3 files changed, 24 insertions, 2 deletions
diff --git a/libAACdec/include/aacdecoder_lib.h b/libAACdec/include/aacdecoder_lib.h
index 7ab60f1..9ae43de 100644
--- a/libAACdec/include/aacdecoder_lib.h
+++ b/libAACdec/include/aacdecoder_lib.h
@@ -348,6 +348,10 @@ Where N equals to CStreamInfo::frameSize .
 
 #include "genericStds.h"
 
+#define AACDECODER_LIB_VL0 2
+#define AACDECODER_LIB_VL1 5
+#define AACDECODER_LIB_VL2 17
+
 /**
  * \brief  AAC decoder error codes.
  */
diff --git a/libAACdec/src/block.cpp b/libAACdec/src/block.cpp
index a19284e..8bee2d4 100644
--- a/libAACdec/src/block.cpp
+++ b/libAACdec/src/block.cpp
@@ -138,7 +138,7 @@ LONG CBlock_GetEscape(HANDLE_FDK_BITSTREAM bs, /*!< pointer to bitstream */
 
   if (i > 16)
   {
-    if (i - 16 > CACHE_BITS) { /* cannot read more than "CACHE_BITS" bits at once in the function FDKreadBits() */
+    if (i >= 31) { /* (1 << i) will shift into the sign bit if i >= 31 */
       return (MAX_QUANTIZED_VALUE + 1); /* returning invalid value that will be captured later */
     }
 
@@ -318,6 +318,9 @@ AAC_DECODER_ERROR CBlock_ReadSectionData(HANDLE_FDK_BITSTREAM bs,
       }
 
       sect_len += sect_len_incr;
+      if (sect_len <= 0) {
+         return AAC_DEC_PARSE_ERROR;
+      }
 
 
       top = band + sect_len;
diff --git a/libAACdec/src/channel.cpp b/libAACdec/src/channel.cpp
index 5475079..4b182e0 100644
--- a/libAACdec/src/channel.cpp
+++ b/libAACdec/src/channel.cpp
@@ -411,11 +411,15 @@ AAC_DECODER_ERROR CChannelElement_Read(HANDLE_FDK_BITSTREAM hBs,
     case drmcrc_end_reg:
       if (pTpDec != NULL) {
         transportDec_CrcEndReg(pTpDec, crcReg1);
+        crcReg1 = -1;
       }
       break;
     case adtscrc_end_reg2:
-      if (pTpDec != NULL) {
+      if (crcReg1 != -1) {
+        error = AAC_DEC_DECODE_FRAME_ERROR;
+      } else if (pTpDec != NULL) {
         transportDec_CrcEndReg(pTpDec, crcReg2);
+        crcReg2 = -1;
       }
       break;
     case drmcrc_start_reg:
@@ -447,5 +451,16 @@ AAC_DECODER_ERROR CChannelElement_Read(HANDLE_FDK_BITSTREAM hBs,
   } while (list->id[i] != end_of_sequence);
 
 bail:
+  if (crcReg1 != -1 || crcReg2 != -1) {
+    if (error == AAC_DEC_OK) {
+      error = AAC_DEC_DECODE_FRAME_ERROR;
+    }
+    if (crcReg1 != -1) {
+      transportDec_CrcEndReg(pTpDec, crcReg1);
+    }
+    if (crcReg2 != -1) {
+      transportDec_CrcEndReg(pTpDec, crcReg2);
+    }
+  }
   return error;
 }