Index: /libmpc/branches/r2d/libmpcdec/internal.h
===================================================================
--- /libmpc/branches/r2d/libmpcdec/internal.h	(revision 265)
+++ /libmpc/branches/r2d/libmpcdec/internal.h	(revision 266)
@@ -62,6 +62,7 @@
 	unsigned int count; /// unread bits in current byte
 };
-
-#define DEMUX_BUFFER_SIZE 65536
+	
+#define MAX_FRAME_SIZE 4352
+#define DEMUX_BUFFER_SIZE (65536 - MAX_FRAME_SIZE) // need some space as sand box
 
 struct mpc_demux_t {
@@ -71,5 +72,5 @@
 
 	// buffer
-	mpc_uint8_t buffer[DEMUX_BUFFER_SIZE];
+	mpc_uint8_t buffer[DEMUX_BUFFER_SIZE + MAX_FRAME_SIZE];
 	mpc_size_t bytes_total;
 	mpc_bits_reader bits_reader;
Index: /libmpc/branches/r2d/libmpcdec/mpc_demux.c
===================================================================
--- /libmpc/branches/r2d/libmpcdec/mpc_demux.c	(revision 265)
+++ /libmpc/branches/r2d/libmpcdec/mpc_demux.c	(revision 266)
@@ -50,5 +50,4 @@
 void  streaminfo_gain(mpc_streaminfo* si, const mpc_bits_reader * r_in);
 
-#define MAX_FRAME_SIZE 4352
 
 enum {
@@ -300,4 +299,5 @@
 		mpc_demux_fill(d, 11, 0); // max header block size
 		size = mpc_bits_get_block(&d->bits_reader, &b);
+		// FIXME : stop scan if invalid key
 		while( memcmp(b.key, "AP", 2) != 0 ){ // scan all blocks until audio
 			mpc_demux_fill(d, 11 + (mpc_uint32_t) b.size, 0);
@@ -317,4 +317,6 @@
 		}
 		d->bits_reader.buff -= size;
+		if (d->si.stream_version == 0) // si no initialized !!!
+			return MPC_STATUS_INVALIDSV;
 	} else
 		return MPC_STATUS_INVALIDSV;
@@ -335,4 +337,6 @@
 			p_tmp->d = mpc_decoder_init(&p_tmp->si);
 		} else {
+			if (p_tmp->seek_table)
+				free(p_tmp->seek_table);
 			free(p_tmp);
 			p_tmp = 0;
@@ -357,6 +361,6 @@
 void mpc_demux_decode(mpc_demux * d, mpc_frame_info * i)
 {
+	mpc_bits_reader r;
 	if (d->si.stream_version >= 8) {
-		mpc_bits_reader r;
 		i->is_key_frame = MPC_FALSE;
 
@@ -389,7 +393,10 @@
 		d->block_bits -= ((d->bits_reader.buff - r.buff) << 3) + r.count - d->bits_reader.count;
 		d->block_frames--;
-		if (d->block_bits < 0) i->bits = -1;
+		if (d->block_bits < 0 || (d->block_frames == 0 && d->block_bits > 7)) {
+			// an error occured, stop decoding
+			// FIXME : return an error code.
+			i->bits = -1; // we pretend it's end of file
+		}
 	} else {
-		mpc_bits_reader r;
 		if (d->d->decoded_samples == (d->seek_table_size << d->seek_pwr) * MPC_FRAME_LENGTH) {
 			d->seek_table[d->seek_table_size] = (mpc_uint32_t) mpc_demux_pos(d);
@@ -397,7 +404,17 @@
 		}
 		mpc_demux_fill(d, MAX_FRAME_SIZE, MPC_BUFFER_FULL | MPC_BUFFER_SWAP);
-		mpc_bits_read(&d->bits_reader, 20); // read frame size
+		d->block_bits = (mpc_int_t) mpc_bits_read(&d->bits_reader, 20); // read frame size
 		r = d->bits_reader;
 		mpc_decoder_decode_frame(d->d, &d->bits_reader, i);
+		if (d->block_bits != ((d->bits_reader.buff - r.buff) << 3) + r.count - d->bits_reader.count) {
+			// an error occured, stop decoding
+			// FIXME : return an error code.
+			i->bits = -1; // we pretend it's end of file
+		}
+	}
+	if (d->buffer + d->bytes_total < d->bits_reader.buff + ((8 - d->bits_reader.count) >> 3)) {
+		// we're reading outside the buffer bytes, this is an error !
+		// FIXME : return an error code.
+		i->bits = -1; // we pretend it's end of file
 	}
 }