diff --git a/decoder/ixheaacd_bitbuffer.c b/decoder/ixheaacd_bitbuffer.c
index 762b102..033e817 100644
--- a/decoder/ixheaacd_bitbuffer.c
+++ b/decoder/ixheaacd_bitbuffer.c
@@ -178,6 +178,13 @@ VOID ixheaacd_aac_read_byte_corr1(UWORD8 **ptr_read_next, WORD32 *ptr_bit_pos,
       v++;
     }
   }
+
+  if (bits_consumed > (31 - temp_bit_count)) {
+    if ((p_bit_buf_end != NULL) && (p_bit_buf_end < v)) {
+      bits_consumed = 31 - temp_bit_count;
+    }
+  }
+
   *ptr_bit_pos = bits_consumed + temp_bit_count;
   *ptr_read_next = v;
   return;
@@ -198,6 +205,13 @@ VOID ixheaacd_aac_read_byte_corr(UWORD8 **ptr_read_next, WORD32 *ptr_bit_pos,
   } else {
     bits_consumed += 8;
   }
+
+  if (bits_consumed > 31) {
+    if (p_bit_buf_end < v) {
+      bits_consumed = 31;
+    }
+  }
+
   *ptr_bit_pos = bits_consumed;
   *ptr_read_next = v;
   return;
diff --git a/decoder/ixheaacd_imdct.c b/decoder/ixheaacd_imdct.c
index c8d17de..fb868db 100644
--- a/decoder/ixheaacd_imdct.c
+++ b/decoder/ixheaacd_imdct.c
@@ -392,6 +392,9 @@ static IA_ERRORCODE ixheaacd_fd_imdct_short(ia_usac_data_struct *usac_data,
   ixheaacd_normalize(p_in_ibuffer, max_shift - 1, ixheaacd_drc_offset->n_long);
   shiftp += max_shift - 1;
 
+  if ((shiftp - shift_olap) > 31) {
+    shiftp = 31 + shift_olap;
+  }
   err_code = ixheaacd_calc_window(&window_short, ixheaacd_drc_offset->n_short,
                                   window_select, usac_data->ec_flag);
   if (err_code == -1) return err_code;
diff --git a/decoder/ixheaacd_mps_decorr.c b/decoder/ixheaacd_mps_decorr.c
index 5c0a55c..910f03a 100644
--- a/decoder/ixheaacd_mps_decorr.c
+++ b/decoder/ixheaacd_mps_decorr.c
@@ -684,6 +684,9 @@ static VOID ixheaacd_ducker_apply_71(
       if (ixheaacd_mps_comp(temp3, temp_1, &qtemp, qtemp1)) {
         temp_2 = ixheaacd_mps_div_32(temp3, temp_1, &qtemp2);
         qtemp2 = qtemp2 + qtemp - qtemp1;
+        if (temp_1 == 0) {
+          qtemp2 = qtemp;
+        }
         temp3 = (qtemp2) > 28 ? MAX_32 : 4 << qtemp2;
 
         if (temp_2 > temp3) {
diff --git a/decoder/ixheaacd_pns_js_thumb.c b/decoder/ixheaacd_pns_js_thumb.c
index e6ba987..c39b3f2 100644
--- a/decoder/ixheaacd_pns_js_thumb.c
+++ b/decoder/ixheaacd_pns_js_thumb.c
@@ -101,6 +101,9 @@ VOID ixheaacd_gen_rand_vec(WORD32 scale, WORD shift, WORD32 *ptr_spec_coef,
 
   spec = ptr_spec_coef;
 
+  if (shift < -31) {
+    shift = -31;
+  }
   for (sfb = 0; sfb <= sfb_width; sfb++) {
     *spec = ixheaac_shr32_dir_sat_limit(ixheaac_mult32_shl_sat(*spec, scale),
                                          shift);
diff --git a/decoder/ixheaacd_sbrdecoder.c b/decoder/ixheaacd_sbrdecoder.c
index e67e073..6f336fa 100644
--- a/decoder/ixheaacd_sbrdecoder.c
+++ b/decoder/ixheaacd_sbrdecoder.c
@@ -615,6 +615,7 @@ IA_ERRORCODE ixheaacd_applysbr(
         if (stereo) {
           frame_status = ixheaacd_sbr_read_cpe(ptr_header_data[0], ptr_frame_data, it_bit_buff,
                                                self->pstr_sbr_tables, audio_object_type);
+          if (usac_flag && (frame_status == 0)) return -1;
           if (frame_status < 0) return frame_status;
         } else {
           if (ps_enable) {
@@ -630,6 +631,7 @@ IA_ERRORCODE ixheaacd_applysbr(
             frame_status = ixheaacd_sbr_read_sce(
                 ptr_header_data[k], ptr_frame_data[k], self->pstr_ps_stereo_dec, it_bit_buff,
                 self->pstr_sbr_tables, audio_object_type, ec_flag);
+            if (usac_flag && (frame_status == 0)) return -1;
             if (frame_status < 0) return frame_status;
             if (ec_flag && self->pstr_ps_stereo_dec != NULL) {
               ixheaacd_copy_prev_ps_params(self->pstr_ps_stereo_dec, &self->str_ps_config_prev,
@@ -644,7 +646,7 @@ IA_ERRORCODE ixheaacd_applysbr(
         }
         ptr_header_data[k]->enh_sbr_ps =
             ((self->enh_sbr_ps) | (ptr_header_data[0]->channel_mode == PS_STEREO));
-        if (audio_object_type != AOT_ER_AAC_ELD) {
+        if ((audio_object_type != AOT_ER_AAC_ELD) && (audio_object_type != AOT_USAC)) {
           WORD32 total_bits_read;
           total_bits_read = ixheaacd_no_bits_read(it_bit_buff);
           if (total_bits_read > (ptr_bit_str_ele->size_payload << 3) ||