Index: /libmpc/branches/r2d/libmpcdec/mpc_demux.c
===================================================================
--- /libmpc/branches/r2d/libmpcdec/mpc_demux.c	(revision 267)
+++ /libmpc/branches/r2d/libmpcdec/mpc_demux.c	(revision 268)
@@ -301,6 +301,9 @@
 		mpc_demux_fill(d, 11, 0); // max header block size
 		size = mpc_bits_get_block(&d->bits_reader, &b);
-		// FIXME : stop scan if invalid key
 		while( memcmp(b.key, "AP", 2) != 0 ){ // scan all blocks until audio
+			if (b.key[0] < 65 || b.key[0] > 90 || b.key[1] < 65 || b.key[1] > 90)
+				return MPC_STATUS_INVALIDSV;
+			if (b.size > (mpc_uint64_t) DEMUX_BUFFER_SIZE - 11)
+				return MPC_STATUS_INVALIDSV;
 			mpc_demux_fill(d, 11 + (mpc_uint32_t) b.size, 0);
 			if (memcmp(b.key, "SH", 2) == 0){
@@ -319,5 +322,5 @@
 		}
 		d->bits_reader.buff -= size;
-		if (d->si.stream_version == 0) // si no initialized !!!
+		if (d->si.stream_version == 0) // si not initialized !!!
 			return MPC_STATUS_INVALIDSV;
 	} else