3 files changed, 27 insertions, 28 deletions

diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp
index e46cb32..8f77017 100644
--- a/libMpegTPDec/src/tpdec_asc.cpp
+++ b/libMpegTPDec/src/tpdec_asc.cpp
@@ -1694,8 +1694,7 @@ static TRANSPORTDEC_ERROR extElementConfig(CSUsacExtElementConfig *extElement,
                                            const AUDIO_OBJECT_TYPE aot) {
   TRANSPORTDEC_ERROR ErrorStatus = TRANSPORTDEC_OK;
 
-  USAC_EXT_ELEMENT_TYPE usacExtElementType =
-      (USAC_EXT_ELEMENT_TYPE)escapedValue(hBs, 4, 8, 16);
+  UINT usacExtElementType = escapedValue(hBs, 4, 8, 16);
 
   /* recurve extension elements which are invalid for USAC */
   if (aot == AOT_USAC) {
@@ -1712,7 +1711,6 @@ static TRANSPORTDEC_ERROR extElementConfig(CSUsacExtElementConfig *extElement,
     }
   }
 
-  extElement->usacExtElementType = usacExtElementType;
   int usacExtElementConfigLength = escapedValue(hBs, 4, 8, 16);
   extElement->usacExtElementConfigLength = (USHORT)usacExtElementConfigLength;
   INT bsAnchor;
@@ -1746,8 +1744,10 @@ static TRANSPORTDEC_ERROR extElementConfig(CSUsacExtElementConfig *extElement,
       }
     } break;
     default:
+      usacExtElementType = ID_EXT_ELE_UNKNOWN;
       break;
   }
+  extElement->usacExtElementType = (USAC_EXT_ELEMENT_TYPE)usacExtElementType;
 
   /* Adjust bit stream position. This is required because of byte alignment and
    * unhandled extensions. */
@@ -1776,7 +1776,7 @@ static TRANSPORTDEC_ERROR configExtension(CSUsacConfig *usc,
   TRANSPORTDEC_ERROR ErrorStatus = TRANSPORTDEC_OK;
 
   int numConfigExtensions;
-  CONFIG_EXT_ID usacConfigExtType;
+  UINT usacConfigExtType;
   int usacConfigExtLength;
   int loudnessInfoSetIndex =
       -1; /* index of loudnessInfoSet config extension. -1 if not contained. */
@@ -1787,7 +1787,7 @@ static TRANSPORTDEC_ERROR configExtension(CSUsacConfig *usc,
   for (int confExtIdx = 0; confExtIdx < numConfigExtensions; confExtIdx++) {
     INT nbits;
     int loudnessInfoSetConfigExtensionPosition = FDKgetValidBits(hBs);
-    usacConfigExtType = (CONFIG_EXT_ID)escapedValue(hBs, 4, 8, 16);
+    usacConfigExtType = escapedValue(hBs, 4, 8, 16);
     usacConfigExtLength = (int)escapedValue(hBs, 4, 8, 16);
 
     /* Start bit position of config extension */
diff --git a/libMpegTPDec/src/tpdec_latm.cpp b/libMpegTPDec/src/tpdec_latm.cpp
index 3b71db8..c32be54 100644
--- a/libMpegTPDec/src/tpdec_latm.cpp
+++ b/libMpegTPDec/src/tpdec_latm.cpp
@@ -1,7 +1,7 @@
 /* -----------------------------------------------------------------------------
 Software License for The Fraunhofer FDK AAC Codec Library for Android
 
-© Copyright  1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten
+© Copyright  1995 - 2021 Fraunhofer-Gesellschaft zur Förderung der angewandten
 Forschung e.V. All rights reserved.
 
  1.    INTRODUCTION
@@ -591,6 +591,18 @@ bail:
   return (ErrorStatus);
 }
 
+static int CLatmDemux_ReadAuChunkLengthInfo(HANDLE_FDK_BITSTREAM bs) {
+  int len = 0, tmp = 255;
+  int validBytes = (int)FDKgetValidBits(bs) >> 3;
+
+  while (tmp == 255 && validBytes-- > 0) {
+    tmp = (int)FDKreadBits(bs, 8);
+    len += tmp;
+  }
+
+  return ((tmp == 255) ? -1 : (len << 3));
+}
+
 TRANSPORTDEC_ERROR CLatmDemux_ReadPayloadLengthInfo(HANDLE_FDK_BITSTREAM bs,
                                                     CLatmDemux *pLatmDemux) {
   TRANSPORTDEC_ERROR ErrorStatus = TRANSPORTDEC_OK;
@@ -602,11 +614,17 @@ TRANSPORTDEC_ERROR CLatmDemux_ReadPayloadLengthInfo(HANDLE_FDK_BITSTREAM bs,
       FDK_ASSERT(pLatmDemux->m_numLayer[prog] <= LATM_MAX_LAYER);
       for (UINT lay = 0; lay < pLatmDemux->m_numLayer[prog]; lay++) {
         LATM_LAYER_INFO *p_linfo = &pLatmDemux->m_linfo[prog][lay];
+        int auChunkLengthInfo = 0;
 
         switch (p_linfo->m_frameLengthType) {
           case 0:
-            p_linfo->m_frameLengthInBits = CLatmDemux_ReadAuChunkLengthInfo(bs);
-            totalPayloadBits += p_linfo->m_frameLengthInBits;
+            auChunkLengthInfo = CLatmDemux_ReadAuChunkLengthInfo(bs);
+            if (auChunkLengthInfo >= 0) {
+              p_linfo->m_frameLengthInBits = (UINT)auChunkLengthInfo;
+              totalPayloadBits += p_linfo->m_frameLengthInBits;
+            } else {
+              return TRANSPORTDEC_PARSE_ERROR;
+            }
             break;
           case 3:
           case 5:
@@ -627,23 +645,6 @@ TRANSPORTDEC_ERROR CLatmDemux_ReadPayloadLengthInfo(HANDLE_FDK_BITSTREAM bs,
   return (ErrorStatus);
 }
 
-int CLatmDemux_ReadAuChunkLengthInfo(HANDLE_FDK_BITSTREAM bs) {
-  UCHAR endFlag;
-  int len = 0;
-
-  do {
-    UCHAR tmp = (UCHAR)FDKreadBits(bs, 8);
-    endFlag = (tmp < 255);
-
-    len += tmp;
-
-  } while (endFlag == 0);
-
-  len <<= 3; /* convert from bytes to bits */
-
-  return len;
-}
-
 UINT CLatmDemux_GetFrameLengthInBits(CLatmDemux *pLatmDemux, const UINT prog,
                                      const UINT layer) {
   UINT nFrameLenBits = 0;
diff --git a/libMpegTPDec/src/tpdec_latm.h b/libMpegTPDec/src/tpdec_latm.h
index 6af553d..8b8c971 100644
--- a/libMpegTPDec/src/tpdec_latm.h
+++ b/libMpegTPDec/src/tpdec_latm.h
@@ -1,7 +1,7 @@
 /* -----------------------------------------------------------------------------
 Software License for The Fraunhofer FDK AAC Codec Library for Android
 
-© Copyright  1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten
+© Copyright  1995 - 2021 Fraunhofer-Gesellschaft zur Förderung der angewandten
 Forschung e.V. All rights reserved.
 
  1.    INTRODUCTION
@@ -151,8 +151,6 @@ typedef struct {
                                   AudioPreRoll */
 } CLatmDemux;
 
-int CLatmDemux_ReadAuChunkLengthInfo(HANDLE_FDK_BITSTREAM bs);
-
 TRANSPORTDEC_ERROR CLatmDemux_Read(HANDLE_FDK_BITSTREAM bs,
                                    CLatmDemux *pLatmDemux, TRANSPORT_TYPE tt,
                                    CSTpCallBacks *pTpDecCallbacks,