1 files changed, 12 insertions, 3 deletions
diff --git a/decoder/ixheaacd_mps_parse.c b/decoder/ixheaacd_mps_parse.c
index d7191a1..19b7212 100644
--- a/decoder/ixheaacd_mps_parse.c
+++ b/decoder/ixheaacd_mps_parse.c
@@ -825,12 +825,21 @@ IA_ERRORCODE ixheaacd_ld_mps_frame_parsing(
     bits_param_slot = 4;
 
   if (bs_frame_type) {
+    WORD32 prev_param_slot = -1;
     for (i = 0; i < self->num_parameter_sets; i++) {
-      self->param_slots[i] =
-          ixheaacd_read_bits_buf(it_bit_buff, bits_param_slot);
+      self->param_slots[i] = ixheaacd_read_bits_buf(it_bit_buff, bits_param_slot);
+
+      if (prev_param_slot >= self->param_slots[i] || self->param_slots[i] >= self->time_slots) {
+        return IA_FATAL_ERROR;
+      }
+      prev_param_slot = self->param_slots[i];
     }
   } else {
-    self->param_slots[0] = self->time_slots - 1;
+    for (i = 0; i < self->num_parameter_sets; i++) {
+      self->param_slots[i] = (((self->time_slots * (i + 1)) + self->num_parameter_sets - 1) /
+                              self->num_parameter_sets) -
+                             1;
+    }
   }
 
   frame->independency_flag = ixheaacd_read_bits_buf(it_bit_buff, 1);