diff --git a/Android.bp b/Android.bp
index b322d07..315e5bc 100644
--- a/Android.bp
+++ b/Android.bp
@@ -28,6 +28,9 @@
         misc_undefined:["unsigned-integer-overflow", "signed-integer-overflow"],
         cfi: true,
     },
+    shared_libs: [
+        "liblog",
+    ],
     export_include_dirs: [
         "libAACdec/include",
         "libAACenc/include",
diff --git a/libAACdec/src/aacdec_hcr.cpp b/libAACdec/src/aacdec_hcr.cpp
index 84e05b0..6114756 100644
--- a/libAACdec/src/aacdec_hcr.cpp
+++ b/libAACdec/src/aacdec_hcr.cpp
@@ -134,17 +134,18 @@
     USHORT *pNumExtendedSortedSectionsInSets,
     int numExtendedSortedSectionsInSetsIdx);
 
-static INT DecodeEscapeSequence(HANDLE_FDK_BITSTREAM bs, INT quantSpecCoef,
-                                INT *pLeftStartOfSegment,
+static INT DecodeEscapeSequence(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
+                                INT quantSpecCoef, INT *pLeftStartOfSegment,
                                 SCHAR *pRemainingBitsInSegment,
                                 int *pNumDecodedBits);
 
-static int DecodePCW_Sign(HANDLE_FDK_BITSTREAM bs, UINT codebookDim,
-                          const SCHAR *pQuantVal, FIXP_DBL *pQuantSpecCoef,
-                          int *quantSpecCoefIdx, INT *pLeftStartOfSegment,
+static int DecodePCW_Sign(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
+                          UINT codebookDim, const SCHAR *pQuantVal,
+                          FIXP_DBL *pQuantSpecCoef, int *quantSpecCoefIdx,
+                          INT *pLeftStartOfSegment,
                           SCHAR *pRemainingBitsInSegment, int *pNumDecodedBits);
 
-static const SCHAR *DecodePCW_Body(HANDLE_FDK_BITSTREAM bs,
+static const SCHAR *DecodePCW_Body(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
                                    const UINT *pCurrentTree,
                                    const SCHAR *pQuantValBase,
                                    INT *pLeftStartOfSegment,
@@ -291,7 +292,7 @@
       SPEC_LONG(pAacDecoderChannelInfo->pSpectralCoefficient);
 
   FDKsyncCache(bs);
-  pHcr->decInOut.bitstreamIndex = FDKgetBitCnt(bs);
+  pHcr->decInOut.bitstreamAnchor = (INT)FDKgetValidBits(bs);
 
   if (!IsLongBlock(&pAacDecoderChannelInfo->icsInfo)) /* short block */
   {
@@ -436,7 +437,7 @@
   int pTmp5;
 
   INT bitCntOffst;
-  INT saveBitCnt = FDKgetBitCnt(bs); /* save bitstream position */
+  INT saveBitCnt = (INT)FDKgetValidBits(bs); /* save bitstream position */
 
   HcrCalcNumCodeword(pHcr);
 
@@ -487,7 +488,7 @@
                                           pSamplingRateInfo);
 
   /* restore bitstream position */
-  bitCntOffst = saveBitCnt - FDKgetBitCnt(bs);
+  bitCntOffst = (INT)FDKgetValidBits(bs) - saveBitCnt;
   if (bitCntOffst) {
     FDKpushBiDirectional(bs, bitCntOffst);
   }
@@ -815,7 +816,6 @@
   INT *pLeftStartOfSegment = pHcr->segmentInfo.pLeftStartOfSegment;
   INT *pRightStartOfSegment = pHcr->segmentInfo.pRightStartOfSegment;
   SCHAR *pRemainingBitsInSegment = pHcr->segmentInfo.pRemainingBitsInSegment;
-  INT bitstreamIndex = pHcr->decInOut.bitstreamIndex;
   const UCHAR *pMaxCwLength = aMaxCwLen;
 
   for (i = numSortedSection; i != 0; i--) {
@@ -825,7 +825,7 @@
 
     for (j = *pNumSortedCodewordInSection; j != 0; j--) {
       /* width allows a new segment */
-      intermediateResult = bitstreamIndex + segmentStart;
+      intermediateResult = segmentStart;
       if ((segmentStart + segmentWidth) <= lengthOfReorderedSpectralData) {
         /* store segment start, segment length and increment the number of
          * segments */
@@ -841,12 +841,11 @@
         pLeftStartOfSegment--;
         pRightStartOfSegment--;
         pRemainingBitsInSegment--;
-        segmentStart = *pLeftStartOfSegment - bitstreamIndex;
+        segmentStart = *pLeftStartOfSegment;
 
         lastSegmentWidth = lengthOfReorderedSpectralData - segmentStart;
         *pRemainingBitsInSegment = lastSegmentWidth;
-        *pRightStartOfSegment =
-            bitstreamIndex + segmentStart + lastSegmentWidth - 1;
+        *pRightStartOfSegment = segmentStart + lastSegmentWidth - 1;
         endFlag = 1;
         break;
       }
@@ -1071,9 +1070,9 @@
         numDecodedBits = 0;
 
         /* decode PCW_BODY */
-        pQuantVal =
-            DecodePCW_Body(bs, pCurrentTree, pQuantValBase, pLeftStartOfSegment,
-                           pRemainingBitsInSegment, &numDecodedBits);
+        pQuantVal = DecodePCW_Body(
+            bs, pHcr->decInOut.bitstreamAnchor, pCurrentTree, pQuantValBase,
+            pLeftStartOfSegment, pRemainingBitsInSegment, &numDecodedBits);
 
         /* result is written out here because NO sign bits follow the body */
         for (i = dimension; i != 0; i--) {
@@ -1115,14 +1114,14 @@
         int err;
         numDecodedBits = 0;
 
-        pQuantVal =
-            DecodePCW_Body(bs, pCurrentTree, pQuantValBase, pLeftStartOfSegment,
-                           pRemainingBitsInSegment, &numDecodedBits);
+        pQuantVal = DecodePCW_Body(
+            bs, pHcr->decInOut.bitstreamAnchor, pCurrentTree, pQuantValBase,
+            pLeftStartOfSegment, pRemainingBitsInSegment, &numDecodedBits);
 
         err = DecodePCW_Sign(
-            bs, dimension, pQuantVal, pQuantizedSpectralCoefficients,
-            &quantizedSpectralCoefficientsIdx, pLeftStartOfSegment,
-            pRemainingBitsInSegment, &numDecodedBits);
+            bs, pHcr->decInOut.bitstreamAnchor, dimension, pQuantVal,
+            pQuantizedSpectralCoefficients, &quantizedSpectralCoefficientsIdx,
+            pLeftStartOfSegment, pRemainingBitsInSegment, &numDecodedBits);
         if (err != 0) {
           return;
         }
@@ -1157,14 +1156,14 @@
         numDecodedBits = 0;
 
         /* decode PCW_BODY */
-        pQuantVal =
-            DecodePCW_Body(bs, pCurrentTree, pQuantValBase, pLeftStartOfSegment,
-                           pRemainingBitsInSegment, &numDecodedBits);
+        pQuantVal = DecodePCW_Body(
+            bs, pHcr->decInOut.bitstreamAnchor, pCurrentTree, pQuantValBase,
+            pLeftStartOfSegment, pRemainingBitsInSegment, &numDecodedBits);
 
         err = DecodePCW_Sign(
-            bs, dimension, pQuantVal, pQuantizedSpectralCoefficients,
-            &quantizedSpectralCoefficientsIdx, pLeftStartOfSegment,
-            pRemainingBitsInSegment, &numDecodedBits);
+            bs, pHcr->decInOut.bitstreamAnchor, dimension, pQuantVal,
+            pQuantizedSpectralCoefficients, &quantizedSpectralCoefficientsIdx,
+            pLeftStartOfSegment, pRemainingBitsInSegment, &numDecodedBits);
         if (err != 0) {
           return;
         }
@@ -1177,7 +1176,7 @@
             (FIXP_DBL)ESCAPE_VALUE) {
           pQuantizedSpectralCoefficients[quantizedSpectralCoefficientsIdx] =
               (FIXP_DBL)DecodeEscapeSequence(
-                  bs,
+                  bs, pHcr->decInOut.bitstreamAnchor,
                   pQuantizedSpectralCoefficients
                       [quantizedSpectralCoefficientsIdx],
                   pLeftStartOfSegment, pRemainingBitsInSegment,
@@ -1193,7 +1192,7 @@
             (FIXP_DBL)ESCAPE_VALUE) {
           pQuantizedSpectralCoefficients[quantizedSpectralCoefficientsIdx] =
               (FIXP_DBL)DecodeEscapeSequence(
-                  bs,
+                  bs, pHcr->decInOut.bitstreamAnchor,
                   pQuantizedSpectralCoefficients
                       [quantizedSpectralCoefficientsIdx],
                   pLeftStartOfSegment, pRemainingBitsInSegment,
@@ -1331,7 +1330,7 @@
 spectral coefficients
 --------------------------------------------------------------------------------------------
 */
-static const SCHAR *DecodePCW_Body(HANDLE_FDK_BITSTREAM bs,
+static const SCHAR *DecodePCW_Body(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
                                    const UINT *pCurrentTree,
                                    const SCHAR *pQuantValBase,
                                    INT *pLeftStartOfSegment,
@@ -1349,7 +1348,7 @@
 
   /* decode whole PCW-codeword-body */
   while (1) {
-    carryBit = HcrGetABitFromBitstream(bs, pLeftStartOfSegment,
+    carryBit = HcrGetABitFromBitstream(bs, bsAnchor, pLeftStartOfSegment,
                                        pLeftStartOfSegment, /* dummy */
                                        FROM_LEFT_TO_RIGHT);
     *pRemainingBitsInSegment -= 1;
@@ -1384,8 +1383,8 @@
 --------------------------------------------------------------------------------------------
 */
 
-static INT DecodeEscapeSequence(HANDLE_FDK_BITSTREAM bs, INT quantSpecCoef,
-                                INT *pLeftStartOfSegment,
+static INT DecodeEscapeSequence(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
+                                INT quantSpecCoef, INT *pLeftStartOfSegment,
                                 SCHAR *pRemainingBitsInSegment,
                                 int *pNumDecodedBits) {
   UINT i;
@@ -1396,7 +1395,7 @@
 
   /* decode escape prefix */
   while (1) {
-    carryBit = HcrGetABitFromBitstream(bs, pLeftStartOfSegment,
+    carryBit = HcrGetABitFromBitstream(bs, bsAnchor, pLeftStartOfSegment,
                                        pLeftStartOfSegment, /* dummy */
                                        FROM_LEFT_TO_RIGHT);
     *pRemainingBitsInSegment -= 1;
@@ -1412,7 +1411,7 @@
 
   /* decode escape word */
   for (i = escapeOnesCounter; i != 0; i--) {
-    carryBit = HcrGetABitFromBitstream(bs, pLeftStartOfSegment,
+    carryBit = HcrGetABitFromBitstream(bs, bsAnchor, pLeftStartOfSegment,
                                        pLeftStartOfSegment, /* dummy */
                                        FROM_LEFT_TO_RIGHT);
     *pRemainingBitsInSegment -= 1;
@@ -1441,9 +1440,10 @@
 line)
 --------------------------------------------------------------------------------------------
 */
-static int DecodePCW_Sign(HANDLE_FDK_BITSTREAM bs, UINT codebookDim,
-                          const SCHAR *pQuantVal, FIXP_DBL *pQuantSpecCoef,
-                          int *quantSpecCoefIdx, INT *pLeftStartOfSegment,
+static int DecodePCW_Sign(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
+                          UINT codebookDim, const SCHAR *pQuantVal,
+                          FIXP_DBL *pQuantSpecCoef, int *quantSpecCoefIdx,
+                          INT *pLeftStartOfSegment,
                           SCHAR *pRemainingBitsInSegment,
                           int *pNumDecodedBits) {
   UINT i;
@@ -1453,7 +1453,7 @@
   for (i = codebookDim; i != 0; i--) {
     quantSpecCoef = *pQuantVal++;
     if (quantSpecCoef != 0) {
-      carryBit = HcrGetABitFromBitstream(bs, pLeftStartOfSegment,
+      carryBit = HcrGetABitFromBitstream(bs, bsAnchor, pLeftStartOfSegment,
                                          pLeftStartOfSegment, /* dummy */
                                          FROM_LEFT_TO_RIGHT);
       *pRemainingBitsInSegment -= 1;
diff --git a/libAACdec/src/aacdec_hcr_bit.cpp b/libAACdec/src/aacdec_hcr_bit.cpp
index a53ef16..0198659 100644
--- a/libAACdec/src/aacdec_hcr_bit.cpp
+++ b/libAACdec/src/aacdec_hcr_bit.cpp
@@ -132,13 +132,14 @@
         return:   - bit from bitstream
 --------------------------------------------------------------------------------------------
 */
-UINT HcrGetABitFromBitstream(HANDLE_FDK_BITSTREAM bs, INT *pLeftStartOfSegment,
+UINT HcrGetABitFromBitstream(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
+                             INT *pLeftStartOfSegment,
                              INT *pRightStartOfSegment, UCHAR readDirection) {
   UINT bit;
   INT readBitOffset;
 
   if (readDirection == FROM_LEFT_TO_RIGHT) {
-    readBitOffset = *pLeftStartOfSegment - FDKgetBitCnt(bs);
+    readBitOffset = (INT)FDKgetValidBits(bs) - bsAnchor + *pLeftStartOfSegment;
     if (readBitOffset) {
       FDKpushBiDirectional(bs, readBitOffset);
     }
@@ -147,7 +148,7 @@
 
     *pLeftStartOfSegment += 1;
   } else {
-    readBitOffset = *pRightStartOfSegment - FDKgetBitCnt(bs);
+    readBitOffset = (INT)FDKgetValidBits(bs) - bsAnchor + *pRightStartOfSegment;
     if (readBitOffset) {
       FDKpushBiDirectional(bs, readBitOffset);
     }
diff --git a/libAACdec/src/aacdec_hcr_bit.h b/libAACdec/src/aacdec_hcr_bit.h
index 7a57c8c..77242ac 100644
--- a/libAACdec/src/aacdec_hcr_bit.h
+++ b/libAACdec/src/aacdec_hcr_bit.h
@@ -107,7 +107,8 @@
 
 UCHAR ToggleReadDirection(UCHAR readDirection);
 
-UINT HcrGetABitFromBitstream(HANDLE_FDK_BITSTREAM bs, INT *pLeftStartOfSegment,
+UINT HcrGetABitFromBitstream(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
+                             INT *pLeftStartOfSegment,
                              INT *pRightStartOfSegment, UCHAR readDirection);
 
 #endif /* AACDEC_HCR_BIT_H */
diff --git a/libAACdec/src/aacdec_hcr_types.h b/libAACdec/src/aacdec_hcr_types.h
index d550bc2..1cc3cb0 100644
--- a/libAACdec/src/aacdec_hcr_types.h
+++ b/libAACdec/src/aacdec_hcr_types.h
@@ -350,7 +350,7 @@
   SHORT lengthOfReorderedSpectralData;
   SHORT numSection;
   SHORT *pNumLineInSect;
-  INT bitstreamIndex;
+  INT bitstreamAnchor;
   SCHAR lengthOfLongestCodeword;
   UCHAR *pCodebook;
 } HCR_INPUT_OUTPUT;
diff --git a/libAACdec/src/aacdec_hcrs.cpp b/libAACdec/src/aacdec_hcrs.cpp
index e2b7cd8..1d5aa27 100644
--- a/libAACdec/src/aacdec_hcrs.cpp
+++ b/libAACdec/src/aacdec_hcrs.cpp
@@ -615,9 +615,9 @@
 
   for (; pRemainingBitsInSegment[segmentOffset] > 0;
        pRemainingBitsInSegment[segmentOffset] -= 1) {
-    carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset],
-                                       &pRightStartOfSegment[segmentOffset],
-                                       readDirection);
+    carryBit = HcrGetABitFromBitstream(
+        bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset],
+        &pRightStartOfSegment[segmentOffset], readDirection);
 
     CarryBitToBranchValue(carryBit, /* make a step in decoding tree */
                           treeNode, &branchValue, &branchNode);
@@ -749,9 +749,9 @@
 
   for (; pRemainingBitsInSegment[segmentOffset] > 0;
        pRemainingBitsInSegment[segmentOffset] -= 1) {
-    carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset],
-                                       &pRightStartOfSegment[segmentOffset],
-                                       readDirection);
+    carryBit = HcrGetABitFromBitstream(
+        bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset],
+        &pRightStartOfSegment[segmentOffset], readDirection);
 
     CarryBitToBranchValue(carryBit, /* make a step in decoding tree */
                           treeNode, &branchValue, &branchNode);
@@ -884,9 +884,9 @@
   /* loop for sign bit decoding */
   for (; pRemainingBitsInSegment[segmentOffset] > 0;
        pRemainingBitsInSegment[segmentOffset] -= 1) {
-    carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset],
-                                       &pRightStartOfSegment[segmentOffset],
-                                       readDirection);
+    carryBit = HcrGetABitFromBitstream(
+        bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset],
+        &pRightStartOfSegment[segmentOffset], readDirection);
     cntSign -=
         1; /* decrement sign counter because one sign bit has been read */
 
@@ -997,9 +997,9 @@
 
   for (; pRemainingBitsInSegment[segmentOffset] > 0;
        pRemainingBitsInSegment[segmentOffset] -= 1) {
-    carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset],
-                                       &pRightStartOfSegment[segmentOffset],
-                                       readDirection);
+    carryBit = HcrGetABitFromBitstream(
+        bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset],
+        &pRightStartOfSegment[segmentOffset], readDirection);
 
     /* make a step in tree */
     CarryBitToBranchValue(carryBit, treeNode, &branchValue, &branchNode);
@@ -1159,9 +1159,9 @@
   /* loop for sign bit decoding */
   for (; pRemainingBitsInSegment[segmentOffset] > 0;
        pRemainingBitsInSegment[segmentOffset] -= 1) {
-    carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset],
-                                       &pRightStartOfSegment[segmentOffset],
-                                       readDirection);
+    carryBit = HcrGetABitFromBitstream(
+        bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset],
+        &pRightStartOfSegment[segmentOffset], readDirection);
 
     /* decrement sign counter because one sign bit has been read */
     cntSign -= 1;
@@ -1314,9 +1314,9 @@
   /* decode escape prefix */
   for (; pRemainingBitsInSegment[segmentOffset] > 0;
        pRemainingBitsInSegment[segmentOffset] -= 1) {
-    carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset],
-                                       &pRightStartOfSegment[segmentOffset],
-                                       readDirection);
+    carryBit = HcrGetABitFromBitstream(
+        bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset],
+        &pRightStartOfSegment[segmentOffset], readDirection);
 
     /* count ones and store sum in escapePrefixUp */
     if (carryBit == 1) {
@@ -1435,9 +1435,9 @@
   /* decode escape word */
   for (; pRemainingBitsInSegment[segmentOffset] > 0;
        pRemainingBitsInSegment[segmentOffset] -= 1) {
-    carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset],
-                                       &pRightStartOfSegment[segmentOffset],
-                                       readDirection);
+    carryBit = HcrGetABitFromBitstream(
+        bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset],
+        &pRightStartOfSegment[segmentOffset], readDirection);
 
     /* build escape word */
     escapeWord <<=
diff --git a/libAACdec/src/aacdecoder.cpp b/libAACdec/src/aacdecoder.cpp
index b8b1327..24907ee 100644
--- a/libAACdec/src/aacdecoder.cpp
+++ b/libAACdec/src/aacdecoder.cpp
@@ -1630,17 +1630,9 @@
   aacChannelsOffset = 0;
   aacChannelsOffsetIdx = 0;
   elementOffset = 0;
-  if (configMode & AC_CM_ALLOC_MEM) {
-    if ((ascChannels <= 0) ||
-        (asc->m_channelConfiguration > AACDEC_MAX_CH_CONF)) {
-      return AAC_DEC_UNSUPPORTED_CHANNELCONFIG;
-    }
-    if ((ascChannels + aacChannelsOffsetIdx) > ((8) * 2)) {
-      return AAC_DEC_UNSUPPORTED_CHANNELCONFIG;
-    }
-    if ((ascChannels + aacChannelsOffset) > (8)) {
-      return AAC_DEC_UNSUPPORTED_CHANNELCONFIG;
-    }
+  if ((ascChannels <= 0) || (ascChannels > (8)) ||
+      (asc->m_channelConfiguration > AACDEC_MAX_CH_CONF)) {
+    return AAC_DEC_UNSUPPORTED_CHANNELCONFIG;
   }
 
   /* Set syntax flags */
@@ -2055,17 +2047,12 @@
       if (self->flags[streamIndex] & (AC_RSV603DA | AC_USAC)) {
         _numElements = (int)asc->m_sc.m_usacConfig.m_usacNumElements;
       }
-      if (self->flags[streamIndex] & (AC_ER | AC_LD | AC_ELD)) {
-        _numElements = (asc->m_channelConfiguration == 7)
-                           ? 8
-                           : asc->m_channelConfiguration;
-      }
       for (int _el = 0; _el < _numElements; _el++) {
         int el_channels = 0;
         int el = elementOffset + _el;
 
         if (self->flags[streamIndex] &
-            (AC_ELD | AC_RSV603DA | AC_USAC | AC_RSVD50)) {
+            (AC_ER | AC_LD | AC_ELD | AC_RSV603DA | AC_USAC | AC_RSVD50)) {
           if (ch >= ascChannels) {
             break;
           }
@@ -2115,7 +2102,9 @@
                   (SPECTRAL_PTR)&self->workBufferCore2[ch * 1024];
 
               if (el_channels == 2) {
-                FDK_ASSERT(ch < (8) - 1);
+                if (ch >= (8) - 1) {
+                  return AAC_DEC_UNSUPPORTED_CHANNELCONFIG;
+                }
                 self->pAacDecoderChannelInfo[ch + 1]->pComData =
                     self->pAacDecoderChannelInfo[ch]->pComData;
                 self->pAacDecoderChannelInfo[ch + 1]->pComStaticData =
@@ -2519,8 +2508,14 @@
     if (!(self->flags[0] &
           (AC_USAC | AC_RSVD50 | AC_RSV603DA | AC_ELD | AC_SCALABLE | AC_ER)))
       type = (MP4_ELEMENT_ID)FDKreadBits(bs, 3);
-    else
+    else {
+      if (element_count >= (3 * ((8) * 2) + (((8) * 2)) / 2 + 4 * (1) + 1)) {
+        self->frameOK = 0;
+        ErrorStatus = AAC_DEC_PARSE_ERROR;
+        break;
+      }
       type = self->elements[element_count];
+    }
 
     if ((self->flags[streamIndex] & (AC_USAC | AC_RSVD50) &&
          element_count == 0) ||
@@ -2564,6 +2559,11 @@
       case ID_USAC_SCE:
       case ID_USAC_CPE:
       case ID_USAC_LFE:
+        if (element_count >= (3 * ((8) * 2) + (((8) * 2)) / 2 + 4 * (1) + 1)) {
+          self->frameOK = 0;
+          ErrorStatus = AAC_DEC_PARSE_ERROR;
+          break;
+        }
 
         el_channels = CAacDecoder_GetELChannels(
             type, self->usacStereoConfigIndex[element_count]);
@@ -2795,12 +2795,24 @@
       } break;
 
       case ID_EXT:
+        if (element_count >= (3 * ((8) * 2) + (((8) * 2)) / 2 + 4 * (1) + 1)) {
+          self->frameOK = 0;
+          ErrorStatus = AAC_DEC_PARSE_ERROR;
+          break;
+        }
+
         ErrorStatus = aacDecoder_ParseExplicitMpsAndSbr(
             self, bs, previous_element, previous_element_index, element_count,
             el_cnt);
         break;
 
       case ID_USAC_EXT: {
+        if ((element_count - element_count_prev_streams) >=
+            TP_USAC_MAX_ELEMENTS) {
+          self->frameOK = 0;
+          ErrorStatus = AAC_DEC_PARSE_ERROR;
+          break;
+        }
         /* parse extension element payload
            q.v. rsv603daExtElement() ISO/IEC DIS 23008-3  Table 30
            or   UsacExElement() ISO/IEC FDIS 23003-3:2011(E)  Table 21
diff --git a/libAACdec/src/conceal.cpp b/libAACdec/src/conceal.cpp
index a6064b6..569d672 100644
--- a/libAACdec/src/conceal.cpp
+++ b/libAACdec/src/conceal.cpp
@@ -2080,11 +2080,11 @@
       noiseVal = FX_DBL2FX_PCM(fMult(noiseValLong, TDNoiseAtt));
 
       /* add filtered noise - check for clipping, before */
-      if (pcmdata[ii] > (FIXP_PCM)MAXVAL_FIXP_PCM - noiseVal &&
-          noiseVal > (FIXP_PCM)0) {
+      if (noiseVal > (FIXP_PCM)0 &&
+          pcmdata[ii] > (FIXP_PCM)MAXVAL_FIXP_PCM - noiseVal) {
         noiseVal = noiseVal * (FIXP_PCM)-1;
-      } else if (pcmdata[ii] < (FIXP_PCM)MINVAL_FIXP_PCM - noiseVal &&
-                 noiseVal < (FIXP_PCM)0) {
+      } else if (noiseVal < (FIXP_PCM)0 &&
+                 pcmdata[ii] < (FIXP_PCM)MINVAL_FIXP_PCM - noiseVal) {
         noiseVal = noiseVal * (FIXP_PCM)-1;
       }
 
diff --git a/libAACdec/src/rvlc.cpp b/libAACdec/src/rvlc.cpp
index 92f9f02..b7a9be1 100644
--- a/libAACdec/src/rvlc.cpp
+++ b/libAACdec/src/rvlc.cpp
@@ -168,13 +168,14 @@
   /* set base bitstream ptr to the RVL-coded part (start of RVLC data (ESC 2))
    */
   FDKsyncCache(bs);
+  pRvlc->bsAnchor = (INT)FDKgetValidBits(bs);
 
-  pRvlc->bitstreamIndexRvlFwd = FDKgetBitCnt(
-      bs); /* first bit within RVL coded block as start address for  forward
-              decoding */
-  pRvlc->bitstreamIndexRvlBwd = FDKgetBitCnt(bs) + pRvlc->length_of_rvlc_sf -
-                                1; /* last bit within RVL coded block as start
-                                      address for backward decoding */
+  pRvlc->bitstreamIndexRvlFwd =
+      0; /* first bit within RVL coded block as start address for  forward
+            decoding */
+  pRvlc->bitstreamIndexRvlBwd =
+      pRvlc->length_of_rvlc_sf - 1; /* last bit within RVL coded block as start
+                                       address for backward decoding */
 
   /* skip RVLC-bitstream-part -- pointing now to escapes (if present) or to TNS
    * data (if present) */
@@ -183,7 +184,7 @@
   if (pRvlc->sf_escapes_present != 0) {
     /* locate internal bitstream ptr at escapes (which is the second part) */
     FDKsyncCache(bs);
-    pRvlc->bitstreamIndexEsc = FDKgetBitCnt(bs);
+    pRvlc->bitstreamIndexEsc = pRvlc->bsAnchor - (INT)FDKgetValidBits(bs);
 
     /* skip escapeRVLC-bitstream-part -- pointing to TNS data (if present)   to
      * make decoder continue */
@@ -259,8 +260,9 @@
   treeNode = *pEscTree; /* init at starting node */
 
   for (i = MAX_LEN_RVLC_ESCAPE_WORD - 1; i >= 0; i--) {
-    carryBit = rvlcReadBitFromBitstream(bs, /* get next bit */
-                                        pBitstreamIndexEsc, FWD);
+    carryBit =
+        rvlcReadBitFromBitstream(bs, /* get next bit */
+                                 pRvlc->bsAnchor, pBitstreamIndexEsc, FWD);
 
     CarryBitToBranchValue(carryBit, /* huffman decoding, do a single step in
                                        huffman decoding tree */
@@ -370,8 +372,9 @@
   UINT treeNode = *pRvlCodeTree;
 
   for (i = MAX_LEN_RVLC_CODE_WORD - 1; i >= 0; i--) {
-    carryBit = rvlcReadBitFromBitstream(bs, /* get next bit */
-                                        pBitstrIndxRvl, direction);
+    carryBit =
+        rvlcReadBitFromBitstream(bs, /* get next bit */
+                                 pRvlc->bsAnchor, pBitstrIndxRvl, direction);
 
     CarryBitToBranchValue(carryBit, /* huffman decoding, do a single step in
                                        huffman decoding tree */
@@ -1140,7 +1143,7 @@
   rvlcInit(pRvlc, pAacDecoderChannelInfo, bs);
 
   /* save bitstream position */
-  saveBitCnt = FDKgetBitCnt(bs);
+  saveBitCnt = (INT)FDKgetValidBits(bs);
 
   if (pRvlc->sf_escapes_present)
     rvlcDecodeEscapes(
@@ -1155,7 +1158,7 @@
   pAacDecoderChannelInfo->data.aac.PnsData.PnsActive = pRvlc->noise_used;
 
   /* restore bitstream position */
-  bitCntOffst = saveBitCnt - FDKgetBitCnt(bs);
+  bitCntOffst = (INT)FDKgetValidBits(bs) - saveBitCnt;
   if (bitCntOffst) {
     FDKpushBiDirectional(bs, bitCntOffst);
   }
diff --git a/libAACdec/src/rvlc_info.h b/libAACdec/src/rvlc_info.h
index fc9c19d..e7b3b99 100644
--- a/libAACdec/src/rvlc_info.h
+++ b/libAACdec/src/rvlc_info.h
@@ -164,6 +164,7 @@
   UCHAR direction;
 
   /* bitstream indices */
+  INT bsAnchor;             /* hcr bit buffer reference index */
   INT bitstreamIndexRvlFwd; /* base address of RVL-coded-scalefactor data (ESC
                                2) for forward  decoding */
   INT bitstreamIndexRvlBwd; /* base address of RVL-coded-scalefactor data (ESC
diff --git a/libAACdec/src/rvlcbit.cpp b/libAACdec/src/rvlcbit.cpp
index c06cf96..b0c4596 100644
--- a/libAACdec/src/rvlcbit.cpp
+++ b/libAACdec/src/rvlcbit.cpp
@@ -123,10 +123,10 @@
 --------------------------------------------------------------------------------------------
 */
 
-UCHAR rvlcReadBitFromBitstream(HANDLE_FDK_BITSTREAM bs, INT *pPosition,
-                               UCHAR readDirection) {
+UCHAR rvlcReadBitFromBitstream(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
+                               INT *pPosition, UCHAR readDirection) {
   UINT bit;
-  INT readBitOffset = *pPosition - FDKgetBitCnt(bs);
+  INT readBitOffset = (INT)FDKgetValidBits(bs) - bsAnchor + *pPosition;
 
   if (readBitOffset) {
     FDKpushBiDirectional(bs, readBitOffset);
diff --git a/libAACdec/src/rvlcbit.h b/libAACdec/src/rvlcbit.h
index 5c6a3f1..2578453 100644
--- a/libAACdec/src/rvlcbit.h
+++ b/libAACdec/src/rvlcbit.h
@@ -105,7 +105,7 @@
 
 #include "rvlc.h"
 
-UCHAR rvlcReadBitFromBitstream(HANDLE_FDK_BITSTREAM bs, INT *pPosition,
-                               UCHAR readDirection);
+UCHAR rvlcReadBitFromBitstream(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor,
+                               INT *pPosition, UCHAR readDirection);
 
 #endif /* RVLCBIT_H */
diff --git a/libFDK/include/FDK_bitbuffer.h b/libFDK/include/FDK_bitbuffer.h
index ed0b2f6..19a24b3 100644
--- a/libFDK/include/FDK_bitbuffer.h
+++ b/libFDK/include/FDK_bitbuffer.h
@@ -113,7 +113,6 @@
   UINT ValidBits;
   UINT ReadOffset;
   UINT WriteOffset;
-  UINT BitCnt;
   UINT BitNdx;
 
   UCHAR *Buffer;
@@ -159,15 +158,10 @@
 void FDK_pushForward(HANDLE_FDK_BITBUF hBitBuffer, const UINT numberOfBits,
                      UCHAR config);
 
-void FDK_byteAlign(HANDLE_FDK_BITBUF hBitBuffer, UCHAR config);
-
 UINT FDK_getValidBits(HANDLE_FDK_BITBUF hBitBuffer);
 
 INT FDK_getFreeBits(HANDLE_FDK_BITBUF hBitBuffer);
 
-void FDK_setBitCnt(HANDLE_FDK_BITBUF hBitBuffer, const UINT value);
-INT FDK_getBitCnt(HANDLE_FDK_BITBUF hBitBuffer);
-
 void FDK_Feed(HANDLE_FDK_BITBUF hBitBuffer, const UCHAR inputBuffer[],
               const UINT bufferSize, UINT *bytesValid);
 
diff --git a/libFDK/include/FDK_bitstream.h b/libFDK/include/FDK_bitstream.h
index 49eeeaf..f799026 100644
--- a/libFDK/include/FDK_bitstream.h
+++ b/libFDK/include/FDK_bitstream.h
@@ -481,21 +481,6 @@
 }
 
 /**
- * \brief Byte Alignment Function.
- *        This function performs the byte_alignment() syntactic function on the
- * input stream, i.e. some bits will be discarded/padded so that the next bits
- * to be read/written will be aligned on a byte boundary with respect to
- * the bit position 0.
- *
- * \param  hBitStream HANDLE_FDK_BITSTREAM handle
- * \return void
- */
-FDK_INLINE void FDKbyteAlign(HANDLE_FDK_BITSTREAM hBitStream) {
-  FDKsyncCache(hBitStream);
-  FDK_byteAlign(&hBitStream->hBitBuf, (UCHAR)hBitStream->ConfigCache);
-}
-
-/**
  * \brief Byte Alignment Function with anchor
  *        This function performs the byte_alignment() syntactic function on the
  * input stream, i.e. some bits will be discarded so that the next bits to be
@@ -604,37 +589,6 @@
 }
 
 /**
- * \brief reset bitcounter in bitBuffer to zero.
- * \param hBitStream HANDLE_FDK_BITSTREAM handle
- * \return void
- */
-FDK_INLINE void FDKresetBitCnt(HANDLE_FDK_BITSTREAM hBitStream) {
-  FDKsyncCache(hBitStream);
-  FDK_setBitCnt(&hBitStream->hBitBuf, 0);
-}
-
-/**
- * \brief set bitcoutner in bitBuffer to given value.
- * \param hBitStream HANDLE_FDK_BITSTREAM handle
- * \param value new value to be assigned to the bit counter
- * \return void
- */
-FDK_INLINE void FDKsetBitCnt(HANDLE_FDK_BITSTREAM hBitStream, UINT value) {
-  FDKsyncCache(hBitStream);
-  FDK_setBitCnt(&hBitStream->hBitBuf, value);
-}
-
-/**
- * \brief get bitcounter state from bitBuffer.
- * \param hBitStream HANDLE_FDK_BITSTREAM handle
- * \return current bit counter value
- */
-FDK_INLINE INT FDKgetBitCnt(HANDLE_FDK_BITSTREAM hBitStream) {
-  FDKsyncCache(hBitStream);
-  return FDK_getBitCnt(&hBitStream->hBitBuf);
-}
-
-/**
  * \brief Fill the BitBuffer with a number of input bytes from  external source.
  *        The bytesValid variable returns the number of ramaining valid bytes in
  * extern inputBuffer.
diff --git a/libFDK/src/FDK_bitbuffer.cpp b/libFDK/src/FDK_bitbuffer.cpp
index a990c58..98905ea 100644
--- a/libFDK/src/FDK_bitbuffer.cpp
+++ b/libFDK/src/FDK_bitbuffer.cpp
@@ -128,7 +128,6 @@
   hBitBuf->ValidBits = validBits;
   hBitBuf->ReadOffset = 0;
   hBitBuf->WriteOffset = 0;
-  hBitBuf->BitCnt = 0;
   hBitBuf->BitNdx = 0;
 
   hBitBuf->Buffer = pBuffer;
@@ -151,7 +150,6 @@
   hBitBuf->ValidBits = 0;
   hBitBuf->ReadOffset = 0;
   hBitBuf->WriteOffset = 0;
-  hBitBuf->BitCnt = 0;
   hBitBuf->BitNdx = 0;
 }
 
@@ -161,7 +159,6 @@
   UINT bitOffset = hBitBuf->BitNdx & 0x07;
 
   hBitBuf->BitNdx = (hBitBuf->BitNdx + numberOfBits) & (hBitBuf->bufBits - 1);
-  hBitBuf->BitCnt += numberOfBits;
   hBitBuf->ValidBits -= numberOfBits;
 
   UINT byteMask = hBitBuf->bufSize - 1;
@@ -184,7 +181,6 @@
 INT FDK_get32(HANDLE_FDK_BITBUF hBitBuf) {
   UINT BitNdx = hBitBuf->BitNdx + 32;
   hBitBuf->BitNdx = BitNdx & (hBitBuf->bufBits - 1);
-  hBitBuf->BitCnt += 32;
   hBitBuf->ValidBits = (UINT)((INT)hBitBuf->ValidBits - (INT)32);
 
   UINT byteOffset = (BitNdx - 1) >> 3;
@@ -223,7 +219,6 @@
   int i;
 
   hBitBuf->BitNdx = (hBitBuf->BitNdx - numberOfBits) & (hBitBuf->bufBits - 1);
-  hBitBuf->BitCnt -= numberOfBits;
   hBitBuf->ValidBits += numberOfBits;
 
   UINT tx = hBitBuf->Buffer[(byteOffset - 3) & byteMask] << 24 |
@@ -256,7 +251,6 @@
     UINT bitOffset = hBitBuf->BitNdx & 0x7;
 
     hBitBuf->BitNdx = (hBitBuf->BitNdx + numberOfBits) & (hBitBuf->bufBits - 1);
-    hBitBuf->BitCnt += numberOfBits;
     hBitBuf->ValidBits += numberOfBits;
 
     UINT byteMask = hBitBuf->bufSize - 1;
@@ -307,7 +301,6 @@
   int i;
 
   hBitBuf->BitNdx = (hBitBuf->BitNdx - numberOfBits) & (hBitBuf->bufBits - 1);
-  hBitBuf->BitCnt -= numberOfBits;
   hBitBuf->ValidBits -= numberOfBits;
 
   /* in place turn around */
@@ -344,7 +337,6 @@
 #ifndef FUNCTION_FDK_pushBack
 void FDK_pushBack(HANDLE_FDK_BITBUF hBitBuf, const UINT numberOfBits,
                   UCHAR config) {
-  hBitBuf->BitCnt = (UINT)((INT)hBitBuf->BitCnt - (INT)numberOfBits);
   hBitBuf->ValidBits =
       (config == 0) ? (UINT)((INT)hBitBuf->ValidBits + (INT)numberOfBits)
                     : ((UINT)((INT)hBitBuf->ValidBits - (INT)numberOfBits));
@@ -355,7 +347,6 @@
 
 void FDK_pushForward(HANDLE_FDK_BITBUF hBitBuf, const UINT numberOfBits,
                      UCHAR config) {
-  hBitBuf->BitCnt = (UINT)((INT)hBitBuf->BitCnt + (INT)numberOfBits);
   hBitBuf->ValidBits =
       (config == 0) ? ((UINT)((INT)hBitBuf->ValidBits - (INT)numberOfBits))
                     : (UINT)((INT)hBitBuf->ValidBits + (INT)numberOfBits);
@@ -363,19 +354,6 @@
       (UINT)((INT)hBitBuf->BitNdx + (INT)numberOfBits) & (hBitBuf->bufBits - 1);
 }
 
-void FDK_byteAlign(HANDLE_FDK_BITBUF hBitBuf, UCHAR config) {
-  INT alignment = hBitBuf->BitCnt & 0x07;
-
-  if (alignment) {
-    if (config == 0)
-      FDK_pushForward(hBitBuf, 8 - alignment, config); /* BS_READER */
-    else
-      FDK_put(hBitBuf, 0, 8 - alignment); /* BS_WRITER */
-  }
-
-  hBitBuf->BitCnt = 0;
-}
-
 #ifndef FUNCTION_FDK_getValidBits
 UINT FDK_getValidBits(HANDLE_FDK_BITBUF hBitBuf) { return hBitBuf->ValidBits; }
 #endif /* #ifndef FUNCTION_FDK_getValidBits */
@@ -384,12 +362,6 @@
   return (hBitBuf->bufBits - hBitBuf->ValidBits);
 }
 
-void FDK_setBitCnt(HANDLE_FDK_BITBUF hBitBuf, const UINT value) {
-  hBitBuf->BitCnt = value;
-}
-
-INT FDK_getBitCnt(HANDLE_FDK_BITBUF hBitBuf) { return hBitBuf->BitCnt; }
-
 void FDK_Feed(HANDLE_FDK_BITBUF hBitBuf, const UCHAR *RESTRICT inputBuffer,
               const UINT bufferSize, UINT *bytesValid) {
   inputBuffer = &inputBuffer[bufferSize - *bytesValid];
@@ -438,7 +410,6 @@
 
   h_BitBufSrc->BitNdx =
       (h_BitBufSrc->BitNdx + bToRead) & (h_BitBufSrc->bufBits - 1);
-  h_BitBufSrc->BitCnt += bToRead;
   h_BitBufSrc->ValidBits -= bToRead;
 }
 
diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp
index b0f1c6a..8d411e8 100644
--- a/libMpegTPDec/src/tpdec_asc.cpp
+++ b/libMpegTPDec/src/tpdec_asc.cpp
@@ -2102,7 +2102,9 @@
     self->m_aot = getAOT(bs);
     self->m_samplingFrequency =
         getSampleRate(bs, &self->m_samplingFrequencyIndex, 4);
-    if (self->m_samplingFrequency <= 0) {
+    if (self->m_samplingFrequency <= 0 ||
+        (self->m_samplingFrequency > 96000 && self->m_aot != 39) ||
+        self->m_samplingFrequency > 4 * 96000) {
       return TRANSPORTDEC_PARSE_ERROR;
     }
 
diff --git a/libSBRdec/src/lpp_tran.cpp b/libSBRdec/src/lpp_tran.cpp
index aa1fd5d..2ef07eb 100644
--- a/libSBRdec/src/lpp_tran.cpp
+++ b/libSBRdec/src/lpp_tran.cpp
@@ -118,6 +118,10 @@
   \sa lppTransposer(), main_audio.cpp, sbr_scale.h, \ref documentationOverview
 */
 
+#ifdef __ANDROID__
+#include "log/log.h"
+#endif
+
 #include "lpp_tran.h"
 
 #include "sbr_ram.h"
@@ -295,7 +299,6 @@
   int ovLowBandShift;
   int lowBandShift;
   /*  int ovHighBandShift;*/
-  int targetStopBand;
 
   alphai[0] = FL2FXCONST_SGL(0.0f);
   alphai[1] = FL2FXCONST_SGL(0.0f);
@@ -311,25 +314,34 @@
 
   autoCorrLength = pSettings->nCols + pSettings->overlap;
 
-  /* Set upper subbands to zero:
-     This is required in case that the patches do not cover the complete
-     highband (because the last patch would be too short). Possible
-     optimization: Clearing bands up to usb would be sufficient here. */
-  targetStopBand = patchParam[pSettings->noOfPatches - 1].targetStartBand +
-                   patchParam[pSettings->noOfPatches - 1].numBandsInPatch;
+  if (pSettings->noOfPatches > 0) {
+    /* Set upper subbands to zero:
+       This is required in case that the patches do not cover the complete
+       highband (because the last patch would be too short). Possible
+       optimization: Clearing bands up to usb would be sufficient here. */
+    int targetStopBand =
+        patchParam[pSettings->noOfPatches - 1].targetStartBand +
+        patchParam[pSettings->noOfPatches - 1].numBandsInPatch;
 
-  int memSize = ((64) - targetStopBand) * sizeof(FIXP_DBL);
+    int memSize = ((64) - targetStopBand) * sizeof(FIXP_DBL);
 
-  if (!useLP) {
-    for (i = startSample; i < stopSampleClear; i++) {
-      FDKmemclear(&qmfBufferReal[i][targetStopBand], memSize);
-      FDKmemclear(&qmfBufferImag[i][targetStopBand], memSize);
-    }
-  } else {
-    for (i = startSample; i < stopSampleClear; i++) {
-      FDKmemclear(&qmfBufferReal[i][targetStopBand], memSize);
+    if (!useLP) {
+      for (i = startSample; i < stopSampleClear; i++) {
+        FDKmemclear(&qmfBufferReal[i][targetStopBand], memSize);
+        FDKmemclear(&qmfBufferImag[i][targetStopBand], memSize);
+      }
+    } else {
+      for (i = startSample; i < stopSampleClear; i++) {
+        FDKmemclear(&qmfBufferReal[i][targetStopBand], memSize);
+      }
     }
   }
+#ifdef __ANDROID__
+  else {
+    // Safetynet logging
+    android_errorWriteLog(0x534e4554, "112160868");
+  }
+#endif
 
   /* init bwIndex for each patch */
   FDKmemclear(bwIndex, sizeof(bwIndex));
@@ -874,7 +886,6 @@
   int ovLowBandShift;
   int lowBandShift;
   /*  int ovHighBandShift;*/
-  int targetStopBand;
 
   alphai[0] = FL2FXCONST_SGL(0.0f);
   alphai[1] = FL2FXCONST_SGL(0.0f);
@@ -889,19 +900,28 @@
 
   autoCorrLength = pSettings->nCols + pSettings->overlap;
 
-  /* Set upper subbands to zero:
-     This is required in case that the patches do not cover the complete
-     highband (because the last patch would be too short). Possible
-     optimization: Clearing bands up to usb would be sufficient here. */
-  targetStopBand = patchParam[pSettings->noOfPatches - 1].targetStartBand +
-                   patchParam[pSettings->noOfPatches - 1].numBandsInPatch;
+  if (pSettings->noOfPatches > 0) {
+    /* Set upper subbands to zero:
+       This is required in case that the patches do not cover the complete
+       highband (because the last patch would be too short). Possible
+       optimization: Clearing bands up to usb would be sufficient here. */
+    int targetStopBand =
+        patchParam[pSettings->noOfPatches - 1].targetStartBand +
+        patchParam[pSettings->noOfPatches - 1].numBandsInPatch;
 
-  int memSize = ((64) - targetStopBand) * sizeof(FIXP_DBL);
+    int memSize = ((64) - targetStopBand) * sizeof(FIXP_DBL);
 
-  for (i = startSample; i < stopSampleClear; i++) {
-    FDKmemclear(&qmfBufferReal[i][targetStopBand], memSize);
-    FDKmemclear(&qmfBufferImag[i][targetStopBand], memSize);
+    for (i = startSample; i < stopSampleClear; i++) {
+      FDKmemclear(&qmfBufferReal[i][targetStopBand], memSize);
+      FDKmemclear(&qmfBufferImag[i][targetStopBand], memSize);
+    }
   }
+#ifdef __ANDROID__
+  else {
+    // Safetynet logging
+    android_errorWriteLog(0x534e4554, "112160868");
+  }
+#endif
 
   /*
   Calc common low band scale factor