diff --git a/Android.bp b/Android.bp
index db39f62..732d386 100644
--- a/Android.bp
+++ b/Android.bp
@@ -234,11 +234,11 @@ cc_library_static {
     },
 
     sanitize: {
-    	cfi: true,
-        diag: {
-            cfi: true,
-        },
-        blacklist: "cfi_blacklist.txt",
+        integer_overflow: true,
+        misc_undefined: ["bounds"],
+        // Enable CFI if this becomes a shared library.
+        // cfi: true,
+        blacklist: "libavc_blacklist.txt",
     },
 }
 
@@ -503,11 +503,11 @@ cc_library_static {
     },
 
     sanitize: {
-    	cfi: true,
-        diag: {
-            cfi: true,
-        },
-        blacklist: "cfi_blacklist.txt",
+        integer_overflow: true,
+        misc_undefined: ["bounds"],
+        // Enable CFI if this becomes a shared library.
+        // cfi: true,
+        blacklist: "libavc_blacklist.txt",
     },
 }
 
diff --git a/cfi_blacklist.txt b/cfi_blacklist.txt
deleted file mode 100644
index 1571e0e..0000000
--- a/cfi_blacklist.txt
+++ /dev/null
@@ -1 +0,0 @@
-src:*external/libavc/*
diff --git a/common/arm/ih264_platform_macros.h b/common/arm/ih264_platform_macros.h
index 438e240..a4d7f3a 100644
--- a/common/arm/ih264_platform_macros.h
+++ b/common/arm/ih264_platform_macros.h
@@ -36,6 +36,8 @@
 #ifndef _IH264_PLATFORM_MACROS_H_
 #define _IH264_PLATFORM_MACROS_H_
 
+#include <stdint.h>
+
 #ifndef  ARMV8
 
 static __inline WORD32 CLIP_U8(WORD32 x)
@@ -62,6 +64,18 @@ static __inline WORD32 CLIP_S10(WORD32 x)
     return x;
 }
 
+static __inline WORD32 CLIP_U11(WORD32 x)
+{
+    asm("usat %0, #11, %1" : "=r"(x) : "r"(x));
+    return x;
+}
+
+static __inline WORD32 CLIP_S11(WORD32 x)
+{
+    asm("ssat %0, #11, %1" : "=r"(x) : "r"(x));
+    return x;
+}
+
 static __inline WORD32 CLIP_U12(WORD32 x)
 {
     asm("usat %0, #12, %1" : "=r"(x) : "r"(x));
@@ -95,17 +109,20 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 
 #else
 
-#define CLIP_U8(x) CLIP3(0, 255, (x))
-#define CLIP_S8(x) CLIP3(-128, 127, (x))
+#define CLIP_U8(x) CLIP3(0, UINT8_MAX, (x))
+#define CLIP_S8(x) CLIP3(INT8_MIN, INT8_MAX, (x))
 
 #define CLIP_U10(x) CLIP3(0, 1023, (x))
 #define CLIP_S10(x) CLIP3(-512, 511, (x))
 
+#define CLIP_U11(x) CLIP3(0, 2047, (x))
+#define CLIP_S11(x) CLIP3(-1024, 1023, (x))
+
 #define CLIP_U12(x) CLIP3(0, 4095, (x))
 #define CLIP_S12(x) CLIP3(-2048, 2047, (x))
 
-#define CLIP_U16(x) CLIP3(0, 65535, (x))
-#define CLIP_S16(x) CLIP3(-32768, 32767, (x))
+#define CLIP_U16(x) CLIP3(0, UINT16_MAX, (x))
+#define CLIP_S16(x) CLIP3(INT16_MIN, INT16_MAX, (x))
 
 #define ITT_BIG_ENDIAN(x)       __asm__("rev %0, %1" : "=r"(x) : "r"(x));
 
@@ -118,6 +135,11 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 
 #endif
 
+/*saturating instructions are not available for WORD64 in ARMv7, hence we cannot
+ * use inline assembly like other clips*/
+#define CLIP_U32(x) CLIP3(0, UINT32_MAX, (x))
+#define CLIP_S32(x) CLIP3(INT32_MIN, INT32_MAX, (x))
+
 #define DATA_SYNC() __sync_synchronize()
 
 #define SHL(x,y) (((y) < 32) ? ((x) << (y)) : 0)
@@ -128,12 +150,17 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 
 #define INLINE inline
 
+/* In normal cases, 0 will not be passed as an argument to CLZ and CTZ.
+As CLZ and CTZ outputs are used as a shift value in few places, these return
+31 for u4_word == 0 case, just to handle error cases gracefully without any
+undefined behaviour */
+
 static INLINE UWORD32 CLZ(UWORD32 u4_word)
 {
     if(u4_word)
         return (__builtin_clz(u4_word));
     else
-        return 32;
+        return 31;
 }
 static INLINE UWORD32 CTZ(UWORD32 u4_word)
 {
diff --git a/common/armv8/ih264_platform_macros.h b/common/armv8/ih264_platform_macros.h
index 438e240..a4d7f3a 100644
--- a/common/armv8/ih264_platform_macros.h
+++ b/common/armv8/ih264_platform_macros.h
@@ -36,6 +36,8 @@
 #ifndef _IH264_PLATFORM_MACROS_H_
 #define _IH264_PLATFORM_MACROS_H_
 
+#include <stdint.h>
+
 #ifndef  ARMV8
 
 static __inline WORD32 CLIP_U8(WORD32 x)
@@ -62,6 +64,18 @@ static __inline WORD32 CLIP_S10(WORD32 x)
     return x;
 }
 
+static __inline WORD32 CLIP_U11(WORD32 x)
+{
+    asm("usat %0, #11, %1" : "=r"(x) : "r"(x));
+    return x;
+}
+
+static __inline WORD32 CLIP_S11(WORD32 x)
+{
+    asm("ssat %0, #11, %1" : "=r"(x) : "r"(x));
+    return x;
+}
+
 static __inline WORD32 CLIP_U12(WORD32 x)
 {
     asm("usat %0, #12, %1" : "=r"(x) : "r"(x));
@@ -95,17 +109,20 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 
 #else
 
-#define CLIP_U8(x) CLIP3(0, 255, (x))
-#define CLIP_S8(x) CLIP3(-128, 127, (x))
+#define CLIP_U8(x) CLIP3(0, UINT8_MAX, (x))
+#define CLIP_S8(x) CLIP3(INT8_MIN, INT8_MAX, (x))
 
 #define CLIP_U10(x) CLIP3(0, 1023, (x))
 #define CLIP_S10(x) CLIP3(-512, 511, (x))
 
+#define CLIP_U11(x) CLIP3(0, 2047, (x))
+#define CLIP_S11(x) CLIP3(-1024, 1023, (x))
+
 #define CLIP_U12(x) CLIP3(0, 4095, (x))
 #define CLIP_S12(x) CLIP3(-2048, 2047, (x))
 
-#define CLIP_U16(x) CLIP3(0, 65535, (x))
-#define CLIP_S16(x) CLIP3(-32768, 32767, (x))
+#define CLIP_U16(x) CLIP3(0, UINT16_MAX, (x))
+#define CLIP_S16(x) CLIP3(INT16_MIN, INT16_MAX, (x))
 
 #define ITT_BIG_ENDIAN(x)       __asm__("rev %0, %1" : "=r"(x) : "r"(x));
 
@@ -118,6 +135,11 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 
 #endif
 
+/*saturating instructions are not available for WORD64 in ARMv7, hence we cannot
+ * use inline assembly like other clips*/
+#define CLIP_U32(x) CLIP3(0, UINT32_MAX, (x))
+#define CLIP_S32(x) CLIP3(INT32_MIN, INT32_MAX, (x))
+
 #define DATA_SYNC() __sync_synchronize()
 
 #define SHL(x,y) (((y) < 32) ? ((x) << (y)) : 0)
@@ -128,12 +150,17 @@ static __inline UWORD32 ITT_BIG_ENDIAN(UWORD32 x)
 
 #define INLINE inline
 
+/* In normal cases, 0 will not be passed as an argument to CLZ and CTZ.
+As CLZ and CTZ outputs are used as a shift value in few places, these return
+31 for u4_word == 0 case, just to handle error cases gracefully without any
+undefined behaviour */
+
 static INLINE UWORD32 CLZ(UWORD32 u4_word)
 {
     if(u4_word)
         return (__builtin_clz(u4_word));
     else
-        return 32;
+        return 31;
 }
 static INLINE UWORD32 CTZ(UWORD32 u4_word)
 {
diff --git a/common/ih264_typedefs.h b/common/ih264_typedefs.h
index 8e4685a..29138c6 100644
--- a/common/ih264_typedefs.h
+++ b/common/ih264_typedefs.h
@@ -37,23 +37,23 @@
 #ifndef _IH264_TYPEDEFS_H_
 #define _IH264_TYPEDEFS_H_
 
-
+#include <stdint.h>
 /*****************************************************************************/
 /* Unsigned data types                                                       */
 /*****************************************************************************/
-typedef unsigned char   UWORD8;
-typedef unsigned short  UWORD16;
-typedef unsigned int    UWORD32;
-typedef unsigned long long   UWORD64;
+typedef uint8_t   UWORD8;
+typedef uint16_t  UWORD16;
+typedef uint32_t  UWORD32;
+typedef uint64_t  UWORD64;
 
 
 /*****************************************************************************/
 /* Signed data types                                                         */
 /*****************************************************************************/
-typedef signed char     WORD8;
-typedef short           WORD16;
-typedef int             WORD32;
-
+typedef int8_t     WORD8;
+typedef int16_t    WORD16;
+typedef int32_t    WORD32;
+typedef int64_t    WORD64;
 
 /*****************************************************************************/
 /* Miscellaneous data types                                                  */
diff --git a/common/mips/ih264_platform_macros.h b/common/mips/ih264_platform_macros.h
index d098372..fa0ba61 100644
--- a/common/mips/ih264_platform_macros.h
+++ b/common/mips/ih264_platform_macros.h
@@ -38,17 +38,25 @@
 #ifndef _IH264_PLATFORM_MACROS_H_
 #define _IH264_PLATFORM_MACROS_H_
 
-#define CLIP_U8(x) CLIP3(0, 255, (x))
-#define CLIP_S8(x) CLIP3(-128, 127, (x))
+#include <stdint.h>
+
+#define CLIP_U8(x) CLIP3(0, UINT8_MAX, (x))
+#define CLIP_S8(x) CLIP3(INT8_MIN, INT8_MAX, (x))
 
 #define CLIP_U10(x) CLIP3(0, 1023, (x))
 #define CLIP_S10(x) CLIP3(-512, 511, (x))
 
+#define CLIP_U11(x) CLIP3(0, 2047, (x))
+#define CLIP_S11(x) CLIP3(-1024, 1023, (x))
+
 #define CLIP_U12(x) CLIP3(0, 4095, (x))
 #define CLIP_S12(x) CLIP3(-2048, 2047, (x))
 
-#define CLIP_U16(x) CLIP3(0, 65535, (x))
-#define CLIP_S16(x) CLIP3(-32768, 32767, (x))
+#define CLIP_U16(x) CLIP3(0, UINT16_MAX, (x))
+#define CLIP_S16(x) CLIP3(INT16_MIN, INT16_MAX, (x))
+
+#define CLIP_U32(x) CLIP3(0, UINT32_MAX, (x))
+#define CLIP_S32(x) CLIP3(INT32_MIN, INT32_MAX, (x))
 
 #define MEM_ALIGN16 __attribute__ ((aligned (16)))
 
@@ -69,12 +77,17 @@
 
 #define PLD(a)
 
+/* In normal cases, 0 will not be passed as an argument to CLZ and CTZ.
+As CLZ and CTZ outputs are used as a shift value in few places, these return
+31 for u4_word == 0 case, just to handle error cases gracefully without any
+undefined behaviour */
+
 static __inline UWORD32 CLZ(UWORD32 u4_word)
 {
     if(u4_word)
     return(__builtin_clz(u4_word));
     else
-        return 32;
+        return 31;
 }
 
 static __inline UWORD32 CTZ(UWORD32 u4_word)
diff --git a/common/x86/ih264_ihadamard_scaling_sse42.c b/common/x86/ih264_ihadamard_scaling_sse42.c
index d68d105..4065e35 100644
--- a/common/x86/ih264_ihadamard_scaling_sse42.c
+++ b/common/x86/ih264_ihadamard_scaling_sse42.c
@@ -96,7 +96,7 @@ void ih264_ihadamard_scaling_4x4_sse42(WORD16* pi2_src,
     __m128i src_r0_r1, src_r2_r3;
     __m128i src_r0, src_r1, src_r2, src_r3;
     __m128i temp0, temp1, temp2, temp3;
-    __m128i add_rshift = _mm_set1_epi32((1 << (5 - u4_qp_div_6)));
+    __m128i add_rshift = _mm_set1_epi32((u4_qp_div_6 < 6) ? (1 << (5 - u4_qp_div_6)) : 0);
     __m128i mult_val = _mm_set1_epi32(pu2_iscal_mat[0] * pu2_weigh_mat[0]);
     UNUSED (pi4_tmp);
 
diff --git a/common/x86/ih264_ihadamard_scaling_ssse3.c b/common/x86/ih264_ihadamard_scaling_ssse3.c
index 1b940ea..b4d483f 100644
--- a/common/x86/ih264_ihadamard_scaling_ssse3.c
+++ b/common/x86/ih264_ihadamard_scaling_ssse3.c
@@ -96,7 +96,7 @@ void ih264_ihadamard_scaling_4x4_ssse3(WORD16* pi2_src,
     __m128i src_r0_r1, src_r2_r3, sign_reg, zero_8x16b = _mm_setzero_si128();
     __m128i src_r0, src_r1, src_r2, src_r3;
     __m128i temp0, temp1, temp2, temp3;
-    __m128i add_rshift = _mm_set1_epi32((1 << (5 - u4_qp_div_6)));
+    __m128i add_rshift = _mm_set1_epi32((u4_qp_div_6 < 6) ? (1 << (5 - u4_qp_div_6)) : 0);
     __m128i mult_val = _mm_set1_epi32(pu2_iscal_mat[0] * pu2_weigh_mat[0]);
 
     __m128i mask = _mm_set1_epi32(val);
diff --git a/common/x86/ih264_iquant_itrans_recon_sse42.c b/common/x86/ih264_iquant_itrans_recon_sse42.c
index f27111f..a7b9e82 100644
--- a/common/x86/ih264_iquant_itrans_recon_sse42.c
+++ b/common/x86/ih264_iquant_itrans_recon_sse42.c
@@ -118,7 +118,7 @@ void ih264_iquant_itrans_recon_4x4_sse42(WORD16 *pi2_src,
     __m128i zero_8x16b = _mm_setzero_si128();          // all bits reset to zero
     __m128i temp0, temp1, temp2, temp3, temp4, temp5, temp6, temp7;
     __m128i resq_r0, resq_r1, resq_r2, resq_r3;
-    __m128i add_rshift = _mm_set1_epi32((1 << (3 - u4_qp_div_6)));
+    __m128i add_rshift = _mm_set1_epi32((u4_qp_div_6 < 4) ? (1 << (3 - u4_qp_div_6)) : 0);
     __m128i value_32 = _mm_set1_epi32(32);
     UNUSED (pi2_tmp);
 
@@ -367,7 +367,7 @@ void ih264_iquant_itrans_recon_chroma_4x4_sse42(WORD16 *pi2_src,
     __m128i zero_8x16b = _mm_setzero_si128();          // all bits reset to zero
     __m128i temp0, temp1, temp2, temp3, temp4, temp5, temp6, temp7;
     __m128i resq_r0, resq_r1, resq_r2, resq_r3;
-    __m128i add_rshift = _mm_set1_epi32((1 << (3 - u4_qp_div_6)));
+    __m128i add_rshift = _mm_set1_epi32((u4_qp_div_6 < 4) ? (1 << (3 - u4_qp_div_6)) : 0);
     __m128i value_32 = _mm_set1_epi32(32);
     __m128i chroma_mask = _mm_set1_epi16 (0xFF);
     __m128i out_r0, out_r1, out_r2, out_r3;
diff --git a/common/x86/ih264_iquant_itrans_recon_ssse3.c b/common/x86/ih264_iquant_itrans_recon_ssse3.c
index 30f7e59..506be49 100644
--- a/common/x86/ih264_iquant_itrans_recon_ssse3.c
+++ b/common/x86/ih264_iquant_itrans_recon_ssse3.c
@@ -118,7 +118,7 @@ void ih264_iquant_itrans_recon_4x4_ssse3(WORD16 *pi2_src,
     __m128i zero_8x16b = _mm_setzero_si128();          // all bits reset to zero
     __m128i temp0, temp1, temp2, temp3, temp4, temp5, temp6, temp7;
     __m128i resq_r0, resq_r1, resq_r2, resq_r3;
-    __m128i add_rshift = _mm_set1_epi32((1 << (3 - u4_qp_div_6)));
+    __m128i add_rshift = _mm_set1_epi32((u4_qp_div_6 < 4) ? (1 << (3 - u4_qp_div_6)) : 0);
     __m128i value_32 = _mm_set1_epi32(32);
     UNUSED (pi2_tmp);
     UNUSED (pi2_dc_ld_addr);
@@ -384,7 +384,7 @@ void ih264_iquant_itrans_recon_8x8_ssse3(WORD16 *pi2_src,
     // __m128i one_8x16b = _mm_set1_epi8(255); // all bits set to 1
     // __m128i one_zero_mask = _mm_unpacklo_epi16(one_8x16b, zero_8x16b); // 1 0 1 0 1 0 1 0 --- 16 bits size
     __m128i value_32 = _mm_set1_epi32(32);
-    __m128i add_rshift = _mm_set1_epi32((1 << (5 - qp_div)));
+    __m128i add_rshift = _mm_set1_epi32((qp_div < 6) ? (1 << (5 - qp_div)) : 0);
     __m128i dequant_r0;
     __m128i predload_r;
     __m128i pred_r0_1, pred_r1_1, pred_r2_1, pred_r3_1, pred_r4_1, pred_r5_1,
diff --git a/common/x86/ih264_platform_macros.h b/common/x86/ih264_platform_macros.h
index 340c5d8..54af325 100644
--- a/common/x86/ih264_platform_macros.h
+++ b/common/x86/ih264_platform_macros.h
@@ -38,20 +38,26 @@
 #ifndef _IH264_PLATFORM_MACROS_H_
 #define _IH264_PLATFORM_MACROS_H_
 
+#include <stdint.h>
 #include <immintrin.h>
 
-
-#define CLIP_U8(x) CLIP3(0, 255, (x))
-#define CLIP_S8(x) CLIP3(-128, 127, (x))
+#define CLIP_U8(x) CLIP3(0, UINT8_MAX, (x))
+#define CLIP_S8(x) CLIP3(INT8_MIN, INT8_MAX, (x))
 
 #define CLIP_U10(x) CLIP3(0, 1023, (x))
 #define CLIP_S10(x) CLIP3(-512, 511, (x))
 
+#define CLIP_U11(x) CLIP3(0, 2047, (x))
+#define CLIP_S11(x) CLIP3(-1024, 1023, (x))
+
 #define CLIP_U12(x) CLIP3(0, 4095, (x))
 #define CLIP_S12(x) CLIP3(-2048, 2047, (x))
 
-#define CLIP_U16(x) CLIP3(0, 65535, (x))
-#define CLIP_S16(x) CLIP3(-32768, 32767, (x))
+#define CLIP_U16(x) CLIP3(0, UINT16_MAX, (x))
+#define CLIP_S16(x) CLIP3(INT16_MIN, INT16_MAX, (x))
+
+#define CLIP_U32(x) CLIP3(0, UINT32_MAX, (x))
+#define CLIP_S32(x) CLIP3(INT32_MIN, INT32_MAX, (x))
 
 #define MEM_ALIGN16 __attribute__ ((aligned (16)))
 
@@ -68,12 +74,17 @@
 
 #define PLD(a)
 
+/* In normal cases, 0 will not be passed as an argument to CLZ and CTZ.
+As CLZ and CTZ outputs are used as a shift value in few places, these return
+31 for u4_word == 0 case, just to handle error cases gracefully without any
+undefined behaviour */
+
 static __inline UWORD32 CLZ(UWORD32 u4_word)
 {
     if(u4_word)
     return(__builtin_clz(u4_word));
     else
-        return 32;
+        return 31;
 }
 
 static __inline UWORD32 CTZ(UWORD32 u4_word)
diff --git a/decoder/ih264d.h b/decoder/ih264d.h
index 7c76296..83f8a1f 100644
--- a/decoder/ih264d.h
+++ b/decoder/ih264d.h
@@ -50,6 +50,7 @@ extern "C" {
 /*****************************************************************************/
 /* Constant Macros                                                           */
 /*****************************************************************************/
+#define IVD_ERROR_MASK 0xFF
 
 /*****************************************************************************/
 /* Function Macros                                                           */
diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index c6999a6..c9426a6 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -975,9 +975,6 @@ void ih264d_init_decoder(void * ps_dec_params)
     ps_dec->i4_degrade_type = 0;
     ps_dec->i4_degrade_pics = 0;
 
-    ps_dec->i4_app_skip_mode = IVD_SKIP_NONE;
-    ps_dec->i4_dec_skip_mode = IVD_SKIP_NONE;
-
     memset(ps_dec->ps_pps, 0,
            ((sizeof(dec_pic_params_t)) * MAX_NUM_PIC_PARAMS));
     memset(ps_dec->ps_sps, 0,
@@ -1008,7 +1005,7 @@ void ih264d_init_decoder(void * ps_dec_params)
     ps_dec->u4_total_frames_decoded = 0;
 
     ps_dec->i4_error_code = 0;
-    ps_dec->i4_content_type = -1;
+    ps_dec->i4_content_type = IV_CONTENTTYPE_NA;
     ps_dec->ps_cur_slice->u1_mbaff_frame_flag = 0;
 
     ps_dec->ps_dec_err_status->u1_err_flag = ACCEPT_ALL_PICS; //REJECT_PB_PICS;
@@ -1058,9 +1055,9 @@ void ih264d_init_decoder(void * ps_dec_params)
 
     /* The Initial Frame Rate Info is not Present */
     ps_dec->i4_vui_frame_rate = -1;
-    ps_dec->i4_pic_type = -1;
-    ps_dec->i4_frametype = -1;
-    ps_dec->i4_content_type = -1;
+    ps_dec->i4_pic_type = NA_SLICE;
+    ps_dec->i4_frametype = IV_NA_FRAME;
+    ps_dec->i4_content_type = IV_CONTENTTYPE_NA;
 
     ps_dec->u1_res_changed = 0;
 
@@ -1235,6 +1232,7 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv
     ps_create_op->s_ivd_create_op_t.pv_handle = NULL;
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, sizeof(iv_obj_t));
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, sizeof(iv_obj_t));
     *dec_hdl = (iv_obj_t *)pv_buf;
     ps_create_op->s_ivd_create_op_t.pv_handle = *dec_hdl;
 
@@ -1272,82 +1270,98 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv
     size = ((sizeof(dec_seq_params_t)) * MAX_NUM_SEQ_PARAMS);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_sps = pv_buf;
 
     size = (sizeof(dec_pic_params_t)) * MAX_NUM_PIC_PARAMS;
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_pps = pv_buf;
 
     size = ithread_get_handle_size();
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pv_dec_thread_handle = pv_buf;
 
     size = ithread_get_handle_size();
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pv_bs_deblk_thread_handle = pv_buf;
 
     size = sizeof(dpb_manager_t);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_dpb_mgr = pv_buf;
 
     size = sizeof(pred_info_t) * 2 * 32;
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_pred = pv_buf;
 
     size = sizeof(disp_mgr_t);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pv_disp_buf_mgr = pv_buf;
 
     size = sizeof(buf_mgr_t) + ithread_get_mutex_lock_size();
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pv_pic_buf_mgr = pv_buf;
 
     size = sizeof(struct pic_buffer_t) * (H264_MAX_REF_PICS * 2);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_pic_buf_base = pv_buf;
 
     size = sizeof(dec_err_status_t);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_dec_err_status = (dec_err_status_t *)pv_buf;
 
     size = sizeof(sei);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_sei = (sei *)pv_buf;
 
     size = sizeof(dpb_commands_t);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_dpb_cmds = (dpb_commands_t *)pv_buf;
 
     size = sizeof(dec_bit_stream_t);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_bitstrm = (dec_bit_stream_t *)pv_buf;
 
     size = sizeof(dec_slice_params_t);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_cur_slice = (dec_slice_params_t *)pv_buf;
 
     size = MAX(sizeof(dec_seq_params_t), sizeof(dec_pic_params_t));
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pv_scratch_sps_pps = pv_buf;
 
 
     ps_dec->u4_static_bits_buf_size = 256000;
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, ps_dec->u4_static_bits_buf_size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, ps_dec->u4_static_bits_buf_size);
     ps_dec->pu1_bits_buf_static = pv_buf;
 
 
@@ -1364,6 +1378,7 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv
     size = (sizeof(bin_ctxt_model_t) * NUM_CABAC_CTXTS);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->p_cabac_ctxt_table_t = pv_buf;
 
 
@@ -1371,6 +1386,7 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv
     size = sizeof(ctxt_inc_mb_info_t);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_left_mb_ctxt_info = pv_buf;
 
 
@@ -1378,6 +1394,7 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv
     size = MAX_REF_BUF_SIZE * 2;
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pu1_ref_buff_base = pv_buf;
     ps_dec->pu1_ref_buff = ps_dec->pu1_ref_buff_base + MAX_REF_BUF_SIZE;
 
@@ -1386,12 +1403,14 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv
                         * PRED_BUFFER_HEIGHT * 2);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pi2_pred1 = pv_buf;
 
 
     size = sizeof(UWORD8) * (MB_LUM_SIZE);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pu1_temp_mc_buffer = pv_buf;
 
 
@@ -1400,6 +1419,7 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv
     size = 8 * MAX_REF_BUFS * sizeof(struct pic_buffer_t);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
 
     ps_dec->pu1_init_dpb_base = pv_buf;
     pu1_buf = pv_buf;
@@ -1412,24 +1432,28 @@ WORD32 ih264d_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv
                         * ((MAX_FRAMES << 1) * (MAX_FRAMES << 1)) * 2);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pu4_mbaff_wt_mat = pv_buf;
 
     size = sizeof(UWORD32) * 2 * 3
                         * ((MAX_FRAMES << 1) * (MAX_FRAMES << 1));
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pu4_wts_ofsts_mat = pv_buf;
 
 
     size = (sizeof(neighbouradd_t) << 2);
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_left_mvpred_addr = pv_buf;
 
 
     size = sizeof(buf_mgr_t) + ithread_get_mutex_lock_size();
     pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pv_mv_buf_mgr = pv_buf;
 
 
@@ -1522,7 +1546,7 @@ WORD32 ih264d_create(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
             }
         }
         ps_create_op->s_ivd_create_op_t.u4_error_code = IVD_MEM_ALLOC_FAILED;
-        ps_create_op->s_ivd_create_op_t.u4_error_code = 1 << IVD_FATALERROR;
+        ps_create_op->s_ivd_create_op_t.u4_error_code |= 1 << IVD_FATALERROR;
 
         return IV_FAIL;
     }
@@ -1564,6 +1588,8 @@ UWORD32 ih264d_map_error(UWORD32 i4_err_status)
         case ERROR_PROFILE_NOT_SUPPORTED:
         case ERROR_INIT_NOT_DONE:
         case IVD_MEM_ALLOC_FAILED:
+        case ERROR_FEATURE_UNAVAIL:
+        case IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED:
             temp = 1 << IVD_FATALERROR;
             H264_DEC_DEBUG_PRINT("\nFatal Error\n");
             break;
@@ -1598,7 +1624,6 @@ UWORD32 ih264d_map_error(UWORD32 i4_err_status)
             break;
 
         case ERROR_NOT_SUPP_RESOLUTION:
-        case ERROR_FEATURE_UNAVAIL:
         case ERROR_ACTUAL_LEVEL_GREATER_THAN_INIT:
             temp = 1 << IVD_UNSUPPORTEDINPUT;
             break;
@@ -1878,12 +1903,12 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
     ps_dec->u4_ts = ps_dec_ip->u4_ts;
 
     ps_dec_op->u4_error_code = 0;
-    ps_dec_op->e_pic_type = -1;
+    ps_dec_op->e_pic_type = IV_NA_FRAME;
     ps_dec_op->u4_output_present = 0;
     ps_dec_op->u4_frame_decoded_flag = 0;
 
-    ps_dec->i4_frametype = -1;
-    ps_dec->i4_content_type = -1;
+    ps_dec->i4_frametype = IV_NA_FRAME;
+    ps_dec->i4_content_type = IV_CONTENTTYPE_NA;
 
     ps_dec->u4_slice_start_code_found = 0;
 
@@ -2046,8 +2071,6 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
         ih264d_init_decoder(ps_dec);
     }
 
-    ps_dec->u4_prev_nal_skipped = 0;
-
     ps_dec->u2_cur_mb_addr = 0;
     ps_dec->u2_total_mbs_coded = 0;
     ps_dec->u2_cur_slice_num = 0;
@@ -2092,6 +2115,7 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
             pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128,
                                               size + EXTRA_BS_OFFSET);
             RETURN_IF((NULL == pv_buf), IV_FAIL);
+            memset(pv_buf, 0, size + EXTRA_BS_OFFSET);
             ps_dec->pu1_bits_buf_dynamic = pv_buf;
             ps_dec->u4_dynamic_bits_buf_size = size;
         }
@@ -2123,51 +2147,6 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
         bytes_consumed = buflen + u4_length_of_start_code;
         ps_dec_op->u4_num_bytes_consumed += bytes_consumed;
 
-        {
-            UWORD8 u1_firstbyte, u1_nal_ref_idc;
-
-            if(ps_dec->i4_app_skip_mode == IVD_SKIP_B)
-            {
-                u1_firstbyte = *(pu1_buf + u4_length_of_start_code);
-                u1_nal_ref_idc = (UWORD8)(NAL_REF_IDC(u1_firstbyte));
-                if(u1_nal_ref_idc == 0)
-                {
-                    /*skip non reference frames*/
-                    cur_slice_is_nonref = 1;
-                    continue;
-                }
-                else
-                {
-                    if(1 == cur_slice_is_nonref)
-                    {
-                        /*We have encountered a referenced frame,return to app*/
-                        ps_dec_op->u4_num_bytes_consumed -=
-                                        bytes_consumed;
-                        ps_dec_op->e_pic_type = IV_B_FRAME;
-                        ps_dec_op->u4_error_code =
-                                        IVD_DEC_FRM_SKIPPED;
-                        ps_dec_op->u4_error_code |= (1
-                                        << IVD_UNSUPPORTEDPARAM);
-                        ps_dec_op->u4_frame_decoded_flag = 0;
-                        ps_dec_op->u4_size =
-                                        sizeof(ivd_video_decode_op_t);
-                        /*signal the decode thread*/
-                        ih264d_signal_decode_thread(ps_dec);
-                        /* close deblock thread if it is not closed yet*/
-                        if(ps_dec->u4_num_cores == 3)
-                        {
-                            ih264d_signal_bs_deblk_thread(ps_dec);
-                        }
-
-                        return (IV_FAIL);
-                    }
-                }
-
-            }
-
-        }
-
-
         if(buflen)
         {
             memcpy(pu1_bitstrm_buf, pu1_buf + u4_length_of_start_code,
@@ -2218,7 +2197,6 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
 
         }
 
-        ps_dec->u4_return_to_app = 0;
         ret = ih264d_parse_nal_unit(dec_hdl, ps_dec_op,
                               pu1_bitstrm_buf, buflen);
         if(ret != OK)
@@ -2232,6 +2210,8 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
                             || (ret == ERROR_UNAVAIL_PICBUF_T)
                             || (ret == ERROR_UNAVAIL_MVBUF_T)
                             || (ret == ERROR_INV_SPS_PPS_T)
+                            || (ret == ERROR_FEATURE_UNAVAIL)
+                            || (ret == IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED)
                             || (ret == IVD_DISP_FRM_ZERO_OP_BUF_SIZE))
             {
                 ps_dec->u4_slice_start_code_found = 0;
@@ -2253,27 +2233,6 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
 
         }
 
-        if(ps_dec->u4_return_to_app)
-        {
-            /*We have encountered a referenced frame,return to app*/
-            ps_dec_op->u4_num_bytes_consumed -= bytes_consumed;
-            ps_dec_op->u4_error_code = IVD_DEC_FRM_SKIPPED;
-            ps_dec_op->u4_error_code |= (1 << IVD_UNSUPPORTEDPARAM);
-            ps_dec_op->u4_frame_decoded_flag = 0;
-            ps_dec_op->u4_size = sizeof(ivd_video_decode_op_t);
-            /*signal the decode thread*/
-            ih264d_signal_decode_thread(ps_dec);
-            /* close deblock thread if it is not closed yet*/
-            if(ps_dec->u4_num_cores == 3)
-            {
-                ih264d_signal_bs_deblk_thread(ps_dec);
-            }
-            return (IV_FAIL);
-
-        }
-
-
-
         header_data_left = ((ps_dec->i4_decode_header == 1)
                         && (ps_dec->i4_header_decoded != 3)
                         && (ps_dec_op->u4_num_bytes_consumed
@@ -2401,31 +2360,10 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
     }
 
 //Report if header (sps and pps) has not been decoded yet
-    if(ps_dec->i4_header_decoded != 3)
-    {
-        ps_dec_op->u4_error_code |= (1 << IVD_INSUFFICIENTDATA);
-
-    }
-
     if(ps_dec->i4_decode_header == 1 && ps_dec->i4_header_decoded != 3)
     {
         ps_dec_op->u4_error_code |= (1 << IVD_INSUFFICIENTDATA);
-
-    }
-    if(ps_dec->u4_prev_nal_skipped)
-    {
-        /*We have encountered a referenced frame,return to app*/
-        ps_dec_op->u4_error_code = IVD_DEC_FRM_SKIPPED;
-        ps_dec_op->u4_error_code |= (1 << IVD_UNSUPPORTEDPARAM);
-        ps_dec_op->u4_frame_decoded_flag = 0;
-        ps_dec_op->u4_size = sizeof(ivd_video_decode_op_t);
-        /* close deblock thread if it is not closed yet*/
-        if(ps_dec->u4_num_cores == 3)
-        {
-            ih264d_signal_bs_deblk_thread(ps_dec);
-        }
-        return (IV_FAIL);
-
+        api_ret_value = IV_FAIL;
     }
 
     if((ps_dec->u4_pic_buf_got == 1)
@@ -3138,32 +3076,10 @@ WORD32 ih264d_set_params(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
 
     ps_ctl_op->u4_error_code = 0;
 
-    ps_dec->i4_app_skip_mode = ps_ctl_ip->e_frm_skip_mode;
-
-    /*Is it really supported test it when you so the corner testing using test app*/
-
     if(ps_ctl_ip->e_frm_skip_mode != IVD_SKIP_NONE)
     {
-
-        if(ps_ctl_ip->e_frm_skip_mode == IVD_SKIP_P)
-            ps_dec->u4_skip_frm_mask |= 1 << P_SLC_BIT;
-        else if(ps_ctl_ip->e_frm_skip_mode == IVD_SKIP_B)
-            ps_dec->u4_skip_frm_mask |= 1 << B_SLC_BIT;
-        else if(ps_ctl_ip->e_frm_skip_mode == IVD_SKIP_PB)
-        {
-            ps_dec->u4_skip_frm_mask |= 1 << B_SLC_BIT;
-            ps_dec->u4_skip_frm_mask |= 1 << P_SLC_BIT;
-        }
-        else if(ps_ctl_ip->e_frm_skip_mode == IVD_SKIP_I)
-            ps_dec->u4_skip_frm_mask |= 1 << I_SLC_BIT;
-        else
-        {
-            //dynamic parameter not supported
-            //Put an appropriate error code to return the error..
-            //when you do the error code tests and after that remove this comment
-            ps_ctl_op->u4_error_code = (1 << IVD_UNSUPPORTEDPARAM);
-            ret = IV_FAIL;
-        }
+        ps_ctl_op->u4_error_code = (1 << IVD_UNSUPPORTEDPARAM);
+        ret = IV_FAIL;
     }
 
     if(ps_ctl_ip->u4_disp_wd >= ps_dec->u2_pic_wd)
@@ -3462,7 +3378,7 @@ WORD32 ih264d_rel_display_frame(iv_obj_t *dec_hdl,
     ivd_rel_display_frame_op_t *ps_rel_op;
     UWORD32 buf_released = 0;
 
-    UWORD32 u4_ts = -1;
+    UWORD32 u4_ts = 0;
     dec_struct_t *ps_dec = dec_hdl->pv_codec_handle;
 
     ps_rel_ip = (ivd_rel_display_frame_ip_t *)pv_api_ip;
diff --git a/decoder/ih264d_defs.h b/decoder/ih264d_defs.h
index 260e358..94d0d61 100644
--- a/decoder/ih264d_defs.h
+++ b/decoder/ih264d_defs.h
@@ -34,6 +34,8 @@
  *
  ************************************************************************
  */
+#include <stdint.h>
+
 #define H264_MAX_FRAME_WIDTH                4080
 #define H264_MAX_FRAME_HEIGHT               4080
 #define H264_MAX_FRAME_SIZE                 (4096 * 2048)
@@ -47,6 +49,9 @@
 #define CHECKBIT(a,i) ((a) &  (1 << i))
 #define CLEARBIT(a,i) ((a) &= ~(1 << i))
 
+/** Macro to check if a number lies in the valid integer range */
+#define IS_OUT_OF_RANGE_S32(a) (((a) < INT32_MIN) || ((a) > INT32_MAX))
+
 /** Macro to convert a integer to a boolean value */
 #define BOOLEAN(x) (!!(x))
 
@@ -351,6 +356,7 @@ enum
 #define DISP_BOT_FLD    0x01
 
 /** Slice Types */
+#define NA_SLICE -1
 #define P_SLICE  0
 #define B_SLICE  1
 #define I_SLICE  2
@@ -600,7 +606,7 @@ enum
 #endif //DEBLOCK_THREAD
 
 #define NUM_COEFFS_IN_4x4BLK 16
-
+#define CABAC_BITS_TO_READ 23
 
 #define MEMSET_16BYTES(pu4_start,value)                         \
 {                                                               \
diff --git a/decoder/ih264d_dpb_mgr.c b/decoder/ih264d_dpb_mgr.c
index 74ecdb5..af414a5 100644
--- a/decoder/ih264d_dpb_mgr.c
+++ b/decoder/ih264d_dpb_mgr.c
@@ -747,18 +747,22 @@ WORD32 ih264d_ref_idx_reordering(dec_struct_t *ps_dec, UWORD8 uc_lx)
         ui_nextUev = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
         if(ui_remapIdc != 2)
         {
+            if(ui_nextUev > ui_max_frame_num)
+                return ERROR_DBP_MANAGER_T;
+
             ui_nextUev = ui_nextUev + 1;
+
             if(ui_remapIdc == 0)
             {
                 // diffPicNum is -ve
-                i_temp = u2_pred_frame_num - ui_nextUev;
+                i_temp = (WORD32)u2_pred_frame_num - (WORD32)ui_nextUev;
                 if(i_temp < 0)
                     i_temp += ui_max_frame_num;
             }
             else
             {
                 // diffPicNum is +ve
-                i_temp = u2_pred_frame_num + ui_nextUev;
+                i_temp = (WORD32)u2_pred_frame_num + (WORD32)ui_nextUev;
                 if(i_temp >= ui_max_frame_num)
                     i_temp -= ui_max_frame_num;
             }
@@ -786,7 +790,12 @@ WORD32 ih264d_ref_idx_reordering(dec_struct_t *ps_dec, UWORD8 uc_lx)
         }
         else //2
         {
-            UWORD8 u1_lt_idx = (UWORD8)ui_nextUev;
+            UWORD8 u1_lt_idx;
+
+            if(ui_nextUev > (MAX_REF_BUFS + 1))
+                return ERROR_DBP_MANAGER_T;
+
+            u1_lt_idx = (UWORD8)ui_nextUev;
 
             for(i = 0; i < (ps_cur_slice->u1_initial_list_size[uc_lx]); i++)
             {
@@ -1170,7 +1179,7 @@ WORD32 ih264d_do_mmco_buffer(dpb_commands_t *ps_dpb_cmds,
                         u4_diff_pic_num = ps_mmc_params->u4_diff_pic_num; //Get absDiffPicnumMinus1
                         if(u1_fld_pic_flag)
                             i4_cur_pic_num = i4_cur_pic_num * 2 + 1;
-                        i4_pic_num = i4_cur_pic_num - (u4_diff_pic_num + 1);
+                        i4_pic_num = ((WORD32)i4_cur_pic_num - ((WORD32)u4_diff_pic_num + 1));
                     }
 
                     if(ps_dpb_mgr->u1_num_st_ref_bufs > 0)
@@ -1218,7 +1227,7 @@ WORD32 ih264d_do_mmco_buffer(dpb_commands_t *ps_dpb_cmds,
                         if(u1_fld_pic_flag)
                             i4_cur_pic_num = i4_cur_pic_num * 2 + 1;
 
-                        i4_pic_num = i4_cur_pic_num - (u4_diff_pic_num + 1);
+                        i4_pic_num = (WORD32)i4_cur_pic_num - ((WORD32)u4_diff_pic_num + 1);
                     }
 
                     u4_lt_idx = ps_mmc_params->u4_lt_idx; //Get long term index
diff --git a/decoder/ih264d_error_handler.h b/decoder/ih264d_error_handler.h
index 586fe8a..a3764c6 100644
--- a/decoder/ih264d_error_handler.h
+++ b/decoder/ih264d_error_handler.h
@@ -113,7 +113,8 @@ typedef enum
     ERROR_IN_LAST_SLICE_OF_PIC = 0x93,
     ERROR_NEW_FRAME_EXPECTED = 0x94,
     ERROR_INCOMPLETE_FRAME = 0x95,
-    ERROR_VUI_PARAMS_NOT_FOUND = 0x96
+    ERROR_VUI_PARAMS_NOT_FOUND = 0x96,
+    ERROR_INV_POC = 0x97
 
 } h264_decoder_error_code_t;
 
diff --git a/decoder/ih264d_parse_bslice.c b/decoder/ih264d_parse_bslice.c
index f087f8d..0af4214 100644
--- a/decoder/ih264d_parse_bslice.c
+++ b/decoder/ih264d_parse_bslice.c
@@ -1220,11 +1220,11 @@ void ih264d_get_implicit_weights(dec_struct_t *ps_dec)
             if(i4_poc1 != i4_poc0)
             {
                 i4_tb = ps_dec->ps_cur_pic->i4_poc - i4_poc0;
-                i16_tb = CLIP3(-128, 127, i4_tb);
+                i16_tb = CLIP_S8(i4_tb);
                 i4_td = i4_poc1 - i4_poc0;
-                i16_td = CLIP3(-128, 127, i4_td);
+                i16_td = CLIP_S8(i4_td);
                 i16_tx = (16384 + ABS(SIGN_POW2_DIV(i16_td, 1))) / i16_td;
-                i2_dist_scale_factor = CLIP3(-1024, 1023,
+                i2_dist_scale_factor = CLIP_S11(
                                             (((i16_tb * i16_tx) + 32) >> 6));
 
                 if(/*((u4_poc1 - u4_poc0) == 0) ||*/
@@ -1290,14 +1290,13 @@ void ih264d_get_implicit_weights(dec_struct_t *ps_dec)
                     if(i4_poc1 != i4_poc0)
                     {
                         i4_tb = i4_cur_poc - i4_poc0;
-                        i16_tb = CLIP3(-128, 127, i4_tb);
+                        i16_tb = CLIP_S8(i4_tb);
                         i4_td = i4_poc1 - i4_poc0;
-                        i16_td = CLIP3(-128, 127, i4_td);
+                        i16_td = CLIP_S8(i4_td);
                         i16_tx = (16384 + ABS(SIGN_POW2_DIV(i16_td, 1)))
                                         / i16_td;
-                        i2_dist_scale_factor = CLIP3(
-                                        -1024, 1023,
-                                        (((i16_tb * i16_tx) + 32) >> 6));
+                        i2_dist_scale_factor = CLIP_S11(
+                                                    (((i16_tb * i16_tx) + 32) >> 6));
 
                         if(/*((u4_poc1 - u4_poc0) == 0) ||*/
                         (!(ps_pic_buff1->u1_is_short && ps_pic_buff0->u1_is_short))
diff --git a/decoder/ih264d_parse_cabac.c b/decoder/ih264d_parse_cabac.c
index 9d58f33..c4a3bd5 100644
--- a/decoder/ih264d_parse_cabac.c
+++ b/decoder/ih264d_parse_cabac.c
@@ -400,7 +400,7 @@ UWORD8 ih264d_read_coeff4x4_cabac(dec_bit_stream_t *ps_bitstrm,
                         {
                             UWORD32 uc_bin;
                             UWORD32 bits_to_flush;
-                            UWORD32 max_bits = 32;
+
 
                             bits_to_flush = 0;
                             /*renormalize to ensure there 23 bits more in the u4_code_int_val_ofst*/
@@ -409,7 +409,7 @@ UWORD8 ih264d_read_coeff4x4_cabac(dec_bit_stream_t *ps_bitstrm,
 
                                 u4_clz = CLZ(u4_code_int_range);
                                 FLUSHBITS(u4_offset, u4_clz)
-                                NEXTBITS(read_bits, u4_offset, pu4_buffer, 23)
+                                NEXTBITS(read_bits, u4_offset, pu4_buffer, CABAC_BITS_TO_READ)
                                 u4_code_int_range = u4_code_int_range << u4_clz;
                                 u4_code_int_val_ofst = (u4_code_int_val_ofst
                                                 << u4_clz) | read_bits;
@@ -438,7 +438,7 @@ UWORD8 ih264d_read_coeff4x4_cabac(dec_bit_stream_t *ps_bitstrm,
                                                 ps_cab_env);INC_BYPASS_BINS(ps_cab_env);
 
                             }
-                            while(uc_bin && (bits_to_flush < max_bits));
+                            while(uc_bin && (bits_to_flush < CABAC_BITS_TO_READ));
 
                             u4_value = (bits_to_flush - 1);
 
@@ -459,7 +459,7 @@ UWORD8 ih264d_read_coeff4x4_cabac(dec_bit_stream_t *ps_bitstrm,
 
                                 u4_clz = CLZ(u4_code_int_range);
                                 FLUSHBITS(u4_offset, u4_clz)
-                                NEXTBITS(read_bits, u4_offset, pu4_buffer, 23)
+                                NEXTBITS(read_bits, u4_offset, pu4_buffer, CABAC_BITS_TO_READ)
                                 u4_code_int_range = u4_code_int_range << u4_clz;
                                 u4_code_int_val_ofst = (u4_code_int_val_ofst
                                                 << u4_clz) | read_bits;
@@ -868,7 +868,7 @@ void ih264d_read_coeff8x8_cabac(dec_bit_stream_t *ps_bitstrm,
                         {
                             UWORD32 uc_bin;
                             UWORD32 bits_to_flush;
-                            UWORD32 max_bits = 32;
+
 
                             bits_to_flush = 0;
                             /*renormalize to ensure there 23 bits more in the u4_code_int_val_ofst*/
@@ -877,7 +877,7 @@ void ih264d_read_coeff8x8_cabac(dec_bit_stream_t *ps_bitstrm,
 
                                 u4_clz = CLZ(u4_code_int_range);
                                 FLUSHBITS(u4_offset, u4_clz)
-                                NEXTBITS(read_bits, u4_offset, pu4_buffer, 23)
+                                NEXTBITS(read_bits, u4_offset, pu4_buffer, CABAC_BITS_TO_READ)
                                 u4_code_int_range = u4_code_int_range << u4_clz;
                                 u4_code_int_val_ofst = (u4_code_int_val_ofst
                                                 << u4_clz) | read_bits;
@@ -902,7 +902,7 @@ void ih264d_read_coeff8x8_cabac(dec_bit_stream_t *ps_bitstrm,
                                 }
 
                             }
-                            while(uc_bin && (bits_to_flush < max_bits));
+                            while(uc_bin && (bits_to_flush < CABAC_BITS_TO_READ));
 
                             u4_value = (bits_to_flush - 1);
                         }
@@ -921,7 +921,7 @@ void ih264d_read_coeff8x8_cabac(dec_bit_stream_t *ps_bitstrm,
 
                                 u4_clz = CLZ(u4_code_int_range);
                                 FLUSHBITS(u4_offset, u4_clz)
-                                NEXTBITS(read_bits, u4_offset, pu4_buffer, 23)
+                                NEXTBITS(read_bits, u4_offset, pu4_buffer, CABAC_BITS_TO_READ)
                                 u4_code_int_range = u4_code_int_range << u4_clz;
                                 u4_code_int_val_ofst = (u4_code_int_val_ofst
                                                 << u4_clz) | read_bits;
@@ -967,7 +967,7 @@ void ih264d_read_coeff8x8_cabac(dec_bit_stream_t *ps_bitstrm,
 
                         //Value of K
                         ui16_sufS += u4_value;
-                        i2_abs_lvl += ui16_sufS;
+                        i2_abs_lvl += (WORD32)ui16_sufS;
                     }
                     else
                     {
diff --git a/decoder/ih264d_parse_cavlc.c b/decoder/ih264d_parse_cavlc.c
index b6a0125..d538a4e 100644
--- a/decoder/ih264d_parse_cavlc.c
+++ b/decoder/ih264d_parse_cavlc.c
@@ -474,8 +474,11 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_2to10(UWORD32 u4_isdc,
 
         pi2_trlone_lkup = ppi2_trlone_lkup[(1 << u4_cnt) - 2 + u4_signs];
 
-        while(u4_cnt--)
+        while(u4_cnt)
+        {
             i2_level_arr[i--] = *pi2_trlone_lkup++;
+            u4_cnt--;
+        }
     }
 
     /****************************************************************/
@@ -610,7 +613,7 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_2to10(UWORD32 u4_isdc,
         const UWORD8 *pu1_table_runbefore;
         UWORD32 u4_run;
         WORD32 k;
-        UWORD32 u4_scan_pos = u4_total_coeff + u4_total_zeroes - 1 + u4_isdc;
+        WORD32 u4_scan_pos = u4_total_coeff + u4_total_zeroes - 1 + u4_isdc;
         WORD32 u4_zeroes_left = u4_total_zeroes;
         k = u4_total_coeff - 1;
 
@@ -638,10 +641,13 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_2to10(UWORD32 u4_isdc,
 
             SET_BIT(ps_tu_4x4->u2_sig_coeff_map, u4_scan_pos);
             *pi2_coeff_data++ = i2_level_arr[k--];
-            u4_zeroes_left -= u4_run;
-            u4_scan_pos -= (u4_run + 1);
+            u4_zeroes_left -= (WORD32)u4_run;
+            u4_scan_pos -= (WORD32)(u4_run + 1);
         }
 
+        if (u4_zeroes_left < 0 || u4_scan_pos < 0)
+            return -1;
+
         /**************************************************************/
         /* Decoding Runs for 0 < zeros left <=6                       */
         /**************************************************************/
@@ -658,9 +664,11 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_2to10(UWORD32 u4_isdc,
 
             SET_BIT(ps_tu_4x4->u2_sig_coeff_map, u4_scan_pos);
             *pi2_coeff_data++ = i2_level_arr[k--];
-            u4_zeroes_left -= u4_run;
-            u4_scan_pos -= (u4_run + 1);
+            u4_zeroes_left -= (WORD32)u4_run;
+            u4_scan_pos -= (WORD32)(u4_run + 1);
         }
+        if (u4_zeroes_left < 0 || u4_scan_pos < 0)
+            return -1;
         /**************************************************************/
         /* Decoding Runs End                                          */
         /**************************************************************/
@@ -668,8 +676,6 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_2to10(UWORD32 u4_isdc,
         /**************************************************************/
         /* Copy the remaining coefficients                            */
         /**************************************************************/
-        if(u4_zeroes_left < 0)
-            return -1;
         while(k >= 0)
         {
 
@@ -755,8 +761,11 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_11to16(UWORD32 u4_isdc,
 
         pi2_trlone_lkup = ppi2_trlone_lkup[(1 << u4_cnt) - 2 + u4_signs];
 
-        while(u4_cnt--)
+        while(u4_cnt)
+        {
             i2_level_arr[i--] = *pi2_trlone_lkup++;
+            u4_cnt--;
+        }
     }
 
     /****************************************************************/
@@ -921,7 +930,7 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_11to16(UWORD32 u4_isdc,
         const UWORD8 *pu1_table_runbefore;
         UWORD32 u4_run;
         WORD32 k;
-        UWORD32 u4_scan_pos = u4_total_coeff + u4_total_zeroes - 1 + u4_isdc;
+        WORD32 u4_scan_pos = u4_total_coeff + u4_total_zeroes - 1 + u4_isdc;
         WORD32 u4_zeroes_left = u4_total_zeroes;
         k = u4_total_coeff - 1;
 
@@ -940,9 +949,12 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_11to16(UWORD32 u4_isdc,
             FLUSHBITS(u4_bitstream_offset, (u4_code & 0x03));
             SET_BIT(ps_tu_4x4->u2_sig_coeff_map, u4_scan_pos);
             *pi2_coeff_data++ = i2_level_arr[k--];
-            u4_zeroes_left -= u4_run;
-            u4_scan_pos -= (u4_run + 1);
+            u4_zeroes_left -= (WORD32)u4_run;
+            u4_scan_pos -= (WORD32)(u4_run + 1);
         }
+        if (u4_zeroes_left < 0 || u4_scan_pos < 0)
+          return -1;
+
         /**************************************************************/
         /* Decoding Runs End                                          */
         /**************************************************************/
@@ -950,8 +962,6 @@ WORD32 ih264d_cavlc_4x4res_block_totalcoeff_11to16(UWORD32 u4_isdc,
         /**************************************************************/
         /* Copy the remaining coefficients                            */
         /**************************************************************/
-        if(u4_zeroes_left < 0)
-            return -1;
         while(k >= 0)
         {
             SET_BIT(ps_tu_4x4->u2_sig_coeff_map, u4_scan_pos);
@@ -1031,8 +1041,11 @@ void ih264d_rest_of_residual_cav_chroma_dc_block(UWORD32 u4_total_coeff_trail_on
 
         pi2_trlone_lkup = ppi2_trlone_lkup[(1 << u4_cnt) - 2 + u4_signs];
 
-        while(u4_cnt--)
+        while(u4_cnt)
+        {
             i2_level_arr[i--] = *pi2_trlone_lkup++;
+            u4_cnt--;
+        }
     }
 
     /****************************************************************/
@@ -1154,7 +1167,7 @@ void ih264d_rest_of_residual_cav_chroma_dc_block(UWORD32 u4_total_coeff_trail_on
     {
         const UWORD8 *pu1_table_runbefore;
         UWORD32 u4_run;
-        UWORD32 u4_scan_pos = (u4_total_coeff + u4_total_zeroes - 1);
+        WORD32 u4_scan_pos = (u4_total_coeff + u4_total_zeroes - 1);
         UWORD32 u4_zeroes_left = u4_total_zeroes;
         i = u4_total_coeff - 1;
 
@@ -1173,8 +1186,8 @@ void ih264d_rest_of_residual_cav_chroma_dc_block(UWORD32 u4_total_coeff_trail_on
             FLUSHBITS(u4_bitstream_offset, (u4_code & 0x03));
             SET_BIT(ps_tu_4x4->u2_sig_coeff_map, u4_scan_pos);
             *pi2_coeff_data++ = i2_level_arr[i--];
-            u4_zeroes_left -= u4_run;
-            u4_scan_pos -= (u4_run + 1);
+            u4_zeroes_left -= (WORD32)u4_run;
+            u4_scan_pos -= (WORD32)(u4_run + 1);
         }
         /**************************************************************/
         /* Decoding Runs End                                          */
@@ -1378,10 +1391,10 @@ void ih264d_cavlc_parse_chroma_dc(dec_mb_info_t *ps_cur_mb_info,
         /*-----------------------------------------------------------*/
         /* Scaling and storing the values back                       */
         /*-----------------------------------------------------------*/
-        *pi2_coeff_data++ = ((i_z0 + i_z3) * u4_scale_u) >> 5;
-        *pi2_coeff_data++ = ((i_z0 - i_z3) * u4_scale_u) >> 5;
-        *pi2_coeff_data++ = ((i_z1 + i_z2) * u4_scale_u) >> 5;
-        *pi2_coeff_data++ = ((i_z1 - i_z2) * u4_scale_u) >> 5;
+        *pi2_coeff_data++ = (WORD16)(((i_z0 + i_z3) * (WORD32)u4_scale_u) >> 5);
+        *pi2_coeff_data++ = (WORD16)(((i_z0 - i_z3) * (WORD32)u4_scale_u) >> 5);
+        *pi2_coeff_data++ = (WORD16)(((i_z1 + i_z2) * (WORD32)u4_scale_u) >> 5);
+        *pi2_coeff_data++ = (WORD16)(((i_z1 - i_z2) * (WORD32)u4_scale_u) >> 5);
 
         ps_dec->pv_parse_tu_coeff_data = (void *)pi2_coeff_data;
 
@@ -1441,10 +1454,10 @@ void ih264d_cavlc_parse_chroma_dc(dec_mb_info_t *ps_cur_mb_info,
         /*-----------------------------------------------------------*/
         /* Scaling and storing the values back                       */
         /*-----------------------------------------------------------*/
-        *pi2_coeff_data++ = ((i_z0 + i_z3) * u4_scale_v) >> 5;
-        *pi2_coeff_data++ = ((i_z0 - i_z3) * u4_scale_v) >> 5;
-        *pi2_coeff_data++ = ((i_z1 + i_z2) * u4_scale_v) >> 5;
-        *pi2_coeff_data++ = ((i_z1 - i_z2) * u4_scale_v) >> 5;
+        *pi2_coeff_data++ = (WORD16)(((i_z0 + i_z3) * (WORD32)u4_scale_v) >> 5);
+        *pi2_coeff_data++ = (WORD16)(((i_z0 - i_z3) * (WORD32)u4_scale_v) >> 5);
+        *pi2_coeff_data++ = (WORD16)(((i_z1 + i_z2) * (WORD32)u4_scale_v) >> 5);
+        *pi2_coeff_data++ = (WORD16)(((i_z1 - i_z2) * (WORD32)u4_scale_v) >> 5);
 
         ps_dec->pv_parse_tu_coeff_data = (void *)pi2_coeff_data;
 
diff --git a/decoder/ih264d_parse_headers.c b/decoder/ih264d_parse_headers.c
index d9f50f4..03b423c 100644
--- a/decoder/ih264d_parse_headers.c
+++ b/decoder/ih264d_parse_headers.c
@@ -205,6 +205,9 @@ WORD32 ih264d_parse_pps(dec_struct_t * ps_dec, dec_bit_stream_t * ps_bitstrm)
     UWORD8 u1_more_data_flag;
     WORD32 i4_i;
 
+    if(!(ps_dec->i4_header_decoded & 1))
+        return ERROR_INV_SPS_PPS_T;
+
     /*--------------------------------------------------------------------*/
     /* Decode pic_parameter_set_id and find corresponding pic params      */
     /*--------------------------------------------------------------------*/
@@ -230,6 +233,9 @@ WORD32 ih264d_parse_pps(dec_struct_t * ps_dec, dec_bit_stream_t * ps_bitstrm)
         return ERROR_INV_SPS_PPS_T;
     COPYTHECONTEXT("PPS: seq_parameter_set_id",u4_temp);
     ps_sps = &ps_dec->ps_sps[u4_temp];
+
+    if(FALSE == ps_sps->u1_is_valid)
+        return ERROR_INV_SPS_PPS_T;
     ps_pps->ps_sps = ps_sps;
 
     /*--------------------------------------------------------------------*/
@@ -488,7 +494,7 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
     UWORD8 u1_frm, uc_constraint_set0_flag, uc_constraint_set1_flag;
     WORD32 i4_cropped_ht, i4_cropped_wd;
     UWORD32 u4_temp;
-    WORD32 pic_height_in_map_units_minus1 = 0;
+    UWORD32 u4_pic_height_in_map_units, u4_pic_width_in_mbs;
     UWORD32 u2_pic_wd = 0;
     UWORD32 u2_pic_ht = 0;
     UWORD32 u2_frm_wd_y = 0;
@@ -498,7 +504,7 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
     UWORD32 u2_crop_offset_y = 0;
     UWORD32 u2_crop_offset_uv = 0;
     WORD32 ret;
-    UWORD32 u4_num_reorder_frames;
+    WORD32 num_reorder_frames;
     /* High profile related syntax element */
     WORD32 i4_i;
     /* G050 */
@@ -608,7 +614,7 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
         /* Monochrome is not supported */
         if(ps_seq->i4_chroma_format_idc != 1)
         {
-            return ERROR_INV_SPS_PPS_T;
+            return ERROR_FEATURE_UNAVAIL;
         }
 
         /* reading bit_depth_luma_minus8   */
@@ -617,7 +623,7 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
 
         if(ps_seq->i4_bit_depth_luma_minus8 != 0)
         {
-            return ERROR_INV_SPS_PPS_T;
+            return ERROR_FEATURE_UNAVAIL;
         }
 
         /* reading bit_depth_chroma_minus8   */
@@ -626,7 +632,7 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
 
         if(ps_seq->i4_bit_depth_chroma_minus8 != 0)
         {
-            return ERROR_INV_SPS_PPS_T;
+            return ERROR_FEATURE_UNAVAIL;
         }
 
         /* reading qpprime_y_zero_transform_bypass_flag   */
@@ -771,18 +777,25 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
     /*--------------------------------------------------------------------*/
     /* Decode FrameWidth and FrameHeight and related values               */
     /*--------------------------------------------------------------------*/
-    ps_seq->u2_frm_wd_in_mbs = 1
+    u4_pic_width_in_mbs = 1
                     + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
     COPYTHECONTEXT("SPS: pic_width_in_mbs_minus1",
-                    ps_seq->u2_frm_wd_in_mbs - 1);
-    u2_pic_wd = (ps_seq->u2_frm_wd_in_mbs << 4);
+                   u4_pic_width_in_mbs - 1);
 
-    pic_height_in_map_units_minus1 = ih264d_uev(pu4_bitstrm_ofst,
+    u4_pic_height_in_map_units = 1 + ih264d_uev(pu4_bitstrm_ofst,
                                                 pu4_bitstrm_buf);
-    ps_seq->u2_frm_ht_in_mbs = 1 + pic_height_in_map_units_minus1;
 
-    u2_pic_ht = (ps_seq->u2_frm_ht_in_mbs << 4);
+    /* Check  for unsupported resolutions*/
+    if((u4_pic_width_in_mbs > (H264_MAX_FRAME_WIDTH >> 4)) ||
+        (u4_pic_height_in_map_units > (H264_MAX_FRAME_HEIGHT >> 4)))
+    {
+        return IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED;
+    }
+    ps_seq->u2_frm_wd_in_mbs = u4_pic_width_in_mbs;
+    ps_seq->u2_frm_ht_in_mbs = u4_pic_height_in_map_units;
 
+    u2_pic_wd = (u4_pic_width_in_mbs << 4);
+    u2_pic_ht = (u4_pic_height_in_map_units << 4);
     /*--------------------------------------------------------------------*/
     /* Get the value of MaxMbAddress and Number of bits needed for it     */
     /*--------------------------------------------------------------------*/
@@ -911,8 +924,8 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
                         + (u2_lft_ofst >> 1) * YUV420SP_FACTOR;
         /* Calculate the display picture width and height based on crop      */
         /* information                                                       */
-        i4_cropped_ht = u2_pic_ht - (u2_btm_ofst + u2_top_ofst);
-        i4_cropped_wd = u2_pic_wd - (u2_rgt_ofst + u2_lft_ofst);
+        i4_cropped_ht = (WORD32)u2_pic_ht - (WORD32)(u2_btm_ofst + u2_top_ofst);
+        i4_cropped_wd = (WORD32)u2_pic_wd - (WORD32)(u2_rgt_ofst + u2_lft_ofst);
 
         if((i4_cropped_ht < MB_SIZE) || (i4_cropped_wd < MB_SIZE))
         {
@@ -943,7 +956,7 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
             return IVD_RES_CHANGED;
         }
 
-        /* Check for unsupported resolutions */
+        /* Check again for unsupported resolutions with updated values*/
         if((u2_pic_wd > H264_MAX_FRAME_WIDTH) || (u2_pic_ht > H264_MAX_FRAME_HEIGHT)
                 || (u2_pic_wd < H264_MIN_FRAME_WIDTH) || (u2_pic_ht < H264_MIN_FRAME_HEIGHT)
                 || (u2_pic_wd * (UWORD32)u2_pic_ht > H264_MAX_FRAME_SIZE))
@@ -962,16 +975,16 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
 
     }
 
-    /* Backup u4_num_reorder_frames if header is already decoded */
+    /* Backup num_reorder_frames if header is already decoded */
     if((ps_dec->i4_header_decoded & 1) &&
                     (1 == ps_seq->u1_vui_parameters_present_flag) &&
                     (1 == ps_seq->s_vui.u1_bitstream_restriction_flag))
     {
-        u4_num_reorder_frames =  ps_seq->s_vui.u4_num_reorder_frames;
+        num_reorder_frames =  (WORD32)ps_seq->s_vui.u4_num_reorder_frames;
     }
     else
     {
-        u4_num_reorder_frames = -1;
+        num_reorder_frames = -1;
     }
     if(1 == ps_seq->u1_vui_parameters_present_flag)
     {
@@ -980,12 +993,12 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
             return ret;
     }
 
-    /* Compare older u4_num_reorder_frames with the new one if header is already decoded */
+    /* Compare older num_reorder_frames with the new one if header is already decoded */
     if((ps_dec->i4_header_decoded & 1) &&
-                    (-1 != (WORD32)u4_num_reorder_frames) &&
+                    (-1 != num_reorder_frames) &&
                     (1 == ps_seq->u1_vui_parameters_present_flag) &&
                     (1 == ps_seq->s_vui.u1_bitstream_restriction_flag) &&
-                    (ps_seq->s_vui.u4_num_reorder_frames != u4_num_reorder_frames))
+                    ((WORD32)ps_seq->s_vui.u4_num_reorder_frames != num_reorder_frames))
     {
         ps_dec->u1_res_changed = 1;
         return IVD_RES_CHANGED;
diff --git a/decoder/ih264d_parse_slice.c b/decoder/ih264d_parse_slice.c
index db02bfe..8d50f9a 100644
--- a/decoder/ih264d_parse_slice.c
+++ b/decoder/ih264d_parse_slice.c
@@ -690,12 +690,12 @@ WORD32 ih264d_start_of_pic(dec_struct_t *ps_dec,
         if((ps_seq->i4_seq_scaling_matrix_present_flag)
                         || (ps_pps->i4_pic_scaling_matrix_present_flag))
         {
-            ih264d_form_scaling_matrix_picture(ps_seq, ps_pps, ps_dec);
+            ret = ih264d_form_scaling_matrix_picture(ps_seq, ps_pps, ps_dec);
             ps_dec->s_high_profile.u1_scaling_present = 1;
         }
         else
         {
-            ih264d_form_default_scaling_matrix(ps_dec);
+            ret = ih264d_form_default_scaling_matrix(ps_dec);
         }
 
         if(ps_pps->i4_transform_8x8_mode_flag)
@@ -705,9 +705,12 @@ WORD32 ih264d_start_of_pic(dec_struct_t *ps_dec,
     }
     else
     {
-        ih264d_form_default_scaling_matrix(ps_dec);
+        ret = ih264d_form_default_scaling_matrix(ps_dec);
     }
-
+    
+    if(ret != OK)
+        return ret;
+ 
     /* required while reading the transform_size_8x8 u4_flag */
     ps_dec->s_high_profile.u1_direct_8x8_inference_flag =
                     ps_seq->u1_direct_8x8_inference_flag;
@@ -979,6 +982,69 @@ WORD32 ih264d_end_of_pic(dec_struct_t *ps_dec)
     return OK;
 }
 
+
+/*!
+ **************************************************************************
+ * \if Function name : ih264d_fix_error_in_dpb \endif
+ *
+ * \brief
+ *    fix error in DPB
+ *
+ * \return
+ *    Number of node(s) deleted
+ **************************************************************************
+ */
+
+WORD32 ih264d_fix_error_in_dpb(dec_struct_t *ps_dec)
+{
+    /*--------------------------------------------------------------------*/
+    /* If there is common node in lt_list and st_list then delete it from */
+    /* st_list                                                            */
+    /*--------------------------------------------------------------------*/
+    UWORD8 no_of_nodes_deleted = 0;
+    UWORD8 lt_ref_num = ps_dec->ps_dpb_mgr->u1_num_lt_ref_bufs;
+    struct dpb_info_t *ps_lt_curr_dpb = ps_dec->ps_dpb_mgr->ps_dpb_ht_head;
+    while(lt_ref_num && ps_lt_curr_dpb)
+    {
+        if(ps_dec->ps_dpb_mgr->ps_dpb_st_head
+                && ((ps_lt_curr_dpb->s_bot_field.u1_reference_info
+                        | ps_lt_curr_dpb->s_top_field.u1_reference_info)
+                        == (IS_SHORT_TERM | IS_LONG_TERM)))
+        {
+            struct dpb_info_t *ps_st_next_dpb = ps_dec->ps_dpb_mgr->ps_dpb_st_head;
+            struct dpb_info_t *ps_st_curr_dpb = ps_dec->ps_dpb_mgr->ps_dpb_st_head;
+            UWORD8 st_ref_num = ps_dec->ps_dpb_mgr->u1_num_st_ref_bufs;
+            while(st_ref_num && ps_st_curr_dpb)
+            {
+                if(ps_st_curr_dpb == ps_lt_curr_dpb)
+                {
+                    if(st_ref_num == ps_dec->ps_dpb_mgr->u1_num_st_ref_bufs)
+                    {
+                        ps_dec->ps_dpb_mgr->ps_dpb_st_head =
+                                ps_dec->ps_dpb_mgr->ps_dpb_st_head->ps_prev_short;
+                        ps_st_curr_dpb = ps_dec->ps_dpb_mgr->ps_dpb_st_head;
+                    }
+                    else
+                    {
+                        ps_st_next_dpb->ps_prev_short = ps_st_curr_dpb->ps_prev_short;
+                    }
+                    ps_dec->ps_dpb_mgr->u1_num_st_ref_bufs--;
+                    ps_dec->ps_dpb_mgr->u1_num_lt_ref_bufs++;
+                    no_of_nodes_deleted++;
+                    break;
+                }
+                ps_st_next_dpb = ps_st_curr_dpb;
+                ps_st_curr_dpb = ps_st_curr_dpb->ps_prev_short;
+                st_ref_num--;
+            }
+        }
+        ps_lt_curr_dpb = ps_lt_curr_dpb->ps_prev_long;
+        lt_ref_num--;
+    }
+    return no_of_nodes_deleted;
+}
+
+
 /*!
  **************************************************************************
  * \if Function name : DecodeSlice \endif
@@ -1000,7 +1066,7 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
     dec_pic_params_t *ps_pps;
     dec_seq_params_t *ps_seq;
     dec_slice_params_t *ps_cur_slice = ps_dec->ps_cur_slice;
-    pocstruct_t s_tmp_poc;
+    pocstruct_t s_tmp_poc = {0};
     WORD32 i_delta_poc[2];
     WORD32 i4_poc = 0;
     UWORD16 u2_first_mb_in_slice, u2_frame_num;
@@ -1057,62 +1123,6 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
         u1_slice_type -= 5;
     }
 
-    {
-        UWORD32 skip;
-
-        if((ps_dec->i4_app_skip_mode == IVD_SKIP_PB)
-                        || (ps_dec->i4_dec_skip_mode == IVD_SKIP_PB))
-        {
-            UWORD32 u4_bit_stream_offset = 0;
-
-            if(ps_dec->u1_nal_unit_type == IDR_SLICE_NAL)
-            {
-                skip = 0;
-
-                ps_dec->i4_dec_skip_mode = IVD_SKIP_NONE;
-            }
-            else if((I_SLICE == u1_slice_type)
-                            && (1 >= ps_dec->ps_cur_sps->u1_num_ref_frames))
-            {
-                skip = 0;
-
-                ps_dec->i4_dec_skip_mode = IVD_SKIP_NONE;
-            }
-            else
-            {
-                skip = 1;
-            }
-
-            /* If one frame worth of data is already skipped, do not skip the next one */
-            if((0 == u2_first_mb_in_slice) && (1 == ps_dec->u4_prev_nal_skipped))
-            {
-                skip = 0;
-            }
-
-            if(skip)
-            {
-                ps_dec->u4_prev_nal_skipped = 1;
-                ps_dec->i4_dec_skip_mode = IVD_SKIP_PB;
-                return 0;
-            }
-            else
-            {
-                /* If the previous NAL was skipped, then
-                 do not process that buffer in this call.
-                 Return to app and process it in the next call.
-                 This is necessary to handle cases where I/IDR is not complete in
-                 the current buffer and application intends to fill the remaining part of the bitstream
-                 later. This ensures we process only frame worth of data in every call */
-                if(1 == ps_dec->u4_prev_nal_skipped)
-                {
-                    ps_dec->u4_return_to_app = 1;
-                    return 0;
-                }
-            }
-        }
-
-    }
-
     u4_temp = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
     if(u4_temp & MASK_ERR_PIC_SET_ID)
         return ERROR_INV_SLICE_HDR_T;
@@ -1473,9 +1483,13 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
         /* IDR Picture or POC wrap around */
         if(i4_poc == 0)
         {
-            ps_dec->i4_prev_max_display_seq = ps_dec->i4_prev_max_display_seq
-                            + ps_dec->i4_max_poc
-                            + ps_dec->u1_max_dec_frame_buffering + 1;
+            UWORD64 u8_temp;
+            u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq
+                      + ps_dec->i4_max_poc
+                      + ps_dec->u1_max_dec_frame_buffering + 1;
+            /*If i4_prev_max_display_seq overflows integer range, reset it */
+            ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)?
+                                              0 : u8_temp;
             ps_dec->i4_max_poc = 0;
         }
     }
@@ -1821,6 +1835,10 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
         ps_dec->pv_proc_tu_coeff_data = ps_dec->pv_parse_tu_coeff_data;
     }
 
+    ret = ih264d_fix_error_in_dpb(ps_dec);
+    if(ret < 0)
+        return ERROR_DBP_MANAGER_T;
+
     if(u1_slice_type == I_SLICE)
     {
         ps_dec->ps_cur_pic->u4_pack_slc_typ |= I_SLC_BIT;
diff --git a/decoder/ih264d_parse_slice.h b/decoder/ih264d_parse_slice.h
index c012062..0f82ec9 100644
--- a/decoder/ih264d_parse_slice.h
+++ b/decoder/ih264d_parse_slice.h
@@ -37,6 +37,7 @@
 #include "ih264_platform_macros.h"
 #include "ih264d_structs.h"
 #include "ih264d_error_handler.h"
+WORD32 ih264d_fix_error_in_dpb(dec_struct_t * ps_dec);
 WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
                                  UWORD8 u1_nal_ref_idc,
                                  dec_struct_t * ps_dec );
diff --git a/decoder/ih264d_process_bslice.c b/decoder/ih264d_process_bslice.c
index 42fad03..3ff15df 100644
--- a/decoder/ih264d_process_bslice.c
+++ b/decoder/ih264d_process_bslice.c
@@ -597,7 +597,7 @@ WORD32 ih264d_decode_temporal_direct(dec_struct_t * ps_dec,
     const UWORD8 *pu1_mb_partw = (const UWORD8 *)gau1_ih264d_mb_partw;
     WORD8 c_refFrm0, c_refFrm1;
     UWORD8 u1_ref_idx0, u1_is_cur_mb_fld;
-    UWORD32 pic0_poc, pic1_poc, cur_poc;
+    WORD32 pic0_poc, pic1_poc, cur_poc;
     WORD32 ret = 0;
 
     u1_is_cur_mb_fld = ps_cur_mb_info->u1_mb_field_decodingflag;
@@ -756,7 +756,7 @@ WORD32 ih264d_decode_temporal_direct(dec_struct_t * ps_dec,
         }
         {
             WORD16 i16_td;
-
+            WORD32 diff;
             if(c_refFrm0 >= 0)
             {
                 i2_mv_x0 = ps_mv->i2_mv[0];
@@ -782,7 +782,8 @@ WORD32 ih264d_decode_temporal_direct(dec_struct_t * ps_dec,
                 i2_mv_y0 *= 2;
             }
 
-            i16_td = pic1_poc - pic0_poc;
+            diff = pic1_poc - pic0_poc;
+            i16_td = CLIP_S8(diff);
             if((ps_pic_buff0->u1_is_short == 0) || (i16_td == 0))
             {
                 i2_mv_x1 = 0;
@@ -792,12 +793,11 @@ WORD32 ih264d_decode_temporal_direct(dec_struct_t * ps_dec,
             {
                 WORD16 i16_tb, i16_tx, i2_dist_scale_factor, i16_temp;
 
-                i16_td = CLIP3(-128, 127, i16_td);
-                i16_tb = cur_poc - pic0_poc;
-                i16_tb = CLIP3(-128, 127, i16_tb);
+                diff = cur_poc - pic0_poc;
+                i16_tb = CLIP_S8(diff);
 
                 i16_tx = (16384 + ABS(SIGN_POW2_DIV(i16_td, 1))) / i16_td;
-                i2_dist_scale_factor = CLIP3(-1024, 1023,
+                i2_dist_scale_factor = CLIP_S11(
                                             (((i16_tb * i16_tx) + 32) >> 6));
                 i16_temp = (i2_mv_x0 * i2_dist_scale_factor + 128) >> 8;
                 i2_mv_x1 = i16_temp - i2_mv_x0;
diff --git a/decoder/ih264d_process_intra_mb.c b/decoder/ih264d_process_intra_mb.c
index 211d796..2d4d006 100644
--- a/decoder/ih264d_process_intra_mb.c
+++ b/decoder/ih264d_process_intra_mb.c
@@ -1670,7 +1670,7 @@ WORD32 ih264d_process_intra_mb(dec_struct_t * ps_dec,
             {
                 /* Align the size to multiple of 8, so that SIMD functions
                 can read 64 bits at a time. Only 25 bytes are actaully used */
-                UWORD8 au1_ngbr_pels[32];
+                UWORD8 au1_ngbr_pels[32] = {0};
                 WORD32 ngbr_avail;
                 ngbr_avail = u1_is_left_sub_block << 0;
                 ngbr_avail |= u1_is_top_sub_block << 2;
diff --git a/decoder/ih264d_quant_scaling.c b/decoder/ih264d_quant_scaling.c
index fa9aeb5..1d48907 100644
--- a/decoder/ih264d_quant_scaling.c
+++ b/decoder/ih264d_quant_scaling.c
@@ -74,7 +74,7 @@ void ih264d_scaling_list(WORD16 *pi2_scaling_list,
     }
 }
 
-void ih264d_form_default_scaling_matrix(dec_struct_t *ps_dec)
+WORD32 ih264d_form_default_scaling_matrix(dec_struct_t *ps_dec)
 {
 
     /*************************************************************************/
@@ -108,11 +108,12 @@ void ih264d_form_default_scaling_matrix(dec_struct_t *ps_dec)
             }
         }
     }
+    return OK;
 }
 
-void ih264d_form_scaling_matrix_picture(dec_seq_params_t *ps_seq,
-                                        dec_pic_params_t *ps_pic,
-                                        dec_struct_t *ps_dec)
+WORD32 ih264d_form_scaling_matrix_picture(dec_seq_params_t *ps_seq,
+                                          dec_pic_params_t *ps_pic,
+                                          dec_struct_t *ps_dec)
 {
     /* default scaling matrices */
     WORD32 i4_i;
@@ -216,7 +217,7 @@ void ih264d_form_scaling_matrix_picture(dec_seq_params_t *ps_seq,
             {
                 if(!ps_pic->u1_pic_scaling_list_present_flag[i4_i])
                 {
-                    if(!ps_seq->u1_seq_scaling_list_present_flag[i4_i])
+                    if(!ps_seq->i4_seq_scaling_matrix_present_flag)
                     {
                         ps_dec->s_high_profile.pi2_scale_mat[i4_i] =
                                         (i4_i == 6) ? ((WORD16*)gai2_ih264d_default_intra8x8) : ((WORD16*)gai2_ih264d_default_inter8x8);
@@ -251,6 +252,9 @@ void ih264d_form_scaling_matrix_picture(dec_seq_params_t *ps_seq,
         /* for all 4x4 matrices */
         for(i4_i = 0; i4_i < 6; i4_i++)
         {
+            if(ps_dec->s_high_profile.pi2_scale_mat[i4_i] == NULL)
+                return ERROR_CORRUPTED_SLICE;
+
             for(i4_j = 0; i4_j < 16; i4_j++)
             {
                 ps_dec->s_high_profile.i2_scalinglist4x4[i4_i][pu1_inv_scan_4x4[i4_j]] =
@@ -262,6 +266,9 @@ void ih264d_form_scaling_matrix_picture(dec_seq_params_t *ps_seq,
         /* for all 8x8 matrices */
         for(i4_i = 0; i4_i < 2; i4_i++)
         {
+            if(ps_dec->s_high_profile.pi2_scale_mat[i4_i + 6] == NULL)
+                return ERROR_CORRUPTED_SLICE;
+
             for(i4_j = 0; i4_j < 64; i4_j++)
             {
                 ps_dec->s_high_profile.i2_scalinglist8x8[i4_i][gau1_ih264d_inv_scan_prog8x8_cabac[i4_j]] =
@@ -270,5 +277,6 @@ void ih264d_form_scaling_matrix_picture(dec_seq_params_t *ps_seq,
             }
         }
     }
+    return OK;
 }
 
diff --git a/decoder/ih264d_quant_scaling.h b/decoder/ih264d_quant_scaling.h
index d9bd377..c714c34 100644
--- a/decoder/ih264d_quant_scaling.h
+++ b/decoder/ih264d_quant_scaling.h
@@ -25,11 +25,11 @@ void ih264d_scaling_list(WORD16 *pi2_scaling_list,
                   dec_bit_stream_t *ps_bitstrm);
 
 
-void ih264d_form_scaling_matrix_picture(dec_seq_params_t *ps_seq,
-                                 dec_pic_params_t *ps_pic,
-                                 dec_struct_t *ps_dec);
+WORD32 ih264d_form_scaling_matrix_picture(dec_seq_params_t *ps_seq,
+                                          dec_pic_params_t *ps_pic,
+                                          dec_struct_t *ps_dec);
 
-void ih264d_form_default_scaling_matrix(dec_struct_t *ps_dec);
+WORD32 ih264d_form_default_scaling_matrix(dec_struct_t *ps_dec);
 
 
 
diff --git a/decoder/ih264d_sei.c b/decoder/ih264d_sei.c
index 098a1f3..39be782 100644
--- a/decoder/ih264d_sei.c
+++ b/decoder/ih264d_sei.c
@@ -197,6 +197,10 @@ WORD32 ih264d_parse_pic_timing(dec_bit_stream_t *ps_bitstrm,
         ps_sei->u1_is_valid = 1;
     }
     u4_bits_consumed = ps_bitstrm->u4_ofst - u4_start_offset;
+
+    if((ui4_payload_size << 3) < u4_bits_consumed)
+        return ERROR_CORRUPTED_SLICE;
+
     ih264d_flush_bits_h264(ps_bitstrm,
                            (ui4_payload_size << 3) - u4_bits_consumed);
 
@@ -275,28 +279,30 @@ WORD32 ih264d_parse_sei_payload(dec_bit_stream_t *ps_bitstrm,
     sei *ps_sei;
     WORD32 i4_status = 0;
     ps_sei = (sei *)ps_dec->ps_sei;
+
+    if(ui4_payload_size == 0)
+        return -1;
+
     switch(ui4_payload_type)
     {
         case SEI_BUF_PERIOD:
 
             i4_status = ih264d_parse_buffering_period(&ps_sei->s_buf_period,
                                                       ps_bitstrm, ps_dec);
-            /*if(i4_status != OK)
-                return i4_status;*/
             break;
         case SEI_PIC_TIMING:
             if(NULL == ps_dec->ps_cur_sps)
-                ih264d_flush_bits_h264(ps_bitstrm, (ui4_payload_size << 3));
+                i4_status = ih264d_flush_bits_h264(ps_bitstrm, (ui4_payload_size << 3));
             else
-                ih264d_parse_pic_timing(ps_bitstrm, ps_dec,
+                i4_status = ih264d_parse_pic_timing(ps_bitstrm, ps_dec,
                                         ui4_payload_size);
             break;
         case SEI_RECOVERY_PT:
-            ih264d_parse_recovery_point(ps_bitstrm, ps_dec,
+            i4_status = ih264d_parse_recovery_point(ps_bitstrm, ps_dec,
                                         ui4_payload_size);
             break;
         default:
-            ih264d_flush_bits_h264(ps_bitstrm, (ui4_payload_size << 3));
+            i4_status = ih264d_flush_bits_h264(ps_bitstrm, (ui4_payload_size << 3));
             break;
     }
     return (i4_status);
@@ -354,12 +360,6 @@ WORD32 ih264d_parse_sei_message(dec_struct_t *ps_dec,
 
         i4_status = ih264d_parse_sei_payload(ps_bitstrm, ui4_payload_type,
                                              ui4_payload_size, ps_dec);
-        if(i4_status == -1)
-        {
-            i4_status = 0;
-            break;
-        }
-
         if(i4_status != OK)
             return i4_status;
 
diff --git a/decoder/ih264d_structs.h b/decoder/ih264d_structs.h
index 706fe9d..97e9797 100644
--- a/decoder/ih264d_structs.h
+++ b/decoder/ih264d_structs.h
@@ -1231,7 +1231,6 @@ typedef struct _DecStruct
     UWORD32 u4_num_mbs_cur_nmb;
     UWORD32 u4_app_deblk_disable_level;
     UWORD32 u4_app_disable_deblk_frm;
-    WORD32 i4_app_skip_mode;
     WORD32 i4_mv_frac_mask;
 
     disp_buf_t disp_bufs[MAX_DISP_BUFS_NEW];
@@ -1239,9 +1238,6 @@ typedef struct _DecStruct
     UWORD32 u4_disp_buf_to_be_freed[MAX_DISP_BUFS_NEW];
     UWORD32 u4_share_disp_buf;
     UWORD32 u4_num_disp_bufs;
-    UWORD32 u4_prev_nal_skipped;
-    UWORD32 u4_return_to_app;
-    WORD32 i4_dec_skip_mode;
 
     UWORD32 u4_bs_deblk_thread_created;
     volatile UWORD32 u4_start_recon_deblk;
diff --git a/decoder/ih264d_utils.c b/decoder/ih264d_utils.c
index edfb8f1..0381763 100644
--- a/decoder/ih264d_utils.c
+++ b/decoder/ih264d_utils.c
@@ -240,8 +240,9 @@ WORD32 ih264d_decode_pic_order_cnt(UWORD8 u1_is_idr_slice,
             WORD32 frame_num_ofst;
             WORD32 abs_frm_num;
             WORD32 poc_cycle_cnt, frame_num_in_poc_cycle;
-            WORD32 expected_delta_poc_cycle;
+            WORD64 i8_expected_delta_poc_cycle;
             WORD32 expected_poc;
+            WORD64 i8_result;
 
             prev_frame_num = (WORD32)ps_cur_slice->u2_frame_num;
             if(!u1_is_idr_slice)
@@ -269,25 +270,25 @@ WORD32 ih264d_decode_pic_order_cnt(UWORD8 u1_is_idr_slice,
             else if(prev_frame_num > ((WORD32)u2_frame_num))
             {
                 frame_num_ofst = i4_prev_frame_num_ofst
-                                + ps_seq->u2_u4_max_pic_num_minus1 + 1;
+                                + (WORD32)ps_seq->u2_u4_max_pic_num_minus1 + 1;
             }
             else
                 frame_num_ofst = i4_prev_frame_num_ofst;
 
             /* 2. Derivation for absFrameNum */
             if(0 != ps_seq->u1_num_ref_frames_in_pic_order_cnt_cycle)
-                abs_frm_num = frame_num_ofst + u2_frame_num;
+                abs_frm_num = frame_num_ofst + (WORD32)u2_frame_num;
             else
                 abs_frm_num = 0;
             if((u1_nal_ref_idc == 0) && (abs_frm_num > 0))
                 abs_frm_num = abs_frm_num - 1;
 
             /* 4. expectedDeltaPerPicOrderCntCycle is derived as */
-            expected_delta_poc_cycle = 0;
+            i8_expected_delta_poc_cycle = 0;
             for(i = 0; i < ps_seq->u1_num_ref_frames_in_pic_order_cnt_cycle;
                             i++)
             {
-                expected_delta_poc_cycle +=
+                i8_expected_delta_poc_cycle +=
                                 ps_seq->i4_ofst_for_ref_frame[i];
             }
 
@@ -303,42 +304,71 @@ WORD32 ih264d_decode_pic_order_cnt(UWORD8 u1_is_idr_slice,
                                 MOD((abs_frm_num - 1),
                                     ps_seq->u1_num_ref_frames_in_pic_order_cnt_cycle);
 
-                expected_poc = poc_cycle_cnt
-                                * expected_delta_poc_cycle;
+                i8_result = poc_cycle_cnt
+                                * i8_expected_delta_poc_cycle;
+
                 for(i = 0; i <= frame_num_in_poc_cycle; i++)
                 {
-                    expected_poc = expected_poc
+                    i8_result = i8_result
                                     + ps_seq->i4_ofst_for_ref_frame[i];
                 }
+
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+
+                expected_poc = (WORD32)i8_result;
+
             }
             else
                 expected_poc = 0;
 
             if(u1_nal_ref_idc == 0)
             {
-                expected_poc = expected_poc
+                i8_result = expected_poc
                                 + ps_seq->i4_ofst_for_non_ref_pic;
+
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+
+                expected_poc = (WORD32)i8_result;
             }
 
             /* 6. TopFieldOrderCnt or BottomFieldOrderCnt are derived as */
             if(!u1_field_pic_flag)
             {
-                i4_top_field_order_cnt = expected_poc
+                i8_result = expected_poc
                                 + ps_cur_poc->i4_delta_pic_order_cnt[0];
-                i4_bottom_field_order_cnt = i4_top_field_order_cnt
+
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+                i4_top_field_order_cnt = (WORD32)i8_result;
+
+                i8_result = i4_top_field_order_cnt
                                 + ps_seq->i4_ofst_for_top_to_bottom_field
                                 + ps_cur_poc->i4_delta_pic_order_cnt[1];
+
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+                i4_bottom_field_order_cnt = (WORD32)i8_result;
             }
             else if(!u1_bottom_field_flag)
             {
-                i4_top_field_order_cnt = expected_poc
+                i8_result = expected_poc
                                 + ps_cur_poc->i4_delta_pic_order_cnt[0];
+
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+                i4_top_field_order_cnt = (WORD32)i8_result;
             }
             else
             {
-                i4_bottom_field_order_cnt = expected_poc
+                i8_result = expected_poc
                                 + ps_seq->i4_ofst_for_top_to_bottom_field
                                 + ps_cur_poc->i4_delta_pic_order_cnt[0];
+
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+                i4_bottom_field_order_cnt = (WORD32)i8_result;
             }
             /* Copy the current POC info into Previous POC structure */
             ps_cur_poc->i4_prev_frame_num_ofst = frame_num_ofst;
@@ -376,7 +406,7 @@ WORD32 ih264d_decode_pic_order_cnt(UWORD8 u1_is_idr_slice,
             else if(prev_frame_num > ((WORD32)u2_frame_num))
             {
                 frame_num_ofst = i4_prev_frame_num_ofst
-                                + ps_seq->u2_u4_max_pic_num_minus1 + 1;
+                                + (WORD32)ps_seq->u2_u4_max_pic_num_minus1 + 1;
             }
             else
                 frame_num_ofst = i4_prev_frame_num_ofst;
@@ -385,10 +415,10 @@ WORD32 ih264d_decode_pic_order_cnt(UWORD8 u1_is_idr_slice,
             if(u1_is_idr_slice)
                 tmp_poc = 0;
             else if(u1_nal_ref_idc == 0)
-                tmp_poc = ((frame_num_ofst + u2_frame_num) << 1)
+                tmp_poc = ((frame_num_ofst + (WORD32)u2_frame_num) << 1)
                                 - 1;
             else
-                tmp_poc = ((frame_num_ofst + u2_frame_num) << 1);
+                tmp_poc = ((frame_num_ofst + (WORD32)u2_frame_num) << 1);
 
             /* 6. TopFieldOrderCnt or BottomFieldOrderCnt are derived as */
             if(!u1_field_pic_flag)
@@ -706,9 +736,9 @@ WORD32 ih264d_init_pic(dec_struct_t *ps_dec,
 
     ps_dec->ps_dpb_mgr->u2_pic_ht = ps_dec->u2_pic_ht;
     ps_dec->ps_dpb_mgr->u2_pic_wd = ps_dec->u2_pic_wd;
-    ps_dec->i4_pic_type = -1;
-    ps_dec->i4_frametype = -1;
-    ps_dec->i4_content_type = -1;
+    ps_dec->i4_pic_type = NA_SLICE;
+    ps_dec->i4_frametype = IV_NA_FRAME;
+    ps_dec->i4_content_type = IV_CONTENTTYPE_NA;
 
     /*--------------------------------------------------------------------*/
     /* Get the value of MaxMbAddress and frmheight in Mbs                 */
@@ -909,7 +939,7 @@ WORD32 ih264d_get_next_display_field(dec_struct_t * ps_dec,
                     (disp_mgr_t *)ps_dec->pv_disp_buf_mgr, &i4_disp_buf_id);
     ps_dec->u4_num_fld_in_frm = 0;
     u4_api_ret = -1;
-    pv_disp_op->u4_ts = -1;
+    pv_disp_op->u4_ts = 0;
     pv_disp_op->e_output_format = ps_dec->u1_chroma_format;
 
     pv_disp_op->s_disp_frm_buf.pv_y_buf = ps_out_buffer->pu1_bufs[0];
@@ -1264,6 +1294,7 @@ void ih264d_release_display_bufs(dec_struct_t *ps_dec)
     WORD32 i4_min_poc;
     WORD32 i4_min_poc_buf_id;
     WORD32 i4_min_index;
+    UWORD64 u8_temp;
     dpb_manager_t *ps_dpb_mgr = ps_dec->ps_dpb_mgr;
     WORD32 (*i4_poc_buf_id_map)[3] = ps_dpb_mgr->ai4_poc_buf_id_map;
 
@@ -1308,9 +1339,11 @@ void ih264d_release_display_bufs(dec_struct_t *ps_dec)
         }
     }
     ps_dpb_mgr->i1_poc_buf_id_entries = 0;
-    ps_dec->i4_prev_max_display_seq = ps_dec->i4_prev_max_display_seq
-                    + ps_dec->i4_max_poc + ps_dec->u1_max_dec_frame_buffering
-                    + 1;
+    u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq + ps_dec->i4_max_poc
+              + ps_dec->u1_max_dec_frame_buffering + 1;
+    /*If i4_prev_max_display_seq overflows integer range, reset it */
+    ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)?
+                                      0 : u8_temp;
     ps_dec->i4_max_poc = 0;
 }
 
@@ -1582,11 +1615,13 @@ WORD32 ih264d_decode_gaps_in_frame_num(dec_struct_t *ps_dec,
             /* IDR Picture or POC wrap around */
             if(i4_poc == 0)
             {
-                ps_dec->i4_prev_max_display_seq =
-                                ps_dec->i4_prev_max_display_seq
-                                                + ps_dec->i4_max_poc
-                                                + ps_dec->u1_max_dec_frame_buffering
-                                                + 1;
+                UWORD64 u8_temp;
+                u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq
+                          + ps_dec->i4_max_poc
+                          + ps_dec->u1_max_dec_frame_buffering + 1;
+                /*If i4_prev_max_display_seq overflows integer range, reset it */
+                ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)?
+                                                  0 : u8_temp;
                 ps_dec->i4_max_poc = 0;
             }
 
@@ -1830,16 +1865,19 @@ WORD16 ih264d_allocate_dynamic_bufs(dec_struct_t * ps_dec)
     size = u4_total_mbs;
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pu1_dec_mb_map = pv_buf;
 
     size = u4_total_mbs;
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pu1_recon_mb_map = pv_buf;
 
     size = u4_total_mbs * sizeof(UWORD16);
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pu2_slice_num_map = pv_buf;
 
     /************************************************************/
@@ -1861,17 +1899,20 @@ WORD16 ih264d_allocate_dynamic_bufs(dec_struct_t * ps_dec)
                         * ((ps_dec->u1_recon_mb_grp) << 4);
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_parse_part_params = pv_buf;
 
     size = ((u4_wd_mbs * sizeof(deblkmb_neighbour_t)) << uc_frmOrFld);
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_deblk_top_mb = pv_buf;
 
     size = ((sizeof(ctxt_inc_mb_info_t))
                         * (((u4_wd_mbs + 1) << uc_frmOrFld) + 1));
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->p_ctxt_inc_mb_map = pv_buf;
 
     /* 0th entry of CtxtIncMbMap will be always be containing default values
@@ -1882,12 +1923,14 @@ WORD16 ih264d_allocate_dynamic_bufs(dec_struct_t * ps_dec)
                         * 16);
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_mv_p[0] = pv_buf;
 
     size = (sizeof(mv_pred_t) * ps_dec->u1_recon_mb_grp
                         * 16);
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_mv_p[1] = pv_buf;
 
     {
@@ -1898,6 +1941,7 @@ WORD16 ih264d_allocate_dynamic_bufs(dec_struct_t * ps_dec)
                             * ps_dec->u1_recon_mb_grp * 4);
             pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
             RETURN_IF((NULL == pv_buf), IV_FAIL);
+            memset(pv_buf, 0, size);
             ps_dec->ps_mv_top_p[i] = pv_buf;
         }
     }
@@ -1986,6 +2030,7 @@ WORD16 ih264d_allocate_dynamic_bufs(dec_struct_t * ps_dec)
     size = sizeof(pred_info_pkd_t) * num_entries;
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->ps_pred_pkd = pv_buf;
 
     /* Allocate memory for coeff data */
@@ -1999,6 +2044,7 @@ WORD16 ih264d_allocate_dynamic_bufs(dec_struct_t * ps_dec)
     size += u4_total_mbs * 32;
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
 
     ps_dec->pi2_coeff_data = pv_buf;
 
@@ -2020,6 +2066,7 @@ WORD16 ih264d_allocate_dynamic_bufs(dec_struct_t * ps_dec)
         size *= u4_num_bufs;
         pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
         RETURN_IF((NULL == pv_buf), IV_FAIL);
+        memset(pv_buf, 0, size);
         ps_dec->pu1_mv_bank_buf_base = pv_buf;
     }
 
@@ -2053,6 +2100,7 @@ WORD16 ih264d_allocate_dynamic_bufs(dec_struct_t * ps_dec)
     size *= ps_dec->u1_pic_bufs;
     pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
     RETURN_IF((NULL == pv_buf), IV_FAIL);
+    memset(pv_buf, 0, size);
     ps_dec->pu1_pic_buf_base = pv_buf;
 
     /* Post allocation Increment Actions */
diff --git a/decoder/ih264d_vui.c b/decoder/ih264d_vui.c
index 15bc37d..15f1c00 100644
--- a/decoder/ih264d_vui.c
+++ b/decoder/ih264d_vui.c
@@ -231,6 +231,11 @@ WORD32 ih264d_parse_vui_parametres(vui_t *ps_vu4,
                                                    pu4_bitstrm_buf);
         ps_vu4->u4_max_dec_frame_buffering = ih264d_uev(pu4_bitstrm_ofst,
                                                         pu4_bitstrm_buf);
+        if((ps_vu4->u4_max_dec_frame_buffering > (H264_MAX_REF_PICS * 2)) ||
+           (ps_vu4->u4_num_reorder_frames > ps_vu4->u4_max_dec_frame_buffering))
+        {
+            return ERROR_INV_SPS_PPS_T;
+        }
     }
     else
     {
diff --git a/encoder/ih264e_defs.h b/encoder/ih264e_defs.h
index 4537bc2..33fafd1 100644
--- a/encoder/ih264e_defs.h
+++ b/encoder/ih264e_defs.h
@@ -134,7 +134,12 @@
 /**
  *  Maximum number of B pictures between two I/P pictures
  */
-#define MAX_NUM_BFRAMES     10
+#define MAX_NUM_BFRAMES     8
+
+/**
+ *  Maximum number of pictures in input queue
+ */
+#define MAX_NUM_INP_FRAMES  ((MAX_NUM_BFRAMES) + 2)
 
 /**
  *  Maximum number of reference buffers in DPB manager
@@ -202,7 +207,7 @@
 #define DEFAULT_RECON_ENABLE            0
 #define DEFAULT_RC                      IVE_RC_STORAGE
 #define DEFAULT_MAX_FRAMERATE           120000
-#define DEFAULT_MAX_BITRATE             50000000
+#define DEFAULT_MAX_BITRATE             240000000
 #define DEFAULT_MAX_NUM_BFRAMES         0
 #define DEFAULT_MAX_SRCH_RANGE_X        256
 #define DEFAULT_MAX_SRCH_RANGE_Y        256
@@ -218,7 +223,7 @@
 #define DEFAULT_AIR_MODE                IVE_AIR_MODE_NONE
 #define DEFAULT_AIR_REFRESH_PERIOD      30
 #define DEFAULT_VBV_DELAY               1000
-#define DEFAULT_VBV_SIZE                16800000 /* level 3.1 */
+#define DEFAULT_VBV_SIZE                240000000 /* level 6.0 */
 #define DEFAULT_NUM_CORES               1
 #define DEFAULT_ME_SPEED_PRESET         100
 #define DEFAULT_HPEL                    1
diff --git a/encoder/ih264e_structs.h b/encoder/ih264e_structs.h
index 125db84..c2e3b89 100644
--- a/encoder/ih264e_structs.h
+++ b/encoder/ih264e_structs.h
@@ -2801,7 +2801,7 @@ struct _codec_t
     /**
      * input buffer queue
      */
-    inp_buf_t as_inp_list[MAX_NUM_BFRAMES];
+    inp_buf_t as_inp_list[MAX_NUM_INP_FRAMES];
 
     /**
      * Flag to indicate if any IDR requests are pending
diff --git a/encoder/ih264e_utils.c b/encoder/ih264e_utils.c
index 455aa9e..c813f57 100644
--- a/encoder/ih264e_utils.c
+++ b/encoder/ih264e_utils.c
@@ -193,7 +193,7 @@ WORD32 ih264e_input_queue_update(codec_t *ps_codec,
     picture_type_e e_pictype;
     WORD32 i4_skip;
     UWORD32 ctxt_sel, u4_pic_id, u4_pic_disp_id;
-    UWORD8 u1_frame_qp;
+    UWORD8 u1_frame_qp, i;
     UWORD32 max_frame_bits = 0x7FFFFFFF;
 
     /*  Mark that the last input frame has been received */
@@ -235,7 +235,7 @@ WORD32 ih264e_input_queue_update(codec_t *ps_codec,
      *Queue the input to the queue
      **************************************************************************/
     ps_inp_buf = &(ps_codec->as_inp_list[ps_codec->i4_pic_cnt
-                                         % MAX_NUM_BFRAMES]);
+                                         % MAX_NUM_INP_FRAMES]);
 
     /* copy input info. to internal structure */
     ps_inp_buf->s_raw_buf = ps_ive_ip->s_inp_buf;
@@ -342,7 +342,7 @@ WORD32 ih264e_input_queue_update(codec_t *ps_codec,
     ps_codec->s_rate_control.pre_encode_skip[ctxt_sel] = i4_skip;
 
     /* Get a buffer to encode */
-    ps_inp_buf = &(ps_codec->as_inp_list[u4_pic_id % MAX_NUM_BFRAMES]);
+    ps_inp_buf = &(ps_codec->as_inp_list[u4_pic_id % MAX_NUM_INP_FRAMES]);
 
     /* copy dequeued input to output */
     ps_enc_buff->s_raw_buf = ps_inp_buf->s_raw_buf;
@@ -400,38 +400,42 @@ WORD32 ih264e_input_queue_update(codec_t *ps_codec,
      *     I/P and I/P.
      */
     if (ps_enc_buff->u4_is_last && (ps_codec->pic_type == PIC_P)
-                    && ps_codec->s_cfg.u4_num_bframes && (ps_codec->i4_poc > 1))
+                    && ps_codec->s_cfg.u4_num_bframes)
     {
-        UWORD32 u4_cntr, u4_lst_bframe;
-        inp_buf_t *ps_swap_buff, *ps_inp_list, *ps_cur_pic;
-
-        u4_cntr = (u4_pic_id + 1) % MAX_NUM_BFRAMES;
-        u4_lst_bframe = u4_pic_id ? ((u4_pic_id - 1) % MAX_NUM_BFRAMES) : (MAX_NUM_BFRAMES - 1);
+        WORD32 cntr;
+        WORD32 lst_bframe = -1;
+        UWORD32 u4_timestamp_low = 0;
+        UWORD32 u4_timestamp_high = 0;
+        inp_buf_t *ps_swap_buff, *ps_inp_list;
 
         ps_inp_list = &ps_codec->as_inp_list[0];
-        ps_cur_pic = &ps_inp_list[u4_pic_id % MAX_NUM_BFRAMES];
 
-        /* Now search the pic in most recent past to current frame */
-        for(; u4_cntr != (u4_pic_id % MAX_NUM_BFRAMES);
-                        u4_cntr = ((u4_cntr + 1) % MAX_NUM_BFRAMES))
+        /* Now search the inp list for highest timestamp */
+        for(cntr = 0; cntr < MAX_NUM_INP_FRAMES; cntr++)
         {
-            if ( (ps_inp_list[u4_cntr].u4_timestamp_low  <= ps_cur_pic->u4_timestamp_low) &&
-                 (ps_inp_list[u4_cntr].u4_timestamp_high <= ps_cur_pic->u4_timestamp_high) &&
-                 (ps_inp_list[u4_cntr].u4_timestamp_low  >= ps_inp_list[u4_lst_bframe].u4_timestamp_low) &&
-                 (ps_inp_list[u4_cntr].u4_timestamp_high >= ps_inp_list[u4_lst_bframe].u4_timestamp_high))
+            if(ps_inp_list[cntr].s_raw_buf.apv_bufs[0] != NULL)
             {
-                u4_lst_bframe = u4_cntr;
+                if ((ps_inp_list[cntr].u4_timestamp_high  > u4_timestamp_high) ||
+                    (ps_inp_list[cntr].u4_timestamp_high  == u4_timestamp_high &&
+                     ps_inp_list[cntr].u4_timestamp_low  > u4_timestamp_low))
+                {
+                    u4_timestamp_low = ps_inp_list[cntr].u4_timestamp_low;
+                    u4_timestamp_high = ps_inp_list[cntr].u4_timestamp_high;
+                    lst_bframe = cntr;
+                }
             }
         }
 
-        ps_swap_buff = &(ps_codec->as_inp_list[u4_lst_bframe]);
+        if(lst_bframe != -1)
+        {
+            ps_swap_buff = &(ps_codec->as_inp_list[lst_bframe]);
 
-        /* copy the last B buffer to output */
-        *ps_enc_buff = *ps_swap_buff;
-
-        /* Store the current buf into the queue in place of last B buf */
-        *ps_swap_buff = *ps_inp_buf;
+            /* copy the last B buffer to output */
+            *ps_enc_buff = *ps_swap_buff;
 
+            /* Store the current buf into the queue in place of last B buf */
+            *ps_swap_buff = *ps_inp_buf;
+        }
     }
 
     if (ps_enc_buff->u4_is_last)
@@ -439,6 +443,12 @@ WORD32 ih264e_input_queue_update(codec_t *ps_codec,
         ps_codec->pic_type = PIC_NA;
     }
 
+    /* The buffer in the queue is set to NULL to specify that encoding is done for that frame */
+    for(i = 0; i < 3; i++)
+    {
+        ps_inp_buf->s_raw_buf.apv_bufs[i] = NULL;
+    }
+
     /* Return the buffer status */
     return (0);
 }
diff --git a/encoder/x86/ih264e_intra_modes_eval_ssse3.c b/encoder/x86/ih264e_intra_modes_eval_ssse3.c
index c11d7f2..ea8a6c8 100644
--- a/encoder/x86/ih264e_intra_modes_eval_ssse3.c
+++ b/encoder/x86/ih264e_intra_modes_eval_ssse3.c
@@ -574,7 +574,7 @@ void ih264e_evaluate_intra_4x4_modes_ssse3(UWORD8 *pu1_src,
             pred2_16x8b = _mm_set1_epi8(dcval);
         }
         else
-            pred2_16x8b = _mm_set1_epi8(128);
+            pred2_16x8b = _mm_set1_epi8(-128);
 
         sad_8x16b = _mm_sad_epu8(src_16x8b, pred2_16x8b);
 
@@ -1135,7 +1135,7 @@ void ih264e_evaluate_intra_chroma_modes_ssse3(UWORD8 *pu1_src,
         }
         else
         {
-            pred1_16x8b = _mm_set1_epi8(128);
+            pred1_16x8b = _mm_set1_epi8(-128);
 
             tmp1_8x16b = _mm_sad_epu8(src1_16x8b, pred1_16x8b);
             tmp2_8x16b = _mm_sad_epu8(src2_16x8b, pred1_16x8b);
diff --git a/libavc_blacklist.txt b/libavc_blacklist.txt
new file mode 100644
index 0000000..5bb3630
--- /dev/null
+++ b/libavc_blacklist.txt
@@ -0,0 +1,34 @@
+[cfi]
+src:*external/libavc/*
+
+[integer]
+# decoder/ih264d_dpb_mgr.c:1174: 2 - 3 cannot be represented in type 'unsigned int'
+fun:ih264d_do_mmco_buffer
+# decoder/ih264d_parse_bslice.c:1388:21: 1 + 4294967295 cannot be represented in type 'unsigned int'
+# decoder/ih264d_parse_bslice.c:1391:22: 1 + 4294967295 cannot be represented in type 'unsigned int'
+fun:ih264d_decode_bslice
+# decoder/ih264d_utils.c:389: 0 - 1 cannot be represented in type 'unsigned int'
+fun:ih264d_decode_pic_order_cnt
+# decoder/ih264d_vui.c:76: 1 + 4294967295 cannot be represented in type 'unsigned int'
+fun:ih264d_parse_hrd_parametres
+# decoder/ih264d_dpb_mgr.c:751: 4294967295 + 1 cannot be represented in type 'unsigned int'
+# decoder/ih264d_dpb_mgr.c:755: 1 - 16 cannot be represented in type 'unsigned int'
+# decoder/ih264d_dpb_mgr.c:762: 4294967295 + 1 cannot be represented in type 'unsigned int'
+fun:ih264d_ref_idx_reordering
+# decoder/ih264d_process_bslice.c:785: 5 - 4294967242 cannot be represented in type 'unsigned int'
+# decoder/ih264d_process_bslice.c:796: 3 - 4294967242 cannot be represented in type 'unsigned int'
+fun:ih264d_decode_temporal_direct
+# encoder/ime.c:153: 0 - 1 cannot be represented in type 'UWORD32'
+fun:ime_diamond_search_16x16
+# encoder/irc_rate_control_api.c:1251: 1000 * 1065353216 cannot be represented in type 'unsigned int'
+fun:irc_change_frame_rate
+# encoder/irc_rate_control_api.c:310: 6000000 * 1000 cannot be represented in type 'unsigned int'
+fun:irc_initialise_rate_control
+
+# Numerous overflows in multiple functions, CAVLC is a compression technique.
+src:*/decoder/ih264d_parse_cavlc.c
+src:*/encoder/ih264e_cavlc.c
+
+# Performance related
+fun:ih264e_pack_c_mb
+fun:ime_compute_satqd_16x16_lumainter_a9q
diff --git a/test/encoder/app.h b/test/encoder/app.h
index 0e9a3df..8a2fb0a 100644
--- a/test/encoder/app.h
+++ b/test/encoder/app.h
@@ -75,7 +75,7 @@
 #define DEFAULT_MAX_REORDER_FRM     0
 #define DEFAULT_QP_MIN              4
 #define DEFAULT_QP_MAX              51
-#define DEFAULT_MAX_BITRATE         50000000
+#define DEFAULT_MAX_BITRATE         240000000
 #define DEFAULT_NUM_BFRAMES         0
 #define DEFAULT_MAX_SRCH_RANGE_X    256
 #define DEFAULT_MAX_SRCH_RANGE_Y    256