Index: /libmpc/trunk/libmpcdec/mpc_demux.c
===================================================================
--- /libmpc/trunk/libmpcdec/mpc_demux.c	(revision 422)
+++ /libmpc/trunk/libmpcdec/mpc_demux.c	(revision 423)
@@ -115,4 +115,16 @@
 
 /**
+ * checks if a block key is valid
+ * @param key the two caracters key to check
+ * @return MPC_STATUS_INVALIDSV if the key is invalid, MPC_STATUS_OK else
+ */
+static inline mpc_status mpc_check_key(char * key)
+{
+	if (key[0] < 65 || key[0] > 90 || key[1] < 65 || key[1] > 90)
+		return MPC_STATUS_INVALIDSV;
+	return MPC_STATUS_OK;
+}
+
+/**
  * seek to a bit position in the stream
  * @param d demuxer context
@@ -304,4 +316,6 @@
 	int tag_size = 0, chap_size = 0, size, i = 0;
 
+	d->chap_nb = 0;
+
 	if (d->si.stream_version < 8)
 		return;
@@ -312,4 +326,6 @@
 		size = mpc_bits_get_block(&d->bits_reader, &b);
 		while (memcmp(b.key, "SE", 2) != 0) {
+			if (mpc_check_key(b.key) != MPC_STATUS_OK)
+				return;
 			if (memcmp(b.key, "CT", 2) == 0) {
 				if (d->chap_pos == 0) d->chap_pos = cur_pos;
@@ -324,5 +340,4 @@
 	}
 
-	d->chap_nb = 0;
 	mpc_demux_seek(d, d->chap_pos, 20);
 	size = mpc_bits_get_block(&d->bits_reader, &b);
@@ -425,5 +440,5 @@
 		size = mpc_bits_get_block(&d->bits_reader, &b);
 		while( memcmp(b.key, "AP", 2) != 0 ){ // scan all blocks until audio
-			if (b.key[0] < 65 || b.key[0] > 90 || b.key[1] < 65 || b.key[1] > 90)
+			if (mpc_check_key(b.key) != MPC_STATUS_OK)
 				return MPC_STATUS_INVALIDSV;
 			if (b.size > (mpc_uint64_t) DEMUX_BUFFER_SIZE - 11)
@@ -505,5 +520,5 @@
 			mpc_bits_get_block(&d->bits_reader, &b);
 			while( memcmp(b.key, "AP", 2) != 0 ) { // scan all blocks until audio
-				if (b.key[0] < 65 || b.key[0] > 90 || b.key[1] < 65 || b.key[1] > 90)
+				if (mpc_check_key(b.key) != MPC_STATUS_OK)
 					goto error;
 				if (memcmp(b.key, "SE", 2) == 0) { // end block