3 files changed, 25 insertions, 14 deletions
diff --git a/libAACdec/src/aacdecoder_lib.cpp b/libAACdec/src/aacdecoder_lib.cpp
index 8863da5..50efb0f 100644
--- a/libAACdec/src/aacdecoder_lib.cpp
+++ b/libAACdec/src/aacdecoder_lib.cpp
@@ -791,36 +791,29 @@ LINKSPEC_CPP AAC_DECODER_ERROR aacDecoder_DecodeFrame(
         const UINT         flags)
 {
     AAC_DECODER_ERROR ErrorStatus;
-    INT layer;
-    INT nBits;
-    INT interleaved = self->outputInterleaved;
-    HANDLE_FDK_BITSTREAM hBs;
     int fTpInterruption = 0;  /* Transport originated interruption detection. */
     int fTpConceal = 0;       /* Transport originated concealment. */
-    INT_PCM *pTimeData = NULL;
-    INT timeDataSize = 0;
-
 
     if (self == NULL) {
       return AAC_DEC_INVALID_HANDLE;
     }
-
-    pTimeData = self->pcmOutputBuffer;
-    timeDataSize = sizeof(self->pcmOutputBuffer)/sizeof(*self->pcmOutputBuffer);
+    INT interleaved = self->outputInterleaved;
+    INT_PCM *pTimeData = self->pcmOutputBuffer;
+    INT timeDataSize = sizeof(self->pcmOutputBuffer)/sizeof(*self->pcmOutputBuffer);
 
     if (flags & AACDEC_INTR) {
       self->streamInfo.numLostAccessUnits = 0;
     }
 
-    hBs = transportDec_GetBitstream(self->hInput, 0);
+    HANDLE_FDK_BITSTREAM hBs = transportDec_GetBitstream(self->hInput, 0);
 
     /* Get current bits position for bitrate calculation. */
-    nBits = FDKgetValidBits(hBs);
+    INT nBits = FDKgetValidBits(hBs);
     if (! (flags & (AACDEC_CONCEAL | AACDEC_FLUSH) ) )
     {
       TRANSPORTDEC_ERROR err;
 
-      for(layer = 0; layer < self->nrOfLayers; layer++)
+      for(INT layer = 0; layer < self->nrOfLayers; layer++)
       {
         err = transportDec_ReadAccessUnit(self->hInput, layer);
         if (err != TRANSPORTDEC_OK) {
diff --git a/libAACdec/src/block.cpp b/libAACdec/src/block.cpp
index a19284e..bda565c 100644
--- a/libAACdec/src/block.cpp
+++ b/libAACdec/src/block.cpp
@@ -318,6 +318,9 @@ AAC_DECODER_ERROR CBlock_ReadSectionData(HANDLE_FDK_BITSTREAM bs,
       }
 
       sect_len += sect_len_incr;
+      if (sect_len <= 0) {
+         return AAC_DEC_PARSE_ERROR;
+      }
 
 
       top = band + sect_len;
diff --git a/libAACdec/src/channel.cpp b/libAACdec/src/channel.cpp
index 5475079..4b182e0 100644
--- a/libAACdec/src/channel.cpp
+++ b/libAACdec/src/channel.cpp
@@ -411,11 +411,15 @@ AAC_DECODER_ERROR CChannelElement_Read(HANDLE_FDK_BITSTREAM hBs,
     case drmcrc_end_reg:
       if (pTpDec != NULL) {
         transportDec_CrcEndReg(pTpDec, crcReg1);
+        crcReg1 = -1;
       }
       break;
     case adtscrc_end_reg2:
-      if (pTpDec != NULL) {
+      if (crcReg1 != -1) {
+        error = AAC_DEC_DECODE_FRAME_ERROR;
+      } else if (pTpDec != NULL) {
         transportDec_CrcEndReg(pTpDec, crcReg2);
+        crcReg2 = -1;
       }
       break;
     case drmcrc_start_reg:
@@ -447,5 +451,16 @@ AAC_DECODER_ERROR CChannelElement_Read(HANDLE_FDK_BITSTREAM hBs,
   } while (list->id[i] != end_of_sequence);
 
 bail:
+  if (crcReg1 != -1 || crcReg2 != -1) {
+    if (error == AAC_DEC_OK) {
+      error = AAC_DEC_DECODE_FRAME_ERROR;
+    }
+    if (crcReg1 != -1) {
+      transportDec_CrcEndReg(pTpDec, crcReg1);
+    }
+    if (crcReg2 != -1) {
+      transportDec_CrcEndReg(pTpDec, crcReg2);
+    }
+  }
   return error;
 }