diff --git a/decoder/ixheaacd_block.c b/decoder/ixheaacd_block.c
index 0f4afb6..2424676 100644
--- a/decoder/ixheaacd_block.c
+++ b/decoder/ixheaacd_block.c
@@ -17,6 +17,7 @@
  *****************************************************************************
  * Originally developed and contributed by Ittiam Systems Pvt. Ltd, Bangalore
 */
+#include <stdlib.h>
 #include "ixheaacd_sbr_common.h"
 #include "ixheaacd_type_def.h"
 
@@ -1122,6 +1123,10 @@ WORD ixheaacd_huffman_dec_word2(ia_bit_buf_struct *it_bit_buff, WORD32 cb_no,
     } else {
       it_bit_buff->ptr_read_next += (it_bit_buff->bit_pos) >> 3;
       it_bit_buff->bit_pos = it_bit_buff->bit_pos & 0x7;
+      if ((SIZE_T)(it_bit_buff->ptr_read_next) > (SIZE_T)(it_bit_buff->ptr_bit_buf_end + 1))
+      {
+        return IA_ENHAACPLUS_DEC_EXE_NONFATAL_INSUFFICIENT_INPUT_BYTES;
+      }
 
       bits_cons = ((it_bit_buff->ptr_read_next - start_read_pos) << 3) +
                   ((it_bit_buff->bit_pos - start_bit_pos));
diff --git a/decoder/ixheaacd_headerdecode.c b/decoder/ixheaacd_headerdecode.c
index 356cf08..2c38ec6 100644
--- a/decoder/ixheaacd_headerdecode.c
+++ b/decoder/ixheaacd_headerdecode.c
@@ -490,6 +490,7 @@ WORD32 ixheaacd_ga_hdr_dec(ia_aac_dec_state_struct *aac_state_struct,
   WORD32 cnt_bits = it_bit_buff->cnt_bits;
   WORD32 dummy = 0;
   UWORD32 aot_init;
+  UWORD32 tmp_aot;
 
   ia_audio_specific_config_struct *pstr_audio_specific_config;
 
@@ -506,14 +507,20 @@ WORD32 ixheaacd_ga_hdr_dec(ia_aac_dec_state_struct *aac_state_struct,
 
   aot_init = aac_state_struct->audio_object_type;
 
-  aac_state_struct->audio_object_type = ixheaacd_read_bits_buf(it_bit_buff, 5);
+  tmp_aot = ixheaacd_read_bits_buf(it_bit_buff, 5);
 
-  if (aac_state_struct->audio_object_type == 31) {
+  if (tmp_aot == 31) {
     tmp = ixheaacd_read_bits_buf(it_bit_buff, 6);
-    aac_state_struct->audio_object_type = 32 + tmp;
+    tmp_aot = 32 + tmp;
   }
+
+  if (aac_state_struct->header_dec_done || aac_state_struct->ui_init_done) {
+    if (tmp_aot != aot_init && tmp_aot != AOT_SBR && tmp_aot != AOT_PS)
+      return IA_FATAL_ERROR;
+  }
+
   pstr_audio_specific_config->audio_object_type =
-      aac_state_struct->audio_object_type;
+      aac_state_struct->audio_object_type = tmp_aot;
 
   tmp = ixheaacd_get_samp_rate(it_bit_buff, pstr_samp_rate_info,
                                pstr_audio_specific_config);