Index: /libmpc/trunk/libmpcdec/mpc_demux.c
===================================================================
--- /libmpc/trunk/libmpcdec/mpc_demux.c	(revision 301)
+++ /libmpc/trunk/libmpcdec/mpc_demux.c	(revision 302)
@@ -101,5 +101,5 @@
 	}
 
-	return 0;
+	return (mpc_uint32_t) -1;
 }
 
@@ -367,4 +367,5 @@
 {
 	mpc_bits_reader r;
+	int pos = 0;
 	if (d->si.stream_version >= 8) {
 		i->is_key_frame = MPC_FALSE;
@@ -379,10 +380,15 @@
 			mpc_demux_fill(d, 11, 0); // max header block size
 			mpc_bits_get_block(&d->bits_reader, &b);
+			pos = mpc_demux_pos(d) >> 3;
 			while( memcmp(b.key, "AP", 2) != 0 ) { // scan all blocks until audio
+				if (b.key[0] < 65 || b.key[0] > 90 || b.key[1] < 65 || b.key[1] > 90
+								|| b.size > (mpc_uint64_t) DEMUX_BUFFER_SIZE - 11)
+					goto error;
 				if (memcmp(b.key, "SE", 2) == 0) { // end block
 					i->bits = -1;
 					return MPC_STATUS_OK;
 				}
-				mpc_demux_fill(d, 11 + (mpc_uint32_t) b.size, 0);
+				if (mpc_demux_fill(d, 11 + (mpc_uint32_t) b.size, 0) == 0)
+					goto error;
 				d->bits_reader.buff += b.size;
 				mpc_bits_get_block(&d->bits_reader, &b);
@@ -392,5 +398,5 @@
 			i->is_key_frame = MPC_TRUE;
 		}
-		if (d->buffer + d->bytes_total - d->bits_reader.buff <= MAX_FRAME_SIZE)
+		if (d->buffer + d->bytes_total - d->bits_reader.buff <= MAX_FRAME_SIZE * 2)
 			mpc_demux_fill(d, (d->block_bits >> 3) + 1, 0);
 		r = d->bits_reader;
@@ -398,8 +404,6 @@
 		d->block_bits -= ((d->bits_reader.buff - r.buff) << 3) + r.count - d->bits_reader.count;
 		d->block_frames--;
-		if (d->block_bits < 0 || (d->block_frames == 0 && d->block_bits > 7)) {
-			i->bits = -1; // we pretend it's end of file
-			return MPC_STATUS_INVALIDSV;
-		}
+		if (d->block_bits < 0 || (d->block_frames == 0 && d->block_bits > 7))
+			goto error;
 	} else {
 		if (d->d->decoded_samples == (d->seek_table_size << d->seek_pwr) * MPC_FRAME_LENGTH) {
@@ -412,14 +416,15 @@
 		r = d->bits_reader;
 		mpc_decoder_decode_frame(d->d, &d->bits_reader, i);
-		if (i->bits != -1 && d->block_bits != ((d->bits_reader.buff - r.buff) << 3) + r.count - d->bits_reader.count) {
-			i->bits = -1; // we pretend it's end of file
-			return MPC_STATUS_INVALIDSV;
-		}
-	}
-	if (d->buffer + d->bytes_total < d->bits_reader.buff + ((8 - d->bits_reader.count) >> 3)) {
+		if (i->bits != -1 && d->block_bits != ((d->bits_reader.buff - r.buff) << 3) + r.count - d->bits_reader.count)
+			goto error;
+	}
+	if (d->buffer + d->bytes_total < d->bits_reader.buff + ((8 - d->bits_reader.count) >> 3))
+		goto error;
+
+	return MPC_STATUS_OK;
+error:
 		i->bits = -1; // we pretend it's end of file
-		return MPC_STATUS_INVALIDSV;
-	}
-	return MPC_STATUS_OK;
+		// return MPC_STATUS_INVALIDSV;
+		return pos;
 }
 
Index: /libmpc/trunk/mpc2sv8/mpc2sv8.c
===================================================================
--- /libmpc/trunk/mpc2sv8/mpc2sv8.c	(revision 301)
+++ /libmpc/trunk/mpc2sv8/mpc2sv8.c	(revision 302)
@@ -177,5 +177,6 @@
 
 	// copy end of file
-	stream_size = (((mpc_demux_pos(demux) + 7) >> 3) - si.header_position + 3) & ~3;
+
+	stream_size = (((mpc_demux_pos(demux) + 7 - 20) >> 3) - si.header_position + 3) & ~3;
 	fseek(in_file, si.header_position + stream_size, SEEK_SET);
 	while((r_size = fread(buf, 1, TMP_BUF_SIZE, in_file))) {