--- libmad-0.15.1b/bit.c.mp3-crash	2004-01-23 11:41:32.000000000 +0200
+++ libmad-0.15.1b/bit.c	2016-06-24 21:47:38.731671829 +0300
@@ -85,6 +85,176 @@
  * NAME:	bit->init()
  * DESCRIPTION:	initialize bit pointer struct
  */
+void mad_bit_w_len_init(struct mad_bit_w_lenptr *bitptr, unsigned char const *byte, unsigned int length)
+{
+  bitptr->byte  = byte;
+  bitptr->cache = 0;
+  bitptr->left  = CHAR_BIT;
+  bitptr->length = length;
+}
+
+/*
+ * NAME:	bit->length()
+ * DESCRIPTION:	return number of bits between start and end points
+ */
+unsigned int mad_bit_w_len_length(struct mad_bit_w_lenptr const *begin,
+			    struct mad_bit_w_lenptr const *end)
+{
+  return begin->left +
+    CHAR_BIT * (end->byte - (begin->byte + 1)) + (CHAR_BIT - end->left);
+}
+
+/*
+ * NAME:	bit->nextbyte()
+ * DESCRIPTION:	return pointer to next unprocessed byte
+ */
+unsigned char const *mad_bit_w_len_nextbyte(struct mad_bit_w_lenptr const *bitptr)
+{
+    if (bitptr->left == CHAR_BIT)
+        return bitptr->byte;
+    if (bitptr->length == 0)
+        return 0;
+    return bitptr->byte + 1;
+}
+
+/*
+ * NAME:	bit->skip()
+ * DESCRIPTION:	advance bit pointer
+ */
+void mad_bit_w_len_skip(struct mad_bit_w_lenptr *bitptr, unsigned int len)
+{
+  if (bitptr->length < len / CHAR_BIT)
+    return;
+  bitptr->byte += len / CHAR_BIT;
+  bitptr->left -= len % CHAR_BIT;
+  bitptr->length -= len / CHAR_BIT;
+
+  if (bitptr->left > CHAR_BIT) {
+    if (bitptr->length == 0)
+      return;
+    bitptr->byte++;
+    bitptr->length--;
+    bitptr->left += CHAR_BIT;
+  }
+
+  if (bitptr->left < CHAR_BIT)
+    bitptr->cache = *bitptr->byte;
+}
+
+/*
+ * NAME:	bit->read()
+ * DESCRIPTION:	read an arbitrary number of bits and return their UIMSBF value
+ */
+unsigned long mad_bit_w_len_read(struct mad_bit_w_lenptr *bitptr, unsigned int len)
+{
+  register unsigned long value;
+
+  if (bitptr->left == CHAR_BIT)
+    bitptr->cache = *bitptr->byte;
+
+  if (len < bitptr->left) {
+    value = (bitptr->cache & ((1 << bitptr->left) - 1)) >>
+      (bitptr->left - len);
+    bitptr->left -= len;
+
+    return value;
+  }
+
+  /* remaining bits in current byte */
+
+  value = bitptr->cache & ((1 << bitptr->left) - 1);
+  len  -= bitptr->left;
+
+  if (bitptr->length == 0)
+    return value;
+  bitptr->byte++;
+  bitptr->length--;
+  bitptr->left = CHAR_BIT;
+
+  /* more bytes */
+
+  while (len >= CHAR_BIT && bitptr->length > 0) {
+    value = (value << CHAR_BIT) | *bitptr->byte++;
+    bitptr->length--;
+    len  -= CHAR_BIT;
+  }
+
+  if (len > 0 && bitptr->length > 0) {
+    bitptr->cache = *bitptr->byte;
+
+    value = (value << len) | (bitptr->cache >> (CHAR_BIT - len));
+    bitptr->left -= len;
+  }
+
+  return value;
+}
+
+# if 0
+/*
+ * NAME:	bit->write()
+ * DESCRIPTION:	write an arbitrary number of bits
+ */
+void mad_bit_w_len_write(struct mad_bit_w_lenptr *bitptr, unsigned int len,
+		   unsigned long value)
+{
+  unsigned char *ptr;
+
+  ptr = (unsigned char *) bitptr->byte;
+
+  /* ... */
+}
+# endif
+
+/*
+ * NAME:	bit->crc()
+ * DESCRIPTION:	compute CRC-check word
+ */
+unsigned short mad_bit_w_len_crc(struct mad_bit_w_lenptr bitptr, unsigned int len,
+			   unsigned short init)
+{
+  register unsigned int crc;
+
+  for (crc = init; len >= 32; len -= 32) {
+    register unsigned long data;
+
+    data = mad_bit_w_len_read(&bitptr, 32);
+
+    crc = (crc << 8) ^ crc_table[((crc >> 8) ^ (data >> 24)) & 0xff];
+    crc = (crc << 8) ^ crc_table[((crc >> 8) ^ (data >> 16)) & 0xff];
+    crc = (crc << 8) ^ crc_table[((crc >> 8) ^ (data >>  8)) & 0xff];
+    crc = (crc << 8) ^ crc_table[((crc >> 8) ^ (data >>  0)) & 0xff];
+  }
+
+  switch (len / 8) {
+  case 3: crc = (crc << 8) ^
+	    crc_table[((crc >> 8) ^ mad_bit_w_len_read(&bitptr, 8)) & 0xff];
+  case 2: crc = (crc << 8) ^
+	    crc_table[((crc >> 8) ^ mad_bit_w_len_read(&bitptr, 8)) & 0xff];
+  case 1: crc = (crc << 8) ^
+	    crc_table[((crc >> 8) ^ mad_bit_w_len_read(&bitptr, 8)) & 0xff];
+
+  len %= 8;
+
+  case 0: break;
+  }
+
+  while (len--) {
+    register unsigned int msb;
+
+    msb = mad_bit_w_len_read(&bitptr, 1) ^ (crc >> 15);
+
+    crc <<= 1;
+    if (msb & 1)
+      crc ^= CRC_POLY;
+  }
+
+  return crc & 0xffff;
+}
+
+/*
+ * NAME:	bit->init()
+ * DESCRIPTION:	initialize bit pointer struct
+ */
 void mad_bit_init(struct mad_bitptr *bitptr, unsigned char const *byte)
 {
   bitptr->byte  = byte;
--- libmad-0.15.1b/bit.h.mp3-crash	2004-01-23 11:41:32.000000000 +0200
+++ libmad-0.15.1b/bit.h	2016-06-24 21:47:38.731671829 +0300
@@ -22,6 +22,29 @@
 # ifndef LIBMAD_BIT_H
 # define LIBMAD_BIT_H
 
+struct mad_bit_w_lenptr {
+  unsigned char const *byte;
+  unsigned short cache;
+  unsigned short left;
+  unsigned int length;
+};
+
+void mad_bit_w_len_init(struct mad_bit_w_lenptr *, unsigned char const *, unsigned int length);
+
+# define mad_bit_w_len_finish(bitptr)		/* nothing */
+
+unsigned int mad_bit_w_len_length(struct mad_bit_w_lenptr const *,
+			    struct mad_bit_w_lenptr const *);
+
+# define mad_bit_w_len_bitsleft(bitptr)  ((bitptr)->left)
+unsigned char const *mad_bit_w_len_nextbyte(struct mad_bit_w_lenptr const *);
+
+void mad_bit_w_len_skip(struct mad_bit_w_lenptr *, unsigned int);
+unsigned long mad_bit_w_len_read(struct mad_bit_w_lenptr *, unsigned int);
+void mad_bit_w_len_write(struct mad_bit_w_lenptr *, unsigned int, unsigned long);
+
+unsigned short mad_bit_w_len_crc(struct mad_bit_w_lenptr, unsigned int, unsigned short);
+
 struct mad_bitptr {
   unsigned char const *byte;
   unsigned short cache;
--- libmad-0.15.1b/frame.c.mp3-crash	2004-02-05 00:59:19.000000000 +0200
+++ libmad-0.15.1b/frame.c	2016-06-24 21:47:38.731671829 +0300
@@ -127,14 +127,14 @@
   /* header() */
 
   /* syncword */
-  mad_bit_skip(&stream->ptr, 11);
+  mad_bit_w_len_skip(stream->l_ptr, 11);
 
   /* MPEG 2.5 indicator (really part of syncword) */
-  if (mad_bit_read(&stream->ptr, 1) == 0)
+  if (mad_bit_w_len_read(stream->l_ptr, 1) == 0)
     header->flags |= MAD_FLAG_MPEG_2_5_EXT;
 
   /* ID */
-  if (mad_bit_read(&stream->ptr, 1) == 0)
+  if (mad_bit_w_len_read(stream->l_ptr, 1) == 0)
     header->flags |= MAD_FLAG_LSF_EXT;
   else if (header->flags & MAD_FLAG_MPEG_2_5_EXT) {
     stream->error = MAD_ERROR_LOSTSYNC;
@@ -142,7 +142,7 @@
   }
 
   /* layer */
-  header->layer = 4 - mad_bit_read(&stream->ptr, 2);
+  header->layer = 4 - mad_bit_w_len_read(stream->l_ptr, 2);
 
   if (header->layer == 4) {
     stream->error = MAD_ERROR_BADLAYER;
@@ -150,13 +150,13 @@
   }
 
   /* protection_bit */
-  if (mad_bit_read(&stream->ptr, 1) == 0) {
+  if (mad_bit_w_len_read(stream->l_ptr, 1) == 0) {
     header->flags    |= MAD_FLAG_PROTECTION;
-    header->crc_check = mad_bit_crc(stream->ptr, 16, 0xffff);
+    header->crc_check = mad_bit_w_len_crc(*(stream->l_ptr), 16, 0xffff);
   }
 
   /* bitrate_index */
-  index = mad_bit_read(&stream->ptr, 4);
+  index = mad_bit_w_len_read(stream->l_ptr, 4);
 
   if (index == 15) {
     stream->error = MAD_ERROR_BADBITRATE;
@@ -169,7 +169,7 @@
     header->bitrate = bitrate_table[header->layer - 1][index];
 
   /* sampling_frequency */
-  index = mad_bit_read(&stream->ptr, 2);
+  index = mad_bit_w_len_read(stream->l_ptr, 2);
 
   if (index == 3) {
     stream->error = MAD_ERROR_BADSAMPLERATE;
@@ -186,29 +186,29 @@
   }
 
   /* padding_bit */
-  if (mad_bit_read(&stream->ptr, 1))
+  if (mad_bit_w_len_read(stream->l_ptr, 1))
     header->flags |= MAD_FLAG_PADDING;
 
   /* private_bit */
-  if (mad_bit_read(&stream->ptr, 1))
+  if (mad_bit_w_len_read(stream->l_ptr, 1))
     header->private_bits |= MAD_PRIVATE_HEADER;
 
   /* mode */
-  header->mode = 3 - mad_bit_read(&stream->ptr, 2);
+  header->mode = 3 - mad_bit_w_len_read(stream->l_ptr, 2);
 
   /* mode_extension */
-  header->mode_extension = mad_bit_read(&stream->ptr, 2);
+  header->mode_extension = mad_bit_w_len_read(stream->l_ptr, 2);
 
   /* copyright */
-  if (mad_bit_read(&stream->ptr, 1))
+  if (mad_bit_w_len_read(stream->l_ptr, 1))
     header->flags |= MAD_FLAG_COPYRIGHT;
 
   /* original/copy */
-  if (mad_bit_read(&stream->ptr, 1))
+  if (mad_bit_w_len_read(stream->l_ptr, 1))
     header->flags |= MAD_FLAG_ORIGINAL;
 
   /* emphasis */
-  header->emphasis = mad_bit_read(&stream->ptr, 2);
+  header->emphasis = mad_bit_w_len_read(stream->l_ptr, 2);
 
 # if defined(OPT_STRICT)
   /*
@@ -226,7 +226,7 @@
 
   /* crc_check */
   if (header->flags & MAD_FLAG_PROTECTION)
-    header->crc_target = mad_bit_read(&stream->ptr, 16);
+    header->crc_target = mad_bit_w_len_read(stream->l_ptr, 16);
 
   return 0;
 }
@@ -238,12 +238,12 @@
 static
 int free_bitrate(struct mad_stream *stream, struct mad_header const *header)
 {
-  struct mad_bitptr keep_ptr;
+  struct mad_bit_w_lenptr keep_ptr;
   unsigned long rate = 0;
   unsigned int pad_slot, slots_per_frame;
   unsigned char const *ptr = 0;
 
-  keep_ptr = stream->ptr;
+  keep_ptr = *stream->l_ptr;
 
   pad_slot = (header->flags & MAD_FLAG_PADDING) ? 1 : 0;
   slots_per_frame = (header->layer == MAD_LAYER_III &&
@@ -261,7 +261,7 @@
 	peek_header.samplerate == header->samplerate) {
       unsigned int N;
 
-      ptr = mad_bit_nextbyte(&stream->ptr);
+      ptr = mad_bit_w_len_nextbyte(stream->l_ptr);
 
       N = ptr - stream->this_frame;
 
@@ -278,10 +278,10 @@
 	break;
     }
 
-    mad_bit_skip(&stream->ptr, 8);
+    mad_bit_w_len_skip(stream->l_ptr, 8);
   }
 
-  stream->ptr = keep_ptr;
+  *stream->l_ptr = keep_ptr;
 
   if (rate < 8 || (header->layer == MAD_LAYER_III && rate > 640)) {
     stream->error = MAD_ERROR_LOSTSYNC;
@@ -348,7 +348,7 @@
     }
   }
   else {
-    mad_bit_init(&stream->ptr, ptr);
+    mad_bit_w_len_init(stream->l_ptr, ptr, stream->bufend - ptr);
 
     if (mad_stream_sync(stream) == -1) {
       if (end - stream->next_frame >= MAD_BUFFER_GUARD)
@@ -358,14 +358,14 @@
       goto fail;
     }
 
-    ptr = mad_bit_nextbyte(&stream->ptr);
+    ptr = mad_bit_w_len_nextbyte(stream->l_ptr);
   }
 
   /* begin processing */
   stream->this_frame = ptr;
   stream->next_frame = ptr + 1;  /* possibly bogus sync word */
 
-  mad_bit_init(&stream->ptr, stream->this_frame);
+  mad_bit_w_len_init(stream->l_ptr, stream->this_frame, stream->bufend - stream->this_frame);
 
   if (decode_header(header, stream) == -1)
     goto fail;
@@ -460,14 +460,16 @@
   /* ancillary_data() */
 
   if (frame->header.layer != MAD_LAYER_III) {
-    struct mad_bitptr next_frame;
+    struct mad_bit_w_lenptr next_frame;
 
-    mad_bit_init(&next_frame, stream->next_frame);
+    mad_bit_w_len_init(&next_frame, stream->next_frame, stream->bufend - stream->next_frame);
 
-    stream->anc_ptr    = stream->ptr;
-    stream->anc_bitlen = mad_bit_length(&stream->ptr, &next_frame);
+    if (stream->l_ptr != stream->l_anc_ptr)
+      free(stream->l_anc_ptr);
+    stream->l_anc_ptr    = stream->l_ptr;
+    stream->anc_bitlen = mad_bit_w_len_length(stream->l_ptr, &next_frame);
 
-    mad_bit_finish(&next_frame);
+    mad_bit_w_len_finish(&next_frame);
   }
 
   return 0;
--- libmad-0.15.1b/layer12.c.mp3-crash	2004-02-05 11:02:39.000000000 +0200
+++ libmad-0.15.1b/layer12.c	2016-06-24 21:47:38.731671829 +0300
@@ -72,11 +72,11 @@
  * DESCRIPTION:	decode one requantized Layer I sample from a bitstream
  */
 static
-mad_fixed_t I_sample(struct mad_bitptr *ptr, unsigned int nb)
+mad_fixed_t I_sample(struct mad_bit_w_lenptr *ptr, unsigned int nb)
 {
   mad_fixed_t sample;
 
-  sample = mad_bit_read(ptr, nb);
+  sample = mad_bit_w_len_read(ptr, nb);
 
   /* invert most significant bit, extend sign, then scale to fixed format */
 
@@ -119,7 +119,7 @@
 
   if (header->flags & MAD_FLAG_PROTECTION) {
     header->crc_check =
-      mad_bit_crc(stream->ptr, 4 * (bound * nch + (32 - bound)),
+      mad_bit_w_len_crc(*stream->l_ptr, 4 * (bound * nch + (32 - bound)),
 		  header->crc_check);
 
     if (header->crc_check != header->crc_target &&
@@ -133,7 +133,7 @@
 
   for (sb = 0; sb < bound; ++sb) {
     for (ch = 0; ch < nch; ++ch) {
-      nb = mad_bit_read(&stream->ptr, 4);
+      nb = mad_bit_w_len_read(stream->l_ptr, 4);
 
       if (nb == 15) {
 	stream->error = MAD_ERROR_BADBITALLOC;
@@ -145,7 +145,7 @@
   }
 
   for (sb = bound; sb < 32; ++sb) {
-    nb = mad_bit_read(&stream->ptr, 4);
+    nb = mad_bit_w_len_read(stream->l_ptr, 4);
 
     if (nb == 15) {
       stream->error = MAD_ERROR_BADBITALLOC;
@@ -161,7 +161,7 @@
   for (sb = 0; sb < 32; ++sb) {
     for (ch = 0; ch < nch; ++ch) {
       if (allocation[ch][sb]) {
-	scalefactor[ch][sb] = mad_bit_read(&stream->ptr, 6);
+	scalefactor[ch][sb] = mad_bit_w_len_read(stream->l_ptr, 6);
 
 # if defined(OPT_STRICT)
 	/*
@@ -185,7 +185,7 @@
       for (ch = 0; ch < nch; ++ch) {
 	nb = allocation[ch][sb];
 	frame->sbsample[ch][s][sb] = nb ?
-	  mad_f_mul(I_sample(&stream->ptr, nb),
+	  mad_f_mul(I_sample(stream->l_ptr, nb),
 		    sf_table[scalefactor[ch][sb]]) : 0;
       }
     }
@@ -194,7 +194,7 @@
       if ((nb = allocation[0][sb])) {
 	mad_fixed_t sample;
 
-	sample = I_sample(&stream->ptr, nb);
+	sample = I_sample(stream->l_ptr, nb);
 
 	for (ch = 0; ch < nch; ++ch) {
 	  frame->sbsample[ch][s][sb] =
@@ -278,7 +278,7 @@
  * DESCRIPTION:	decode three requantized Layer II samples from a bitstream
  */
 static
-void II_samples(struct mad_bitptr *ptr,
+void II_samples(struct mad_bit_w_lenptr *ptr,
 		struct quantclass const *quantclass,
 		mad_fixed_t output[3])
 {
@@ -288,7 +288,7 @@
     unsigned int c, nlevels;
 
     /* degrouping */
-    c = mad_bit_read(ptr, quantclass->bits);
+    c = mad_bit_w_len_read(ptr, quantclass->bits);
     nlevels = quantclass->nlevels;
 
     for (s = 0; s < 3; ++s) {
@@ -300,7 +300,7 @@
     nb = quantclass->bits;
 
     for (s = 0; s < 3; ++s)
-      sample[s] = mad_bit_read(ptr, nb);
+      sample[s] = mad_bit_w_len_read(ptr, nb);
   }
 
   for (s = 0; s < 3; ++s) {
@@ -331,7 +331,7 @@
 int mad_layer_II(struct mad_stream *stream, struct mad_frame *frame)
 {
   struct mad_header *header = &frame->header;
-  struct mad_bitptr start;
+  struct mad_bit_w_lenptr start;
   unsigned int index, sblimit, nbal, nch, bound, gr, ch, s, sb;
   unsigned char const *offsets;
   unsigned char allocation[2][32], scfsi[2][32], scalefactor[2][32][3];
@@ -395,7 +395,7 @@
   if (bound > sblimit)
     bound = sblimit;
 
-  start = stream->ptr;
+  start = *stream->l_ptr;
 
   /* decode bit allocations */
 
@@ -403,14 +403,14 @@
     nbal = bitalloc_table[offsets[sb]].nbal;
 
     for (ch = 0; ch < nch; ++ch)
-      allocation[ch][sb] = mad_bit_read(&stream->ptr, nbal);
+      allocation[ch][sb] = mad_bit_w_len_read(stream->l_ptr, nbal);
   }
 
   for (sb = bound; sb < sblimit; ++sb) {
     nbal = bitalloc_table[offsets[sb]].nbal;
 
     allocation[0][sb] =
-    allocation[1][sb] = mad_bit_read(&stream->ptr, nbal);
+    allocation[1][sb] = mad_bit_w_len_read(stream->l_ptr, nbal);
   }
 
   /* decode scalefactor selection info */
@@ -418,7 +418,7 @@
   for (sb = 0; sb < sblimit; ++sb) {
     for (ch = 0; ch < nch; ++ch) {
       if (allocation[ch][sb])
-	scfsi[ch][sb] = mad_bit_read(&stream->ptr, 2);
+	scfsi[ch][sb] = mad_bit_w_len_read(stream->l_ptr, 2);
     }
   }
 
@@ -426,7 +426,7 @@
 
   if (header->flags & MAD_FLAG_PROTECTION) {
     header->crc_check =
-      mad_bit_crc(start, mad_bit_length(&start, &stream->ptr),
+      mad_bit_w_len_crc(start, mad_bit_w_len_length(&start, stream->l_ptr),
 		  header->crc_check);
 
     if (header->crc_check != header->crc_target &&
@@ -441,7 +441,7 @@
   for (sb = 0; sb < sblimit; ++sb) {
     for (ch = 0; ch < nch; ++ch) {
       if (allocation[ch][sb]) {
-	scalefactor[ch][sb][0] = mad_bit_read(&stream->ptr, 6);
+	scalefactor[ch][sb][0] = mad_bit_w_len_read(stream->l_ptr, 6);
 
 	switch (scfsi[ch][sb]) {
 	case 2:
@@ -451,12 +451,12 @@
 	  break;
 
 	case 0:
-	  scalefactor[ch][sb][1] = mad_bit_read(&stream->ptr, 6);
+	  scalefactor[ch][sb][1] = mad_bit_w_len_read(stream->l_ptr, 6);
 	  /* fall through */
 
 	case 1:
 	case 3:
-	  scalefactor[ch][sb][2] = mad_bit_read(&stream->ptr, 6);
+	  scalefactor[ch][sb][2] = mad_bit_w_len_read(stream->l_ptr, 6);
 	}
 
 	if (scfsi[ch][sb] & 1)
@@ -487,7 +487,7 @@
 	if ((index = allocation[ch][sb])) {
 	  index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
 
-	  II_samples(&stream->ptr, &qc_table[index], samples);
+	  II_samples(stream->l_ptr, &qc_table[index], samples);
 
 	  for (s = 0; s < 3; ++s) {
 	    frame->sbsample[ch][3 * gr + s][sb] =
@@ -505,7 +505,7 @@
       if ((index = allocation[0][sb])) {
 	index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
 
-	II_samples(&stream->ptr, &qc_table[index], samples);
+	II_samples(stream->l_ptr, &qc_table[index], samples);
 
 	for (ch = 0; ch < nch; ++ch) {
 	  for (s = 0; s < 3; ++s) {
--- libmad-0.15.1b/layer3.c.mp3-crash	2004-01-23 11:41:32.000000000 +0200
+++ libmad-0.15.1b/layer3.c	2016-06-24 21:47:38.732671821 +0300
@@ -505,7 +505,7 @@
  * DESCRIPTION:	decode frame side information from a bitstream
  */
 static
-enum mad_error III_sideinfo(struct mad_bitptr *ptr, unsigned int nch,
+enum mad_error III_sideinfo(struct mad_bit_w_lenptr *ptr, unsigned int nch,
 			    int lsf, struct sideinfo *si,
 			    unsigned int *data_bitlen,
 			    unsigned int *priv_bitlen)
@@ -516,15 +516,15 @@
   *data_bitlen = 0;
   *priv_bitlen = lsf ? ((nch == 1) ? 1 : 2) : ((nch == 1) ? 5 : 3);
 
-  si->main_data_begin = mad_bit_read(ptr, lsf ? 8 : 9);
-  si->private_bits    = mad_bit_read(ptr, *priv_bitlen);
+  si->main_data_begin = mad_bit_w_len_read(ptr, lsf ? 8 : 9);
+  si->private_bits    = mad_bit_w_len_read(ptr, *priv_bitlen);
 
   ngr = 1;
   if (!lsf) {
     ngr = 2;
 
     for (ch = 0; ch < nch; ++ch)
-      si->scfsi[ch] = mad_bit_read(ptr, 4);
+      si->scfsi[ch] = mad_bit_w_len_read(ptr, 4);
   }
 
   for (gr = 0; gr < ngr; ++gr) {
@@ -533,10 +533,10 @@
     for (ch = 0; ch < nch; ++ch) {
       struct channel *channel = &granule->ch[ch];
 
-      channel->part2_3_length    = mad_bit_read(ptr, 12);
-      channel->big_values        = mad_bit_read(ptr, 9);
-      channel->global_gain       = mad_bit_read(ptr, 8);
-      channel->scalefac_compress = mad_bit_read(ptr, lsf ? 9 : 4);
+      channel->part2_3_length    = mad_bit_w_len_read(ptr, 12);
+      channel->big_values        = mad_bit_w_len_read(ptr, 9);
+      channel->global_gain       = mad_bit_w_len_read(ptr, 8);
+      channel->scalefac_compress = mad_bit_w_len_read(ptr, lsf ? 9 : 4);
 
       *data_bitlen += channel->part2_3_length;
 
@@ -546,8 +546,8 @@
       channel->flags = 0;
 
       /* window_switching_flag */
-      if (mad_bit_read(ptr, 1)) {
-	channel->block_type = mad_bit_read(ptr, 2);
+      if (mad_bit_w_len_read(ptr, 1)) {
+	channel->block_type = mad_bit_w_len_read(ptr, 2);
 
 	if (channel->block_type == 0 && result == 0)
 	  result = MAD_ERROR_BADBLOCKTYPE;
@@ -558,33 +558,33 @@
 	channel->region0_count = 7;
 	channel->region1_count = 36;
 
-	if (mad_bit_read(ptr, 1))
+	if (mad_bit_w_len_read(ptr, 1))
 	  channel->flags |= mixed_block_flag;
 	else if (channel->block_type == 2)
 	  channel->region0_count = 8;
 
 	for (i = 0; i < 2; ++i)
-	  channel->table_select[i] = mad_bit_read(ptr, 5);
+	  channel->table_select[i] = mad_bit_w_len_read(ptr, 5);
 
 # if defined(DEBUG)
 	channel->table_select[2] = 4;  /* not used */
 # endif
 
 	for (i = 0; i < 3; ++i)
-	  channel->subblock_gain[i] = mad_bit_read(ptr, 3);
+	  channel->subblock_gain[i] = mad_bit_w_len_read(ptr, 3);
       }
       else {
 	channel->block_type = 0;
 
 	for (i = 0; i < 3; ++i)
-	  channel->table_select[i] = mad_bit_read(ptr, 5);
+	  channel->table_select[i] = mad_bit_w_len_read(ptr, 5);
 
-	channel->region0_count = mad_bit_read(ptr, 4);
-	channel->region1_count = mad_bit_read(ptr, 3);
+	channel->region0_count = mad_bit_w_len_read(ptr, 4);
+	channel->region1_count = mad_bit_w_len_read(ptr, 3);
       }
 
       /* [preflag,] scalefac_scale, count1table_select */
-      channel->flags |= mad_bit_read(ptr, lsf ? 2 : 3);
+      channel->flags |= mad_bit_w_len_read(ptr, lsf ? 2 : 3);
     }
   }
 
@@ -596,11 +596,11 @@
  * DESCRIPTION:	decode channel scalefactors for LSF from a bitstream
  */
 static
-unsigned int III_scalefactors_lsf(struct mad_bitptr *ptr,
+unsigned int III_scalefactors_lsf(struct mad_bit_w_lenptr *ptr,
 				  struct channel *channel,
 				  struct channel *gr1ch, int mode_extension)
 {
-  struct mad_bitptr start;
+  struct mad_bit_w_lenptr start;
   unsigned int scalefac_compress, index, slen[4], part, n, i;
   unsigned char const *nsfb;
 
@@ -645,7 +645,7 @@
     n = 0;
     for (part = 0; part < 4; ++part) {
       for (i = 0; i < nsfb[part]; ++i)
-	channel->scalefac[n++] = mad_bit_read(ptr, slen[part]);
+	channel->scalefac[n++] = mad_bit_w_len_read(ptr, slen[part]);
     }
 
     while (n < 39)
@@ -690,7 +690,7 @@
       max = (1 << slen[part]) - 1;
 
       for (i = 0; i < nsfb[part]; ++i) {
-	is_pos = mad_bit_read(ptr, slen[part]);
+	is_pos = mad_bit_w_len_read(ptr, slen[part]);
 
 	channel->scalefac[n] = is_pos;
 	gr1ch->scalefac[n++] = (is_pos == max);
@@ -703,7 +703,7 @@
     }
   }
 
-  return mad_bit_length(&start, ptr);
+  return mad_bit_w_len_length(&start, ptr);
 }
 
 /*
@@ -711,10 +711,10 @@
  * DESCRIPTION:	decode channel scalefactors of one granule from a bitstream
  */
 static
-unsigned int III_scalefactors(struct mad_bitptr *ptr, struct channel *channel,
+unsigned int III_scalefactors(struct mad_bit_w_lenptr *ptr, struct channel *channel,
 			      struct channel const *gr0ch, unsigned int scfsi)
 {
-  struct mad_bitptr start;
+  struct mad_bit_w_lenptr start;
   unsigned int slen1, slen2, sfbi;
 
   start = *ptr;
@@ -729,11 +729,11 @@
 
     nsfb = (channel->flags & mixed_block_flag) ? 8 + 3 * 3 : 6 * 3;
     while (nsfb--)
-      channel->scalefac[sfbi++] = mad_bit_read(ptr, slen1);
+      channel->scalefac[sfbi++] = mad_bit_w_len_read(ptr, slen1);
 
     nsfb = 6 * 3;
     while (nsfb--)
-      channel->scalefac[sfbi++] = mad_bit_read(ptr, slen2);
+      channel->scalefac[sfbi++] = mad_bit_w_len_read(ptr, slen2);
 
     nsfb = 1 * 3;
     while (nsfb--)
@@ -746,7 +746,7 @@
     }
     else {
       for (sfbi = 0; sfbi < 6; ++sfbi)
-	channel->scalefac[sfbi] = mad_bit_read(ptr, slen1);
+	channel->scalefac[sfbi] = mad_bit_w_len_read(ptr, slen1);
     }
 
     if (scfsi & 0x4) {
@@ -755,7 +755,7 @@
     }
     else {
       for (sfbi = 6; sfbi < 11; ++sfbi)
-	channel->scalefac[sfbi] = mad_bit_read(ptr, slen1);
+	channel->scalefac[sfbi] = mad_bit_w_len_read(ptr, slen1);
     }
 
     if (scfsi & 0x2) {
@@ -764,7 +764,7 @@
     }
     else {
       for (sfbi = 11; sfbi < 16; ++sfbi)
-	channel->scalefac[sfbi] = mad_bit_read(ptr, slen2);
+	channel->scalefac[sfbi] = mad_bit_w_len_read(ptr, slen2);
     }
 
     if (scfsi & 0x1) {
@@ -773,13 +773,13 @@
     }
     else {
       for (sfbi = 16; sfbi < 21; ++sfbi)
-	channel->scalefac[sfbi] = mad_bit_read(ptr, slen2);
+	channel->scalefac[sfbi] = mad_bit_w_len_read(ptr, slen2);
     }
 
     channel->scalefac[21] = 0;
   }
 
-  return mad_bit_length(&start, ptr);
+  return mad_bit_w_len_length(&start, ptr);
 }
 
 /*
@@ -930,14 +930,14 @@
  * DESCRIPTION:	decode Huffman code words of one channel of one granule
  */
 static
-enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
+enum mad_error III_huffdecode(struct mad_bit_w_lenptr *ptr, mad_fixed_t xr[576],
 			      struct channel *channel,
 			      unsigned char const *sfbwidth,
 			      unsigned int part2_length)
 {
   signed int exponents[39], exp;
   signed int const *expptr;
-  struct mad_bitptr peek;
+  struct mad_bit_w_lenptr peek;
   signed int bits_left, cachesz;
   register mad_fixed_t *xrptr;
   mad_fixed_t const *sfbound;
@@ -950,13 +950,13 @@
   III_exponents(channel, sfbwidth, exponents);
 
   peek = *ptr;
-  mad_bit_skip(ptr, bits_left);
+  mad_bit_w_len_skip(ptr, bits_left);
 
   /* align bit reads to byte boundaries */
-  cachesz  = mad_bit_bitsleft(&peek);
+  cachesz  = mad_bit_w_len_bitsleft(&peek);
   cachesz += ((32 - 1 - 24) + (24 - cachesz)) & ~7;
 
-  bitcache   = mad_bit_read(&peek, cachesz);
+  bitcache   = mad_bit_w_len_read(&peek, cachesz);
   bits_left -= cachesz;
 
   xrptr = &xr[0];
@@ -1023,7 +1023,7 @@
 	unsigned int bits;
 
 	bits       = ((32 - 1 - 21) + (21 - cachesz)) & ~7;
-	bitcache   = (bitcache << bits) | mad_bit_read(&peek, bits);
+	bitcache   = (bitcache << bits) | mad_bit_w_len_read(&peek, bits);
 	cachesz   += bits;
 	bits_left -= bits;
       }
@@ -1054,7 +1054,7 @@
 
 	case 15:
 	  if (cachesz < linbits + 2) {
-	    bitcache   = (bitcache << 16) | mad_bit_read(&peek, 16);
+	    bitcache   = (bitcache << 16) | mad_bit_w_len_read(&peek, 16);
 	    cachesz   += 16;
 	    bits_left -= 16;
 	  }
@@ -1089,7 +1089,7 @@
 
 	case 15:
 	  if (cachesz < linbits + 1) {
-	    bitcache   = (bitcache << 16) | mad_bit_read(&peek, 16);
+	    bitcache   = (bitcache << 16) | mad_bit_w_len_read(&peek, 16);
 	    cachesz   += 16;
 	    bits_left -= 16;
 	  }
@@ -1173,7 +1173,7 @@
       /* hcod (1..6) */
 
       if (cachesz < 10) {
-	bitcache   = (bitcache << 16) | mad_bit_read(&peek, 16);
+	bitcache   = (bitcache << 16) | mad_bit_w_len_read(&peek, 16);
 	cachesz   += 16;
 	bits_left -= 16;
       }
@@ -2347,7 +2347,7 @@
  * DESCRIPTION:	decode frame main_data
  */
 static
-enum mad_error III_decode(struct mad_bitptr *ptr, struct mad_frame *frame,
+enum mad_error III_decode(struct mad_bit_w_lenptr *ptr, struct mad_frame *frame,
 			  struct sideinfo *si, unsigned int nch)
 {
   struct mad_header *header = &frame->header;
@@ -2519,7 +2519,7 @@
   unsigned int nch, priv_bitlen, next_md_begin = 0;
   unsigned int si_len, data_bitlen, md_len;
   unsigned int frame_space, frame_used, frame_free;
-  struct mad_bitptr ptr;
+  struct mad_bit_w_lenptr ptr;
   struct sideinfo si;
   enum mad_error error;
   int result = 0;
@@ -2548,7 +2548,7 @@
 
   /* check frame sanity */
 
-  if (stream->next_frame - mad_bit_nextbyte(&stream->ptr) <
+  if (stream->next_frame - mad_bit_w_len_nextbyte(stream->l_ptr) <
       (signed int) si_len) {
     stream->error = MAD_ERROR_BADFRAMELEN;
     stream->md_len = 0;
@@ -2559,7 +2559,7 @@
 
   if (header->flags & MAD_FLAG_PROTECTION) {
     header->crc_check =
-      mad_bit_crc(stream->ptr, si_len * CHAR_BIT, header->crc_check);
+      mad_bit_w_len_crc(*stream->l_ptr, si_len * CHAR_BIT, header->crc_check);
 
     if (header->crc_check != header->crc_target &&
 	!(frame->options & MAD_OPTION_IGNORECRC)) {
@@ -2570,7 +2570,7 @@
 
   /* decode frame side information */
 
-  error = III_sideinfo(&stream->ptr, nch, header->flags & MAD_FLAG_LSF_EXT,
+  error = III_sideinfo(stream->l_ptr, nch, header->flags & MAD_FLAG_LSF_EXT,
 		       &si, &data_bitlen, &priv_bitlen);
   if (error && result == 0) {
     stream->error = error;
@@ -2583,26 +2583,26 @@
   /* find main_data of next frame */
 
   {
-    struct mad_bitptr peek;
+    struct mad_bit_w_lenptr peek;
     unsigned long header;
 
-    mad_bit_init(&peek, stream->next_frame);
+    mad_bit_w_len_init(&peek, stream->next_frame, stream->bufend - stream->next_frame);
 
-    header = mad_bit_read(&peek, 32);
+    header = mad_bit_w_len_read(&peek, 32);
     if ((header & 0xffe60000L) /* syncword | layer */ == 0xffe20000L) {
       if (!(header & 0x00010000L))  /* protection_bit */
-	mad_bit_skip(&peek, 16);  /* crc_check */
+	mad_bit_w_len_skip(&peek, 16);  /* crc_check */
 
       next_md_begin =
-	mad_bit_read(&peek, (header & 0x00080000L) /* ID */ ? 9 : 8);
+	mad_bit_w_len_read(&peek, (header & 0x00080000L) /* ID */ ? 9 : 8);
     }
 
-    mad_bit_finish(&peek);
+    mad_bit_w_len_finish(&peek);
   }
 
   /* find main_data of this frame */
 
-  frame_space = stream->next_frame - mad_bit_nextbyte(&stream->ptr);
+  frame_space = stream->next_frame - mad_bit_w_len_nextbyte(stream->l_ptr);
 
   if (next_md_begin > si.main_data_begin + frame_space)
     next_md_begin = 0;
@@ -2612,7 +2612,7 @@
   frame_used = 0;
 
   if (si.main_data_begin == 0) {
-    ptr = stream->ptr;
+    ptr = *stream->l_ptr;
     stream->md_len = 0;
 
     frame_used = md_len;
@@ -2625,15 +2625,15 @@
       }
     }
     else {
-      mad_bit_init(&ptr,
-		   *stream->main_data + stream->md_len - si.main_data_begin);
+      unsigned char * start = *stream->main_data + stream->md_len - si.main_data_begin;
+      mad_bit_w_len_init(&ptr, start, stream->bufend - start);
 
       if (md_len > si.main_data_begin) {
 	assert(stream->md_len + md_len -
 	       si.main_data_begin <= MAD_BUFFER_MDLEN);
 
 	memcpy(*stream->main_data + stream->md_len,
-	       mad_bit_nextbyte(&stream->ptr),
+	       mad_bit_w_len_nextbyte(stream->l_ptr),
 	       frame_used = md_len - si.main_data_begin);
 	stream->md_len += frame_used;
       }
@@ -2653,7 +2653,7 @@
 
     /* designate ancillary bits */
 
-    stream->anc_ptr    = ptr;
+    *(stream->l_anc_ptr)    = ptr;
     stream->anc_bitlen = md_len * CHAR_BIT - data_bitlen;
   }
 
--- libmad-0.15.1b/stream.c.mp3-crash	2004-02-05 11:02:39.000000000 +0200
+++ libmad-0.15.1b/stream.c	2016-06-24 21:47:38.732671821 +0300
@@ -45,9 +45,11 @@
 
   stream->this_frame = 0;
   stream->next_frame = 0;
-  mad_bit_init(&stream->ptr, 0);
+  stream->l_ptr = malloc(sizeof(*(stream->l_ptr)));
+  stream->l_anc_ptr = malloc(sizeof(*(stream->l_anc_ptr)));
+  mad_bit_w_len_init(stream->l_ptr, 0, 0);
 
-  mad_bit_init(&stream->anc_ptr, 0);
+  mad_bit_w_len_init(stream->l_anc_ptr, 0, 0);
   stream->anc_bitlen = 0;
 
   stream->main_data  = 0;
@@ -68,8 +70,15 @@
     stream->main_data = 0;
   }
 
-  mad_bit_finish(&stream->anc_ptr);
-  mad_bit_finish(&stream->ptr);
+  mad_bit_w_len_finish(stream->l_anc_ptr);
+  mad_bit_w_len_finish(stream->l_ptr);
+  free(stream->l_ptr);
+  
+  if (stream->l_ptr != stream->l_anc_ptr)
+    free(stream->l_anc_ptr);
+  
+  stream->l_anc_ptr = NULL;
+  stream->l_ptr = NULL;
 }
 
 /*
@@ -87,7 +96,7 @@
 
   stream->sync = 1;
 
-  mad_bit_init(&stream->ptr, buffer);
+  mad_bit_w_len_init(stream->l_ptr, buffer, length);
 }
 
 /*
@@ -107,7 +116,7 @@
 {
   register unsigned char const *ptr, *end;
 
-  ptr = mad_bit_nextbyte(&stream->ptr);
+  ptr = mad_bit_w_len_nextbyte(stream->l_ptr);
   end = stream->bufend;
 
   while (ptr < end - 1 &&
@@ -117,7 +126,7 @@
   if (end - ptr < MAD_BUFFER_GUARD)
     return -1;
 
-  mad_bit_init(&stream->ptr, ptr);
+  mad_bit_w_len_init(stream->l_ptr, ptr, stream->bufend - stream->buffer);
 
   return 0;
 }
--- libmad-0.15.1b/stream.h.mp3-crash	2004-02-05 11:02:39.000000000 +0200
+++ libmad-0.15.1b/stream.h	2016-06-24 21:47:38.732671821 +0300
@@ -68,9 +68,17 @@
 
   unsigned char const *this_frame;	/* start of current frame */
   unsigned char const *next_frame;	/* start of next frame */
+  union
+  {
   struct mad_bitptr ptr;		/* current processing bit pointer */
+  struct mad_bit_w_lenptr * l_ptr;
+  };
 
+  union
+  {
   struct mad_bitptr anc_ptr;		/* ancillary bits pointer */
+  struct mad_bit_w_lenptr * l_anc_ptr;		/* ancillary bits pointer */
+  };
   unsigned int anc_bitlen;		/* number of ancillary bits */
 
   unsigned char (*main_data)[MAD_BUFFER_MDLEN];