);
 
   /* restore bitstream position */
-  bitCntOffst = saveBitCnt - FDKgetBitCnt(bs);
+  bitCntOffst = (INT)FDKgetValidBits(bs) - saveBitCnt;
   if (bitCntOffst) {
     FDKpushBiDirectional(bs, bitCntOffst);
   }
@@ -815,7 +816,6 @@ static void HcrPrepareSegmentationGrid(H_HCR_INFO pHcr) {
   INT *pLeftStartOfSegment = pHcr->segmentInfo.pLeftStartOfSegment;
   INT *pRightStartOfSegment = pHcr->segmentInfo.pRightStartOfSegment;
   SCHAR *pRemainingBitsInSegment = pHcr->segmentInfo.pRemainingBitsInSegment;
-  INT bitstreamIndex = pHcr->decInOut.bitstreamIndex;
   const UCHAR *pMaxCwLength = aMaxCwLen;
 
   for (i = numSortedSection; i != 0; i--) {
@@ -825,7 +825,7 @@ static void HcrPrepareSegmentationGrid(H_HCR_INFO pHcr) {
 
     for (j = *pNumSortedCodewordInSection; j != 0; j--) {
       /* width allows a new segment */
-      intermediateResult = bitstreamIndex + segmentStart;
+      intermediateResult = segmentStart;
       if ((segmentStart + segmentWidth) <= lengthOfReorderedSpectralData) {
         /* store segment start, segment length and increment the number of
          * segments */
@@ -841,12 +841,11 @@ static void HcrPrepareSegmentationGrid(H_HCR_INFO pHcr) {
         pLeftStartOfSegment--;
         pRightStartOfSegment--;
         pRemainingBitsInSegment--;
-        segmentStart = *pLeftStartOfSegment - bitstreamIndex;
+        segmentStart = *pLeftStartOfSegment;
 
         lastSegmentWidth = lengthOfReorderedSpectralData - segmentStart;
         *pRemainingBitsInSegment = lastSegmentWidth;
-        *pRightStartOfSegment =
-            bitstreamIndex + segmentStart + lastSegmentWidth - 1;
+        *pRightStartOfSegment = segmentStart + lastSegmentWidth - 1;
         endFlag = 1;
         break;
       }
@@ -1071,9 +1070,9 @@ static void DecodePCWs(HANDLE_FDK_BITSTREAM bs, H_HCR_INFO pHcr) {
         numDecodedBits = 0;
 
         /* decode PCW_BODY */
-        pQuantVal =
-            DecodePCW_Body(bs, pCurrentTree, pQuantValBase, pLeftStartOfSegment,
-                           pRemainingBitsInSegment, &numDecodedBits);
+        pQuantVal = DecodePCW_Body(
+            bs, pHcr->decInOut.bitstreamAnchor, pCurrentTree, pQuantValBase,
+            pLeftStartOfSegment, pRemainingBitsInSegment, &numDecodedBits);
 
         /* result is written out here because NO sign bits follow the body */
         for (i = dimension; i != 0; i--) {
@@ -1115,14 +1114,14 @@ static void DecodePCWs(HANDLE_FDK_BITSTREAM bs, H_HCR_INFO pHcr) {
         int err;
         numDecodedBits = 0;
 
-        pQuantVal =
-            DecodePCW_Body(bs, pCurrentTree, pQuantValBase, pLeftStartOfSegment,
-                           pRemainingBitsInSegment, &numDecodedBits);
+        pQuantVal = DecodePCW_Body(
+            bs, pHcr->decInOut.bitstreamAnchor, pCurrentTree, pQuantValBase,
+            pLeftStartOfSegment, pRemainingBitsInSegment, &numDecodedBits);
 
         err = DecodePCW_Sign(
-            bs, dimension, pQuantVal, pQuantizedSpectralCoefficients,
-            &quantizedSpectralCoefficientsIdx, pLeftStartOfSegment,
-            pRemainingBitsInSegment, &numDecodedBits);
+            bs, pHcr->decInOut.bitstreamAnchor, dimension, pQuantVal,
+            pQuantizedSpectralCoefficients, &quantizedSpectralCoefficientsIdx,
+            pLeftStartOfSegment, pRemainingBitsInSegment, &numDecodedBits);
         if (err != 0) {
           return;
         }
@@ -1157,14 +1156,14 @@ static void DecodePCWs(HANDLE_FDK_BITSTREAM bs, H_HCR_INFO pHcr) {
         numDecodedBits = 0;
 
         /* decode PCW_BODY */
-        pQuantVal =
-            DecodePCW_Body(bs, pCurrentTree, pQuantValBase, pLeftStartOfSegment,
-                           pRemainingBitsInSegment, &numDecodedBits);
+        pQuantVal = DecodePCW_Body(
+            bs, pHcr->decInOut.bitstreamAnchor, pCurrentTree, pQuantValBase,
+            pLeftStartOfSegment, pRemainingBitsInSegment, &numDecodedBits);
 
         err = DecodePCW_Sign(
-            bs, dimension, pQuantVal, pQuantizedSpectralCoefficients,
-            &quantizedSpectralCoefficientsIdx, pLeftStartOfSegment,
-            pRemainingBitsInSegment, &numDecodedBits);
+            bs, pHcr->decInOut.bitstreamAnchor, dimension, pQuantVal,
+            pQuantizedSpectralCoefficients, &quantizedSpectralCoefficientsIdx,
+            pLeftStartOfSegment, pRemainingBitsInSegment, &numDecodedBits);
         if (err != 0) {
           return;
         }
@@ -1177,7 +1176,7 @@ static void DecodePCWs(HANDLE_FDK_BITSTREAM bs, H_HCR_INFO pHcr) {
             (FIXP_DBL)ESCAPE_VALUE) {
           pQuantizedSpectralCoefficients[quantizedSpectralCoefficientsIdx] =
               (FIXP_DBL)DecodeEscapeSequence(
-                  bs,
+                  bs, pHcr->decInOut.bitstreamAnchor,
                   pQuantizedSpectralCoefficients
                       [quantizedSpectralCoefficientsIdx],
                   pLeftStartOfSegment, pRemainingBitsInSegment,
@@ -1193,7 +1192,7 @@ static void DecodePCWs(HANDLE_FDK_BITSTREAM bs, H_HCR_INFO pHcr) {
             (FIXP_DBL)ESCAPE_VALUE) {
           pQuantizedSpectralCoefficients[quantizedSpectralCoefficientsIdx] =
               (FIXP_DBL)DecodeEscapeSequence(
-                  bs,
+                  bs, pHcr->decInOut.bitstreamAnchor,
                   pQuantizedSpectralCoefficients
                       [quantizedSpectralCoefficientsIdx],
                   pLeftStartOfSegment, pRemainingBitsInSegment,
@@ -1331,7 +1330,7 @@ void CarryBitToBranchValue(UCHAR carryBit, UINT treeNode, UINT *branchValue,
 spectral coefficients
 --------------------------------------------------------------------------------------------
 */
-static const SCHAR *DecodePCW_Body(HANDLE_FDK_BITSTREAM bs,
+static const SCHAR *DecodePCW_Body(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
                                    const UINT *pCurrentTree,
                                    const SCHAR *pQuantValBase,
                                    INT *pLeftStartOfSegment,
@@ -1349,7 +1348,7 @@ static const SCHAR *DecodePCW_Body(HANDLE_FDK_BITSTREAM bs,
 
   /* decode whole PCW-codeword-body */
   while (1) {
-    carryBit = HcrGetABitFromBitstream(bs, pLeftStartOfSegment,
+    carryBit = HcrGetABitFromBitstream(bs, bsAnchor, pLeftStartOfSegment,
                                        pLeftStartOfSegment, /* dummy */
                                        FROM_LEFT_TO_RIGHT);
     *pRemainingBitsInSegment -= 1;
@@ -1384,8 +1383,8 @@ value == 16, a escapeSequence is decoded in two steps:
 --------------------------------------------------------------------------------------------
 */
 
-static INT DecodeEscapeSequence(HANDLE_FDK_BITSTREAM bs, INT quantSpecCoef,
-                                INT *pLeftStartOfSegment,
+static INT DecodeEscapeSequence(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
+                                INT quantSpecCoef, INT *pLeftStartOfSegment,
                                 SCHAR *pRemainingBitsInSegment,
                                 int *pNumDecodedBits) {
   UINT i;
@@ -1396,7 +1395,7 @@ static INT DecodeEscapeSequence(HANDLE_FDK_BITSTREAM bs, INT quantSpecCoef,
 
   /* decode escape prefix */
   while (1) {
-    carryBit = HcrGetABitFromBitstream(bs, pLeftStartOfSegment,
+    carryBit = HcrGetABitFromBitstream(bs, bsAnchor, pLeftStartOfSegment,
                                        pLeftStartOfSegment, /* dummy */
                                        FROM_LEFT_TO_RIGHT);
     *pRemainingBitsInSegment -= 1;
@@ -1412,7 +1411,7 @@ static INT DecodeEscapeSequence(HANDLE_FDK_BITSTREAM bs, INT quantSpecCoef,
 
   /* decode escape word */
   for (i = escapeOnesCounter; i != 0; i--) {
-    carryBit = HcrGetABitFromBitstream(bs, pLeftStartOfSegment,
+    carryBit = HcrGetABitFromBitstream(bs, bsAnchor, pLeftStartOfSegment,
                                        pLeftStartOfSegment, /* dummy */
                                        FROM_LEFT_TO_RIGHT);
     *pRemainingBitsInSegment -= 1;
@@ -1441,9 +1440,10 @@ the last of eight function of HCR)
 line)
 --------------------------------------------------------------------------------------------
 */
-static int DecodePCW_Sign(HANDLE_FDK_BITSTREAM bs, UINT codebookDim,
-                          const SCHAR *pQuantVal, FIXP_DBL *pQuantSpecCoef,
-                          int *quantSpecCoefIdx, INT *pLeftStartOfSegment,
+static int DecodePCW_Sign(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
+                          UINT codebookDim, const SCHAR *pQuantVal,
+                          FIXP_DBL *pQuantSpecCoef, int *quantSpecCoefIdx,
+                          INT *pLeftStartOfSegment,
                           SCHAR *pRemainingBitsInSegment,
                           int *pNumDecodedBits) {
   UINT i;
@@ -1453,7 +1453,7 @@ static int DecodePCW_Sign(HANDLE_FDK_BITSTREAM bs, UINT codebookDim,
   for (i = codebookDim; i != 0; i--) {
     quantSpecCoef = *pQuantVal++;
     if (quantSpecCoef != 0) {
-      carryBit = HcrGetABitFromBitstream(bs, pLeftStartOfSegment,
+      carryBit = HcrGetABitFromBitstream(bs, bsAnchor, pLeftStartOfSegment,
                                          pLeftStartOfSegment, /* dummy */
                                          FROM_LEFT_TO_RIGHT);
       *pRemainingBitsInSegment -= 1;
diff --git a/libAACdec/src/aacdec_hcr_bit.cpp b/libAACdec/src/aacdec_hcr_bit.cpp
index a53ef16..0198659 100644
--- a/libAACdec/src/aacdec_hcr_bit.cpp
+++ b/libAACdec/src/aacdec_hcr_bit.cpp
@@ -132,13 +132,14 @@ read direction. It is called very often, therefore it makes sense to inline it
         return:   - bit from bitstream
 --------------------------------------------------------------------------------------------
 */
-UINT HcrGetABitFromBitstream(HANDLE_FDK_BITSTREAM bs, INT *pLeftStartOfSegment,
+UINT HcrGetABitFromBitstream(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
+                             INT *pLeftStartOfSegment,
                              INT *pRightStartOfSegment, UCHAR readDirection) {
   UINT bit;
   INT readBitOffset;
 
   if (readDirection == FROM_LEFT_TO_RIGHT) {
-    readBitOffset = *pLeftStartOfSegment - FDKgetBitCnt(bs);
+    readBitOffset = (INT)FDKgetValidBits(bs) - bsAnchor + *pLeftStartOfSegment;
     if (readBitOffset) {
       FDKpushBiDirectional(bs, readBitOffset);
     }
@@ -147,7 +148,7 @@ UINT HcrGetABitFromBitstream(HANDLE_FDK_BITSTREAM bs, INT *pLeftStartOfSegment,
 
     *pLeftStartOfSegment += 1;
   } else {
-    readBitOffset = *pRightStartOfSegment - FDKgetBitCnt(bs);
+    readBitOffset = (INT)FDKgetValidBits(bs) - bsAnchor + *pRightStartOfSegment;
     if (readBitOffset) {
       FDKpushBiDirectional(bs, readBitOffset);
     }
diff --git a/libAACdec/src/aacdec_hcr_bit.h b/libAACdec/src/aacdec_hcr_bit.h
index 7a57c8c..77242ac 100644
--- a/libAACdec/src/aacdec_hcr_bit.h
+++ b/libAACdec/src/aacdec_hcr_bit.h
@@ -107,7 +107,8 @@ amm-info@iis.fraunhofer.de
 
 UCHAR ToggleReadDirection(UCHAR readDirection);
 
-UINT HcrGetABitFromBitstream(HANDLE_FDK_BITSTREAM bs, INT *pLeftStartOfSegment,
+UINT HcrGetABitFromBitstream(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
+                             INT *pLeftStartOfSegment,
                              INT *pRightStartOfSegment, UCHAR readDirection);
 
 #endif /* AACDEC_HCR_BIT_H */
diff --git a/libAACdec/src/aacdec_hcr_types.h b/libAACdec/src/aacdec_hcr_types.h
index d550bc2..1cc3cb0 100644
--- a/libAACdec/src/aacdec_hcr_types.h
+++ b/libAACdec/src/aacdec_hcr_types.h
@@ -350,7 +350,7 @@ typedef struct {
   SHORT lengthOfReorderedSpectralData;
   SHORT numSection;
   SHORT *pNumLineInSect;
-  INT bitstreamIndex;
+  INT bitstreamAnchor;
   SCHAR lengthOfLongestCodeword;
   UCHAR *pCodebook;
 } HCR_INPUT_OUTPUT;
diff --git a/libAACdec/src/aacdec_hcrs.cpp b/libAACdec/src/aacdec_hcrs.cpp
index e2b7cd8..d2bc867 100644
--- a/libAACdec/src/aacdec_hcrs.cpp
+++ b/libAACdec/src/aacdec_hcrs.cpp
@@ -367,7 +367,10 @@ static UINT InitSegmentBitfield(UINT *pNumSegment,
   UINT tempWord;
   USHORT numValidSegment;
 
-  *pNumWordForBitfield = ((*pNumSegment - 1) >> THIRTYTWO_LOG_DIV_TWO_LOG) + 1;
+  *pNumWordForBitfield =
+      (*pNumSegment == 0)
+          ? 0
+          : ((*pNumSegment - 1) >> THIRTYTWO_LOG_DIV_TWO_LOG) + 1;
 
   /* loop over all words, which are completely used or only partial */
   /* bit in pSegmentBitfield is zero if segment is empty; bit in
@@ -615,9 +618,9 @@ UINT Hcr_State_BODY_ONLY(HANDLE_FDK_BITSTREAM bs, void *ptr) {
 
   for (; pRemainingBitsInSegment[segmentOffset] > 0;
        pRemainingBitsInSegment[segmentOffset] -= 1) {
-    carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset],
-                                       &pRightStartOfSegment[segmentOffset],
-                                       readDirection);
+    carryBit = HcrGetABitFromBitstream(
+        bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset],
+        &pRightStartOfSegment[segmentOffset], readDirection);
 
     CarryBitToBranchValue(carryBit, /* make a step in decoding tree */
                           treeNode, &branchValue, &branchNode);
@@ -749,9 +752,9 @@ UINT Hcr_State_BODY_SIGN__BODY(HANDLE_FDK_BITSTREAM bs, void *ptr) {
 
   for (; pRemainingBitsInSegment[segmentOffset] > 0;
        pRemainingBitsInSegment[segmentOffset] -= 1) {
-    carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset],
-                                       &pRightStartOfSegment[segmentOffset],
-                                       readDirection);
+    carryBit = HcrGetABitFromBitstream(
+        bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset],
+        &pRightStartOfSegment[segmentOffset], readDirection);
 
     CarryBitToBranchValue(carryBit, /* make a step in decoding tree */
                           treeNode, &branchValue, &branchNode);
@@ -884,9 +887,9 @@ UINT Hcr_State_BODY_SIGN__SIGN(HANDLE_FDK_BITSTREAM bs, void *ptr) {
   /* loop for sign bit decoding */
   for (; pRemainingBitsInSegment[segmentOffset] > 0;
        pRemainingBitsInSegment[segmentOffset] -= 1) {
-    carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset],
-                                       &pRightStartOfSegment[segmentOffset],
-                                       readDirection);
+    carryBit = HcrGetABitFromBitstream(
+        bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset],
+        &pRightStartOfSegment[segmentOffset], readDirection);
     cntSign -=
         1; /* decrement sign counter because one sign bit has been read */
 
@@ -997,9 +1000,9 @@ UINT Hcr_State_BODY_SIGN_ESC__BODY(HANDLE_FDK_BITSTREAM bs, void *ptr) {
 
   for (; pRemainingBitsInSegment[segmentOffset] > 0;
        pRemainingBitsInSegment[segmentOffset] -= 1) {
-    carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset],
-                                       &pRightStartOfSegment[segmentOffset],
-                                       readDirection);
+    carryBit = HcrGetABitFromBitstream(
+        bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset],
+        &pRightStartOfSegment[segmentOffset], readDirection);
 
     /* make a step in tree */
     CarryBitToBranchValue(carryBit, treeNode, &branchValue, &branchNode);
@@ -1159,9 +1162,9 @@ UINT Hcr_State_BODY_SIGN_ESC__SIGN(HANDLE_FDK_BITSTREAM bs, void *ptr) {
   /* loop for sign bit decoding */
   for (; pRemainingBitsInSegment[segmentOffset] > 0;
        pRemainingBitsInSegment[segmentOffset] -= 1) {
-    carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset],
-                                       &pRightStartOfSegment[segmentOffset],
-                                       readDirection);
+    carryBit = HcrGetABitFromBitstream(
+        bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset],
+        &pRightStartOfSegment[segmentOffset], readDirection);
 
     /* decrement sign counter because one sign bit has been read */
     cntSign -= 1;
@@ -1314,9 +1317,9 @@ UINT Hcr_State_BODY_SIGN_ESC__ESC_PREFIX(HANDLE_FDK_BITSTREAM bs, void *ptr) {
   /* decode escape prefix */
   for (; pRemainingBitsInSegment[segmentOffset] > 0;
        pRemainingBitsInSegment[segmentOffset] -= 1) {
-    carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset],
-                                       &pRightStartOfSegment[segmentOffset],
-                                       readDirection);
+    carryBit = HcrGetABitFromBitstream(
+        bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset],
+        &pRightStartOfSegment[segmentOffset], readDirection);
 
     /* count ones and store sum in escapePrefixUp */
     if (carryBit == 1) {
@@ -1435,9 +1438,9 @@ UINT Hcr_State_BODY_SIGN_ESC__ESC_WORD(HANDLE_FDK_BITSTREAM bs, void *ptr) {
   /* decode escape word */
   for (; pRemainingBitsInSegment[segmentOffset] > 0;
        pRemainingBitsInSegment[segmentOffset] -= 1) {
-    carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset],
-                                       &pRightStartOfSegment[segmentOffset],
-                                       readDirection);
+    carryBit = HcrGetABitFromBitstream(
+        bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset],
+        &pRightStartOfSegment[segmentOffset], readDirection);
 
     /* build escape word */
     escapeWord <<=
diff --git a/libAACdec/src/aacdecoder.cpp b/libAACdec/src/aacdecoder.cpp
index b8b1327..8f03328 100644
--- a/libAACdec/src/aacdecoder.cpp
+++ b/libAACdec/src/aacdecoder.cpp
@@ -234,7 +234,8 @@ void CAacDecoder_SyncQmfMode(HANDLE_AACDECODER self) {
               MODE_HQ))) { /* MPS decoder does support the requested mode. */
           break;
         }
-      } /* Fall-through: */
+      }
+        FDK_FALLTHROUGH;
       default:
         if (self->qmfModeUser == NOT_DEFINED) {
           /* Revert in case mpegSurroundDecoder_SetParam() fails. */
@@ -538,13 +539,7 @@ static int CProgramConfigElement_Read(HANDLE_FDK_BITSTREAM bs,
                     sizeof(CProgramConfig)); /* Store the complete PCE */
           pceStatus = 1; /* New PCE but no change of config */
           break;
-        case 2: /* The number of channels are identical but not the config */
-          if (channelConfig == 0) {
-            FDKmemcpy(pce, tmpPce,
-                      sizeof(CProgramConfig)); /* Store the complete PCE */
-            pceStatus = 2; /* Decoder needs re-configuration */
-          }
-          break;
+        case 2:  /* The number of channels are identical but not the config */
         case -1: /* The channel configuration is completely different */
           pceStatus = -1; /* Not supported! */
           break;
@@ -775,7 +770,7 @@ LINKSPEC_CPP AAC_DECODER_ERROR CAacDecoder_PreRollExtensionPayloadParse(
     /* For every AU get length and offset in the bitstream */
     prerollAULength[i] = escapedValue(hBs, 16, 16, 0);
     if (prerollAULength[i] > 0) {
-      prerollAUOffset[i] = auStartAnchor - FDKgetValidBits(hBs);
+      prerollAUOffset[i] = auStartAnchor - (INT)FDKgetValidBits(hBs);
       independencyFlag = FDKreadBit(hBs);
       if (i == 0 && !independencyFlag) {
         *numPrerollAU = 0;
@@ -938,6 +933,7 @@ static AAC_DECODER_ERROR CAacDecoder_ExtPayloadParse(
 
     case EXT_SBR_DATA_CRC:
       crcFlag = 1;
+      FDK_FALLTHROUGH;
     case EXT_SBR_DATA:
       if (IS_CHANNEL_ELEMENT(previous_element)) {
         SBR_ERROR sbrError;
@@ -1076,6 +1072,7 @@ static AAC_DECODER_ERROR CAacDecoder_ExtPayloadParse(
          * intentional. */
         break;
       }
+      FDK_FALLTHROUGH;
 
     case EXT_FIL:
 
@@ -1108,12 +1105,13 @@ static AAC_DECODER_ERROR aacDecoder_ParseExplicitMpsAndSbr(
   /* get the remaining bits of this frame */
   bitCnt = transportDec_GetAuBitsRemaining(self->hInput, 0);
 
-  if ((bitCnt > 0) && (self->flags[0] & AC_SBR_PRESENT) &&
+  if ((self->flags[0] & AC_SBR_PRESENT) &&
       (self->flags[0] & (AC_USAC | AC_RSVD50 | AC_ELD | AC_DRM))) {
     SBR_ERROR err = SBRDEC_OK;
     int chElIdx, numChElements = el_cnt[ID_SCE] + el_cnt[ID_CPE] +
                                  el_cnt[ID_LFE] + el_cnt[ID_USAC_SCE] +
                                  el_cnt[ID_USAC_CPE] + el_cnt[ID_USAC_LFE];
+    INT bitCntTmp = bitCnt;
 
     if (self->flags[0] & AC_USAC) {
       chElIdx = numChElements - 1;
@@ -1123,6 +1121,7 @@ static AAC_DECODER_ERROR aacDecoder_ParseExplicitMpsAndSbr(
 
     for (; chElIdx < numChElements; chElIdx += 1) {
       MP4_ELEMENT_ID sbrType;
+      SBR_ERROR errTmp;
       if (self->flags[0] & (AC_USAC)) {
         FDK_ASSERT((self->elements[element_index] == ID_USAC_SCE) ||
                    (self->elements[element_index] == ID_USAC_CPE));
@@ -1132,19 +1131,21 @@ static AAC_DECODER_ERROR aacDecoder_ParseExplicitMpsAndSbr(
                       : ID_SCE;
       } else
         sbrType = self->elements[chElIdx];
-      err = sbrDecoder_Parse(self->hSbrDecoder, bs, self->pDrmBsBuffer,
-                             self->drmBsBufferSize, &bitCnt, -1,
-                             self->flags[0] & AC_SBRCRC, sbrType, chElIdx,
-                             self->flags[0], self->elFlags);
-      if (err != SBRDEC_OK) {
-        break;
+      errTmp = sbrDecoder_Parse(self->hSbrDecoder, bs, self->pDrmBsBuffer,
+                                self->drmBsBufferSize, &bitCnt, -1,
+                                self->flags[0] & AC_SBRCRC, sbrType, chElIdx,
+                                self->flags[0], self->elFlags);
+      if (errTmp != SBRDEC_OK) {
+        err = errTmp;
+        bitCntTmp = bitCnt;
+        bitCnt = 0;
       }
     }
     switch (err) {
       case SBRDEC_PARSE_ERROR:
         /* Can not go on parsing because we do not
             know the length of the SBR extension data. */
-        FDKpushFor(bs, bitCnt);
+        FDKpushFor(bs, bitCntTmp);
         bitCnt = 0;
         break;
       case SBRDEC_OK:
@@ -1495,11 +1496,13 @@ CAacDecoder_Init(HANDLE_AACDECODER self, const CSAudioSpecificConfig *asc,
   switch (asc->m_aot) {
     case AOT_AAC_LC:
       self->streamInfo.profile = 1;
+      FDK_FALLTHROUGH;
     case AOT_ER_AAC_SCAL:
       if (asc->m_sc.m_gaSpecificConfig.m_layer > 0) {
         /* aac_scalable_extension_element() currently not supported. */
         return AAC_DEC_UNSUPPORTED_FORMAT;
       }
+      FDK_FALLTHROUGH;
     case AOT_SBR:
     case AOT_PS:
     case AOT_ER_AAC_LC:
@@ -1630,17 +1633,9 @@ CAacDecoder_Init(HANDLE_AACDECODER self, const CSAudioSpecificConfig *asc,
   aacChannelsOffset = 0;
   aacChannelsOffsetIdx = 0;
   elementOffset = 0;
-  if (configMode & AC_CM_ALLOC_MEM) {
-    if ((ascChannels <= 0) ||
-        (asc->m_channelConfiguration > AACDEC_MAX_CH_CONF)) {
-      return AAC_DEC_UNSUPPORTED_CHANNELCONFIG;
-    }
-    if ((ascChannels + aacChannelsOffsetIdx) > ((8) * 2)) {
-      return AAC_DEC_UNSUPPORTED_CHANNELCONFIG;
-    }
-    if ((ascChannels + aacChannelsOffset) > (8)) {
-      return AAC_DEC_UNSUPPORTED_CHANNELCONFIG;
-    }
+  if ((ascChannels <= 0) || (ascChannels > (8)) ||
+      (asc->m_channelConfiguration > AACDEC_MAX_CH_CONF)) {
+    return AAC_DEC_UNSUPPORTED_CHANNELCONFIG;
   }
 
   /* Set syntax flags */
@@ -2055,17 +2050,12 @@ CAacDecoder_Init(HANDLE_AACDECODER self, const CSAudioSpecificConfig *asc,
       if (self->flags[streamIndex] & (AC_RSV603DA | AC_USAC)) {
         _numElements = (int)asc->m_sc.m_usacConfig.m_usacNumElements;
       }
-      if (self->flags[streamIndex] & (AC_ER | AC_LD | AC_ELD)) {
-        _numElements = (asc->m_channelConfiguration == 7)
-                           ? 8
-                           : asc->m_channelConfiguration;
-      }
       for (int _el = 0; _el < _numElements; _el++) {
         int el_channels = 0;
         int el = elementOffset + _el;
 
         if (self->flags[streamIndex] &
-            (AC_ELD | AC_RSV603DA | AC_USAC | AC_RSVD50)) {
+            (AC_ER | AC_LD | AC_ELD | AC_RSV603DA | AC_USAC | AC_RSVD50)) {
           if (ch >= ascChannels) {
             break;
           }
@@ -2115,7 +2105,9 @@ CAacDecoder_Init(HANDLE_AACDECODER self, const CSAudioSpecificConfig *asc,
                   (SPECTRAL_PTR)&self->workBufferCore2[ch * 1024];
 
               if (el_channels == 2) {
-                FDK_ASSERT(ch < (8) - 1);
+                if (ch >= (8) - 1) {
+                  return AAC_DEC_UNSUPPORTED_CHANNELCONFIG;
+                }
                 self->pAacDecoderChannelInfo[ch + 1]->pComData =
                     self->pAacDecoderChannelInfo[ch]->pComData;
                 self->pAacDecoderChannelInfo[ch + 1]->pComStaticData =
@@ -2519,8 +2511,14 @@ LINKSPEC_CPP AAC_DECODER_ERROR CAacDecoder_DecodeFrame(
     if (!(self->flags[0] &
           (AC_USAC | AC_RSVD50 | AC_RSV603DA | AC_ELD | AC_SCALABLE | AC_ER)))
       type = (MP4_ELEMENT_ID)FDKreadBits(bs, 3);
-    else
+    else {
+      if (element_count >= (3 * ((8) * 2) + (((8) * 2)) / 2 + 4 * (1) + 1)) {
+        self->frameOK = 0;
+        ErrorStatus = AAC_DEC_PARSE_ERROR;
+        break;
+      }
       type = self->elements[element_count];
+    }
 
     if ((self->flags[streamIndex] & (AC_USAC | AC_RSVD50) &&
          element_count == 0) ||
@@ -2564,6 +2562,11 @@ LINKSPEC_CPP AAC_DECODER_ERROR CAacDecoder_DecodeFrame(
       case ID_USAC_SCE:
       case ID_USAC_CPE:
       case ID_USAC_LFE:
+        if (element_count >= (3 * ((8) * 2) + (((8) * 2)) / 2 + 4 * (1) + 1)) {
+          self->frameOK = 0;
+          ErrorStatus = AAC_DEC_PARSE_ERROR;
+          break;
+        }
 
         el_channels = CAacDecoder_GetELChannels(
             type, self->usacStereoConfigIndex[element_count]);
@@ -2795,12 +2798,24 @@ LINKSPEC_CPP AAC_DECODER_ERROR CAacDecoder_DecodeFrame(
       } break;
 
       case ID_EXT:
+        if (element_count >= (3 * ((8) * 2) + (((8) * 2)) / 2 + 4 * (1) + 1)) {
+          self->frameOK = 0;
+          ErrorStatus = AAC_DEC_PARSE_ERROR;
+          break;
+        }
+
         ErrorStatus = aacDecoder_ParseExplicitMpsAndSbr(
             self, bs, previous_element, previous_element_index, element_count,
             el_cnt);
         break;
 
       case ID_USAC_EXT: {
+        if ((element_count - element_count_prev_streams) >=
+            TP_USAC_MAX_ELEMENTS) {
+          self->frameOK = 0;
+          ErrorStatus = AAC_DEC_PARSE_ERROR;
+          break;
+        }
         /* parse extension element payload
            q.v. rsv603daExtElement() ISO/IEC DIS 23008-3  Table 30
            or   UsacExElement() ISO/IEC FDIS 23003-3:2011(E)  Table 21
@@ -3012,9 +3027,11 @@ LINKSPEC_CPP AAC_DECODER_ERROR CAacDecoder_DecodeFrame(
     aacChannels = 0;
   }
 
-  if (TRANSPORTDEC_OK != transportDec_CrcCheck(self->hInput)) {
-    ErrorStatus = AAC_DEC_CRC_ERROR;
-    self->frameOK = 0;
+  if (!(flags & (AACDEC_CONCEAL | AACDEC_FLUSH))) {
+    if (TRANSPORTDEC_OK != transportDec_CrcCheck(self->hInput)) {
+      ErrorStatus = AAC_DEC_CRC_ERROR;
+      self->frameOK = 0;
+    }
   }
 
   /* Ensure that in case of concealment a proper error status is set. */
diff --git a/libAACdec/src/aacdecoder_lib.cpp b/libAACdec/src/aacdecoder_lib.cpp
index 705f758..f287003 100644
--- a/libAACdec/src/aacdecoder_lib.cpp
+++ b/libAACdec/src/aacdecoder_lib.cpp
@@ -387,7 +387,7 @@ static INT aacDecoder_SbrCallback(
 
 static INT aacDecoder_SscCallback(void *handle, HANDLE_FDK_BITSTREAM hBs,
                                   const AUDIO_OBJECT_TYPE coreCodec,
-                                  const INT samplingRate,
+                                  const INT samplingRate, const INT frameSize,
                                   const INT stereoConfigIndex,
                                   const INT coreSbrFrameLengthIndex,
                                   const INT configBytes, const UCHAR configMode,
@@ -398,8 +398,8 @@ static INT aacDecoder_SscCallback(void *handle, HANDLE_FDK_BITSTREAM hBs,
 
   err = mpegSurroundDecoder_Config(
       (CMpegSurroundDecoder *)hAacDecoder->pMpegSurroundDecoder, hBs, coreCodec,
-      samplingRate, stereoConfigIndex, coreSbrFrameLengthIndex, configBytes,
-      configMode, configChanged);
+      samplingRate, frameSize, stereoConfigIndex, coreSbrFrameLengthIndex,
+      configBytes, configMode, configChanged);
 
   switch (err) {
     case MPS_UNSUPPORTED_CONFIG:
@@ -634,6 +634,7 @@ static AAC_DECODER_ERROR setConcealMethod(
     switch (err) {
       case PCMDMX_INVALID_HANDLE:
         errorStatus = AAC_DEC_INVALID_HANDLE;
+        break;
       case PCMDMX_OK:
         break;
       default:
@@ -1884,7 +1885,7 @@ aacDecoder_DecodeFrame(HANDLE_AACDECODER self, INT_PCM *pTimeData_extern,
 
     } /* USAC DASH IPF flushing possible end */
     if (accessUnit < numPrerollAU) {
-      FDKpushBack(hBsAu, auStartAnchor - FDKgetValidBits(hBsAu));
+      FDKpushBack(hBsAu, auStartAnchor - (INT)FDKgetValidBits(hBsAu));
     } else {
       if ((self->buildUpStatus == AACDEC_RSV60_BUILD_UP_ON) ||
           (self->buildUpStatus == AACDEC_RSV60_BUILD_UP_ON_IN_BAND) ||
diff --git a/libAACdec/src/channel.cpp b/libAACdec/src/channel.cpp
index cfffd57..a020034 100644
--- a/libAACdec/src/channel.cpp
+++ b/libAACdec/src/channel.cpp
@@ -592,6 +592,7 @@ AAC_DECODER_ERROR CChannelElement_Read(
                                             line: ~599 */
         /* Note: The missing "break" is intentional here, since we need to call
          * CBlock_ReadScaleFactorData(). */
+        FDK_FALLTHROUGH;
 
       case scale_factor_data:
         if (flags & AC_ER_RVLC) {
diff --git a/libAACdec/src/channelinfo.h b/libAACdec/src/channelinfo.h
index 45a288f..4523400 100644
--- a/libAACdec/src/channelinfo.h
+++ b/libAACdec/src/channelinfo.h
@@ -359,7 +359,7 @@ typedef struct {
   shouldBeUnion {
     struct {
       FIXP_DBL fac_data0[LFAC];
-      UCHAR fac_data_e[4];
+      SCHAR fac_data_e[4];
       FIXP_DBL
       *fac_data[4]; /* Pointers to unused parts of pSpectralCoefficient */
 
diff --git a/libAACdec/src/conceal.cpp b/libAACdec/src/conceal.cpp
index a6064b6..cc6de75 100644
--- a/libAACdec/src/conceal.cpp
+++ b/libAACdec/src/conceal.cpp
@@ -1894,6 +1894,7 @@ INT CConcealment_TDFading(
     case ConcealState_FadeIn:
       idx = cntFadeFrames;
       idx -= TDFadeInStopBeforeFullLevel;
+      FDK_FALLTHROUGH;
     case ConcealState_Ok:
       fadeFactor = pConcealParams->fadeInFactor;
       idx = (concealState == ConcealState_Ok) ? -1 : idx;
diff --git a/libAACdec/src/ldfiltbank.cpp b/libAACdec/src/ldfiltbank.cpp
index 66a5914..c7d2928 100644
--- a/libAACdec/src/ldfiltbank.cpp
+++ b/libAACdec/src/ldfiltbank.cpp
@@ -216,6 +216,7 @@ int InvMdctTransformLowDelay_fdk(FIXP_DBL *mdctData, const int mdctData_e,
   int scale = mdctData_e + MDCT_OUT_HEADROOM -
               LDFB_HEADROOM; /* The LDFB_HEADROOM is compensated inside
                                 multE2_DinvF_fdk() below */
+  int i;
 
   /* Select LD window slope */
   switch (N) {
@@ -261,10 +262,11 @@ int InvMdctTransformLowDelay_fdk(FIXP_DBL *mdctData, const int mdctData_e,
   }
 
   if (gain != (FIXP_DBL)0) {
-    scaleValuesWithFactor(mdctData, gain, N, scale);
-  } else {
-    scaleValues(mdctData, N, scale);
+    for (i = 0; i < N; i++) {
+      mdctData[i] = fMult(mdctData[i], gain);
+    }
   }
+  scaleValuesSaturate(mdctData, N, scale);
 
   /* Since all exponent and factors have been applied, current exponent is zero.
    */
diff --git a/libAACdec/src/rvlc.cpp b/libAACdec/src/rvlc.cpp
index 92f9f02..b7a9be1 100644
--- a/libAACdec/src/rvlc.cpp
+++ b/libAACdec/src/rvlc.cpp
@@ -168,13 +168,14 @@ static void rvlcInit(CErRvlcInfo *pRvlc,
   /* set base bitstream ptr to the RVL-coded part (start of RVLC data (ESC 2))
    */
   FDKsyncCache(bs);
+  pRvlc->bsAnchor = (INT)FDKgetValidBits(bs);
 
-  pRvlc->bitstreamIndexRvlFwd = FDKgetBitCnt(
-      bs); /* first bit within RVL coded block as start address for  forward
-              decoding */
-  pRvlc->bitstreamIndexRvlBwd = FDKgetBitCnt(bs) + pRvlc->length_of_rvlc_sf -
-                                1; /* last bit within RVL coded block as start
-                                      address for backward decoding */
+  pRvlc->bitstreamIndexRvlFwd =
+      0; /* first bit within RVL coded block as start address for  forward
+            decoding */
+  pRvlc->bitstreamIndexRvlBwd =
+      pRvlc->length_of_rvlc_sf - 1; /* last bit within RVL coded block as start
+                                       address for backward decoding */
 
   /* skip RVLC-bitstream-part -- pointing now to escapes (if present) or to TNS
    * data (if present) */
@@ -183,7 +184,7 @@ static void rvlcInit(CErRvlcInfo *pRvlc,
   if (pRvlc->sf_escapes_present != 0) {
     /* locate internal bitstream ptr at escapes (which is the second part) */
     FDKsyncCache(bs);
-    pRvlc->bitstreamIndexEsc = FDKgetBitCnt(bs);
+    pRvlc->bitstreamIndexEsc = pRvlc->bsAnchor - (INT)FDKgetValidBits(bs);
 
     /* skip escapeRVLC-bitstream-part -- pointing to TNS data (if present)   to
      * make decoder continue */
@@ -259,8 +260,9 @@ static SCHAR rvlcDecodeEscapeWord(CErRvlcInfo *pRvlc, HANDLE_FDK_BITSTREAM bs) {
   treeNode = *pEscTree; /* init at starting node */
 
   for (i = MAX_LEN_RVLC_ESCAPE_WORD - 1; i >= 0; i--) {
-    carryBit = rvlcReadBitFromBitstream(bs, /* get next bit */
-                                        pBitstreamIndexEsc, FWD);
+    carryBit =
+        rvlcReadBitFromBitstream(bs, /* get next bit */
+                                 pRvlc->bsAnchor, pBitstreamIndexEsc, FWD);
 
     CarryBitToBranchValue(carryBit, /* huffman decoding, do a single step in
                                        huffman decoding tree */
@@ -370,8 +372,9 @@ SCHAR decodeRVLCodeword(HANDLE_FDK_BITSTREAM bs, CErRvlcInfo *pRvlc) {
   UINT treeNode = *pRvlCodeTree;
 
   for (i = MAX_LEN_RVLC_CODE_WORD - 1; i >= 0; i--) {
-    carryBit = rvlcReadBitFromBitstream(bs, /* get next bit */
-                                        pBitstrIndxRvl, direction);
+    carryBit =
+        rvlcReadBitFromBitstream(bs, /* get next bit */
+                                 pRvlc->bsAnchor, pBitstrIndxRvl, direction);
 
     CarryBitToBranchValue(carryBit, /* huffman decoding, do a single step in
                                        huffman decoding tree */
@@ -1140,7 +1143,7 @@ void CRvlc_Decode(CAacDecoderChannelInfo *pAacDecoderChannelInfo,
   rvlcInit(pRvlc, pAacDecoderChannelInfo, bs);
 
   /* save bitstream position */
-  saveBitCnt = FDKgetBitCnt(bs);
+  saveBitCnt = (INT)FDKgetValidBits(bs);
 
   if (pRvlc->sf_escapes_present)
     rvlcDecodeEscapes(
@@ -1155,7 +1158,7 @@ void CRvlc_Decode(CAacDecoderChannelInfo *pAacDecoderChannelInfo,
   pAacDecoderChannelInfo->data.aac.PnsData.PnsActive = pRvlc->noise_used;
 
   /* restore bitstream position */
-  bitCntOffst = saveBitCnt - FDKgetBitCnt(bs);
+  bitCntOffst = (INT)FDKgetValidBits(bs) - saveBitCnt;
   if (bitCntOffst) {
     FDKpushBiDirectional(bs, bitCntOffst);
   }
diff --git a/libAACdec/src/rvlc_info.h b/libAACdec/src/rvlc_info.h
index fc9c19d..e7b3b99 100644
--- a/libAACdec/src/rvlc_info.h
+++ b/libAACdec/src/rvlc_info.h
@@ -164,6 +164,7 @@ typedef struct {
   UCHAR direction;
 
   /* bitstream indices */
+  INT bsAnchor;             /* hcr bit buffer reference index */
   INT bitstreamIndexRvlFwd; /* base address of RVL-coded-scalefactor data (ESC
                                2) for forward  decoding */
   INT bitstreamIndexRvlBwd; /* base address of RVL-coded-scalefactor data (ESC
diff --git a/libAACdec/src/rvlcbit.cpp b/libAACdec/src/rvlcbit.cpp
index c06cf96..b0c4596 100644
--- a/libAACdec/src/rvlcbit.cpp
+++ b/libAACdec/src/rvlcbit.cpp
@@ -123,10 +123,10 @@ read direction. It is called very often, therefore it makes sense to inline it
 --------------------------------------------------------------------------------------------
 */
 
-UCHAR rvlcReadBitFromBitstream(HANDLE_FDK_BITSTREAM bs, INT *pPosition,
-                               UCHAR readDirection) {
+UCHAR rvlcReadBitFromBitstream(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
+                               INT *pPosition, UCHAR readDirection) {
   UINT bit;
-  INT readBitOffset = *pPosition - FDKgetBitCnt(bs);
+  INT readBitOffset = (INT)FDKgetValidBits(bs) - bsAnchor + *pPosition;
 
   if (readBitOffset) {
     FDKpushBiDirectional(bs, readBitOffset);
diff --git a/libAACdec/src/rvlcbit.h b/libAACdec/src/rvlcbit.h
index 5c6a3f1..2578453 100644
--- a/libAACdec/src/rvlcbit.h
+++ b/libAACdec/src/rvlcbit.h
@@ -105,7 +105,7 @@ amm-info@iis.fraunhofer.de
 
 #include "rvlc.h"
 
-UCHAR rvlcReadBitFromBitstream(HANDLE_FDK_BITSTREAM bs, INT *pPosition,
-                               UCHAR readDirection);
+UCHAR rvlcReadBitFromBitstream(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
+                               INT *pPosition, UCHAR readDirection);
 
 #endif /* RVLCBIT_H */
diff --git a/libAACdec/src/usacdec_acelp.cpp b/libAACdec/src/usacdec_acelp.cpp
index ed775d2..a606459 100644
--- a/libAACdec/src/usacdec_acelp.cpp
+++ b/libAACdec/src/usacdec_acelp.cpp
@@ -309,7 +309,7 @@ static FIXP_DBL calc_period_factor(FIXP_DBL exc[], FIXP_SGL gain_pit,
   ener_exc = (FIXP_DBL)0;
   for (int i = 0; i < L_SUBFR; i++) {
     ener_exc += fPow2Div2(exc[i]) >> s;
-    if (ener_exc > FL2FXCONST_DBL(0.5f)) {
+    if (ener_exc >= FL2FXCONST_DBL(0.5f)) {
       ener_exc >>= 1;
       s++;
     }
@@ -579,11 +579,11 @@ void Syn_filt(const FIXP_LPC a[], /* (i) : a[m] prediction coefficients Q12 */
     L_tmp = (FIXP_DBL)0;
 
     for (j = 0; j < M_LP_FILTER_ORDER; j++) {
-      L_tmp -= fMultDiv2(a[j], y[i - (j + 1)]);
+      L_tmp -= fMultDiv2(a[j], y[i - (j + 1)]) >> (LP_FILTER_SCALE - 1);
     }
 
-    L_tmp = scaleValue(L_tmp, a_exp + 1);
-    y[i] = L_tmp + x[i];
+    L_tmp = scaleValue(L_tmp, a_exp + LP_FILTER_SCALE);
+    y[i] = fAddSaturate(L_tmp, x[i]);
   }
 
   return;
@@ -631,10 +631,10 @@ void E_UTIL_residu(const FIXP_LPC *a, const INT a_exp, FIXP_DBL *x, FIXP_DBL *y,
     s = (FIXP_DBL)0;
 
     for (j = 0; j < M_LP_FILTER_ORDER; j++) {
-      s += fMultDiv2(a[j], x[i - j - 1]);
+      s += fMultDiv2(a[j], x[i - j - 1]) >> (LP_FILTER_SCALE - 1);
     }
 
-    s = scaleValue(s, a_exp + 1);
+    s = scaleValue(s, a_exp + LP_FILTER_SCALE);
     y[i] = fAddSaturate(s, x[i]);
   }
 
diff --git a/libAACdec/src/usacdec_const.h b/libAACdec/src/usacdec_const.h
index c7dbae7..f68e808 100644
--- a/libAACdec/src/usacdec_const.h
+++ b/libAACdec/src/usacdec_const.h
@@ -115,6 +115,7 @@ amm-info@iis.fraunhofer.de
 
 /* definitions which are independent of coreCoderFrameLength */
 #define M_LP_FILTER_ORDER 16 /* LP filter order */
+#define LP_FILTER_SCALE 4    /* LP filter scale */
 
 #define PIT_MIN_12k8 34    /* Minimum pitch lag with resolution 1/4 */
 #define PIT_MAX_12k8 231   /* Maximum pitch lag for fs=12.8kHz */
diff --git a/libAACdec/src/usacdec_fac.cpp b/libAACdec/src/usacdec_fac.cpp
index 71ce4a9..0d3d844 100644
--- a/libAACdec/src/usacdec_fac.cpp
+++ b/libAACdec/src/usacdec_fac.cpp
@@ -142,7 +142,7 @@ FIXP_DBL *CLpd_FAC_GetMemory(CAacDecoderChannelInfo *pAacDecoderChannelInfo,
   return ptr;
 }
 
-int CLpd_FAC_Read(HANDLE_FDK_BITSTREAM hBs, FIXP_DBL *pFac, UCHAR *pFacScale,
+int CLpd_FAC_Read(HANDLE_FDK_BITSTREAM hBs, FIXP_DBL *pFac, SCHAR *pFacScale,
                   int length, int use_gain, int frame) {
   FIXP_DBL fac_gain;
   int fac_gain_e = 0;
@@ -191,13 +191,11 @@ static void Syn_filt_zero(const FIXP_LPC a[], const INT a_exp, INT length,
     L_tmp = (FIXP_DBL)0;
 
     for (j = 0; j < fMin(i, M_LP_FILTER_ORDER); j++) {
-      L_tmp -= fMultDiv2(a[j], x[i - (j + 1)]);
+      L_tmp -= fMultDiv2(a[j], x[i - (j + 1)]) >> (LP_FILTER_SCALE - 1);
     }
 
-    L_tmp = scaleValue(L_tmp, a_exp + 1);
-
-    x[i] = scaleValueSaturate((x[i] >> 1) + (L_tmp >> 1),
-                              1); /* Avoid overflow issues and saturate. */
+    L_tmp = scaleValue(L_tmp, a_exp + LP_FILTER_SCALE);
+    x[i] = fAddSaturate(x[i], L_tmp);
   }
 }
 
@@ -536,10 +534,12 @@ INT CLpd_FAC_Acelp2Mdct(H_MDCT hMdct, FIXP_DBL *output, FIXP_DBL *_pSpec,
 
   /* Optional scaling of time domain - no yet windowed - of current spectrum */
   if (total_gain != (FIXP_DBL)0) {
-    scaleValuesWithFactor(pSpec, total_gain, tl, spec_scale[0] + scale);
-  } else {
-    scaleValues(pSpec, tl, spec_scale[0] + scale);
+    for (i = 0; i < tl; i++) {
+      pSpec[i] = fMult(pSpec[i], total_gain);
+    }
   }
+  int loc_scale = fixmin_I(spec_scale[0] + scale, (INT)DFRACT_BITS - 1);
+  scaleValuesSaturate(pSpec, tl, loc_scale);
 
   pOut1 += fl / 2 - 1;
   pCurr = pSpec + tl - fl / 2;
@@ -625,10 +625,12 @@ INT CLpd_FAC_Acelp2Mdct(H_MDCT hMdct, FIXP_DBL *output, FIXP_DBL *_pSpec,
      */
     /* and de-scale current spectrum signal (time domain, no yet windowed) */
     if (total_gain != (FIXP_DBL)0) {
-      scaleValuesWithFactor(pSpec, total_gain, tl, spec_scale[w] + scale);
-    } else {
-      scaleValues(pSpec, tl, spec_scale[w] + scale);
+      for (i = 0; i < tl; i++) {
+        pSpec[i] = fMult(pSpec[i], total_gain);
+      }
     }
+    loc_scale = fixmin_I(spec_scale[w] + scale, (INT)DFRACT_BITS - 1);
+    scaleValuesSaturate(pSpec, tl, loc_scale);
 
     if (noOutSamples <= nrSamples) {
       /* Divert output first half to overlap buffer if we already got enough
diff --git a/libAACdec/src/usacdec_fac.h b/libAACdec/src/usacdec_fac.h
index bf13552..100a6fa 100644
--- a/libAACdec/src/usacdec_fac.h
+++ b/libAACdec/src/usacdec_fac.h
@@ -131,7 +131,7 @@ FIXP_DBL *CLpd_FAC_GetMemory(CAacDecoderChannelInfo *pAacDecoderChannelInfo,
  * Always 0 for FD case.
  * \return 0 on success, -1 on error.
  */
-int CLpd_FAC_Read(HANDLE_FDK_BITSTREAM hBs, FIXP_DBL *pFac, UCHAR *pFacScale,
+int CLpd_FAC_Read(HANDLE_FDK_BITSTREAM hBs, FIXP_DBL *pFac, SCHAR *pFacScale,
                   int length, int use_gain, int frame);
 
 /**
diff --git a/libAACdec/src/usacdec_lpd.cpp b/libAACdec/src/usacdec_lpd.cpp
index 22069a6..2110172 100644
--- a/libAACdec/src/usacdec_lpd.cpp
+++ b/libAACdec/src/usacdec_lpd.cpp
@@ -418,6 +418,7 @@ void CLpd_AdaptLowFreqDeemph(FIXP_DBL x[], int lg, FIXP_DBL alfd_gains[],
     FIXP_DBL tmp_pow2[32];
 
     s = s * 2 + ALFDPOW2_SCALE;
+    s = fMin(31, s);
 
     k = 8;
     i_max = lg / 4; /* ALFD range = 1600Hz (lg = 6400Hz) */
@@ -1221,8 +1222,7 @@ AAC_DECODER_ERROR CLpdChannelStream_Read(
       (INT)(samplingRate * PIT_MIN_12k8 + (FSCALE_DENOM / 2)) / FSCALE_DENOM -
       (INT)PIT_MIN_12k8;
 
-  if (pSamplingRateInfo->samplingRate >
-      FAC_FSCALE_MAX /* maximum allowed core sampling frequency */) {
+  if ((samplingRate < FAC_FSCALE_MIN) || (samplingRate > FAC_FSCALE_MAX)) {
     error = AAC_DEC_PARSE_ERROR;
     goto bail;
   }