diff --git a/common/mp4ff/mp4atom.c b/common/mp4ff/mp4atom.c
index c735c2a..e88ffb4 100644
--- a/common/mp4ff/mp4atom.c
+++ b/common/mp4ff/mp4atom.c
@@ -258,6 +258,9 @@ uint64_t mp4ff_atom_read_header(mp4ff_t *f, uint8_t *atom_type, uint8_t *header_
 
 static int32_t mp4ff_read_stsz(mp4ff_t *f)
 {
+    if (f->total_tracks == 0)
+        return f->error++;
+
     mp4ff_read_char(f); /* version */
     mp4ff_read_int24(f); /* flags */
     f->track[f->total_tracks - 1]->stsz_sample_size = mp4ff_read_int32(f);
@@ -269,7 +272,10 @@ static int32_t mp4ff_read_stsz(mp4ff_t *f)
         f->track[f->total_tracks - 1]->stsz_table =
             (int32_t*)malloc(f->track[f->total_tracks - 1]->stsz_sample_count*sizeof(int32_t));
 
-        for (i = 0; i < f->track[f->total_tracks - 1]->stsz_sample_count; i++)
+        if (!f->track[f->total_tracks - 1]->stsz_table)
+            return f->error++;
+
+        for (i = 0; i < f->track[f->total_tracks - 1]->stsz_sample_count && !f->stream->read_error; i++)
         {
             f->track[f->total_tracks - 1]->stsz_table[i] = mp4ff_read_int32(f);
         }
@@ -283,6 +289,9 @@ static int32_t mp4ff_read_esds(mp4ff_t *f)
     uint8_t tag;
     uint32_t temp;
 
+    if (f->total_tracks == 0)
+        return f->error++;
+
     mp4ff_read_char(f); /* version */
     mp4ff_read_int24(f); /* flags */
 
@@ -347,6 +356,9 @@ static int32_t mp4ff_read_mp4a(mp4ff_t *f)
     uint8_t atom_type = 0;
     uint8_t header_size = 0;
 
+    if (f->total_tracks == 0)
+        return f->error++;
+
     for (i = 0; i < 6; i++)
     {
         mp4ff_read_char(f); /* reserved */
@@ -380,12 +392,16 @@ static int32_t mp4ff_read_stsd(mp4ff_t *f)
     int32_t i;
     uint8_t header_size = 0;
 
+    /* CVE-2017-9218 */
+    if (f->total_tracks == 0)
+        return f->error++;
+
     mp4ff_read_char(f); /* version */
     mp4ff_read_int24(f); /* flags */
 
     f->track[f->total_tracks - 1]->stsd_entry_count = mp4ff_read_int32(f);
 
-    for (i = 0; i < f->track[f->total_tracks - 1]->stsd_entry_count; i++)
+    for (i = 0; i < f->track[f->total_tracks - 1]->stsd_entry_count && !f->stream->read_error; i++) /* CVE-2017-9253 */
     {
         uint64_t skip = mp4ff_position(f);
         uint64_t size;
@@ -415,6 +431,9 @@ static int32_t mp4ff_read_stsc(mp4ff_t *f)
 {
     int32_t i;
 
+    if (f->total_tracks == 0)
+        return f->error++;
+
     mp4ff_read_char(f); /* version */
     mp4ff_read_int24(f); /* flags */
     f->track[f->total_tracks - 1]->stsc_entry_count = mp4ff_read_int32(f);
@@ -426,7 +445,27 @@ static int32_t mp4ff_read_stsc(mp4ff_t *f)
     f->track[f->total_tracks - 1]->stsc_sample_desc_index =
         (int32_t*)malloc(f->track[f->total_tracks - 1]->stsc_entry_count*sizeof(int32_t));
 
-    for (i = 0; i < f->track[f->total_tracks - 1]->stsc_entry_count; i++)
+    /* CVE-2017-9219 */
+    if (!f->track[f->total_tracks - 1]->stsc_first_chunk)
+    {
+        return f->error++;
+    }
+    if (!f->track[f->total_tracks - 1]->stsc_samples_per_chunk)
+    {
+        free(f->track[f->total_tracks - 1]->stsc_first_chunk);
+        f->track[f->total_tracks - 1]->stsc_first_chunk = NULL;
+        return f->error++;
+    }
+    if (!f->track[f->total_tracks - 1]->stsc_sample_desc_index)
+    {
+        free(f->track[f->total_tracks - 1]->stsc_first_chunk);
+        f->track[f->total_tracks - 1]->stsc_first_chunk = NULL;
+        free(f->track[f->total_tracks - 1]->stsc_samples_per_chunk);
+        f->track[f->total_tracks - 1]->stsc_samples_per_chunk = NULL;
+        return f->error++;
+    }
+
+    for (i = 0; i < f->track[f->total_tracks - 1]->stsc_entry_count && !f->stream->read_error; i++) /* CVE-2017-9255 */
     {
         f->track[f->total_tracks - 1]->stsc_first_chunk[i] = mp4ff_read_int32(f);
         f->track[f->total_tracks - 1]->stsc_samples_per_chunk[i] = mp4ff_read_int32(f);
@@ -440,6 +479,9 @@ static int32_t mp4ff_read_stco(mp4ff_t *f)
 {
     int32_t i;
 
+    if (f->total_tracks == 0)
+        return f->error++;
+
     mp4ff_read_char(f); /* version */
     mp4ff_read_int24(f); /* flags */
     f->track[f->total_tracks - 1]->stco_entry_count = mp4ff_read_int32(f);
@@ -447,7 +489,11 @@ static int32_t mp4ff_read_stco(mp4ff_t *f)
     f->track[f->total_tracks - 1]->stco_chunk_offset =
         (int32_t*)malloc(f->track[f->total_tracks - 1]->stco_entry_count*sizeof(int32_t));
 
-    for (i = 0; i < f->track[f->total_tracks - 1]->stco_entry_count; i++)
+    /* CVE-2017-9220 */
+    if (!f->track[f->total_tracks - 1]->stco_chunk_offset)
+        return f->error++;
+
+    for (i = 0; i < f->track[f->total_tracks - 1]->stco_entry_count && !f->stream->read_error; i++) /* CVE-2017-9256 */
     {
         f->track[f->total_tracks - 1]->stco_chunk_offset[i] = mp4ff_read_int32(f);
     }
@@ -458,8 +504,12 @@ static int32_t mp4ff_read_stco(mp4ff_t *f)
 static int32_t mp4ff_read_ctts(mp4ff_t *f)
 {
     int32_t i;
-    mp4ff_track_t * p_track = f->track[f->total_tracks - 1];
+    mp4ff_track_t * p_track;
 
+    if (f->total_tracks == 0)
+        return f->error++;
+
+    p_track = f->track[f->total_tracks - 1];
     if (p_track->ctts_entry_count) return 0;
 
     mp4ff_read_char(f); /* version */
@@ -478,7 +528,7 @@ static int32_t mp4ff_read_ctts(mp4ff_t *f)
     }
     else
     {
-        for (i = 0; i < f->track[f->total_tracks - 1]->ctts_entry_count; i++)
+        for (i = 0; i < f->track[f->total_tracks - 1]->ctts_entry_count && !f->stream->read_error; i++) /* CVE-2017-9257 */
         {
             p_track->ctts_sample_count[i] = mp4ff_read_int32(f);
             p_track->ctts_sample_offset[i] = mp4ff_read_int32(f);
@@ -490,7 +540,13 @@ static int32_t mp4ff_read_ctts(mp4ff_t *f)
 static int32_t mp4ff_read_stts(mp4ff_t *f)
 {
     int32_t i;
-    mp4ff_track_t * p_track = f->track[f->total_tracks - 1];
+    mp4ff_track_t * p_track;
+
+    /* CVE-2017-9223 */
+    if (f->total_tracks == 0)
+        return f->error++;
+
+    p_track = f->track[f->total_tracks - 1];
 
     if (p_track->stts_entry_count) return 0;
 
@@ -510,7 +566,7 @@ static int32_t mp4ff_read_stts(mp4ff_t *f)
     }
     else
     {
-        for (i = 0; i < f->track[f->total_tracks - 1]->stts_entry_count; i++)
+        for (i = 0; i < f->track[f->total_tracks - 1]->stts_entry_count && !f->stream->read_error; i++) /* CVE-2017-9254 */
         {
             p_track->stts_sample_count[i] = mp4ff_read_int32(f);
             p_track->stts_sample_delta[i] = mp4ff_read_int32(f);
@@ -597,6 +653,10 @@ static int32_t mp4ff_read_mdhd(mp4ff_t *f)
 {
     uint32_t version;
 
+    /* CVE-2017-9221 */
+    if (f->total_tracks == 0)
+        return f->error++;
+
     version = mp4ff_read_int32(f);
     if (version==1)
     {
diff --git a/common/mp4ff/mp4ff.c b/common/mp4ff/mp4ff.c
index 9181ace..761bb0d 100644
--- a/common/mp4ff/mp4ff.c
+++ b/common/mp4ff/mp4ff.c
@@ -42,6 +42,12 @@ mp4ff_t *mp4ff_open_read(mp4ff_callback_t *f)
 
     parse_atoms(ff,0);
 
+    if (ff->error)
+    {
+        free(ff);
+        ff = NULL;
+    }
+
     return ff;
 }
 
@@ -55,6 +61,12 @@ mp4ff_t *mp4ff_open_read_metaonly(mp4ff_callback_t *f)
 
     parse_atoms(ff,1);
 
+    if (ff->error)
+    {
+        free(ff);
+        ff = NULL;
+    }
+
     return ff;
 }
 
@@ -101,10 +113,17 @@ void mp4ff_close(mp4ff_t *ff)
     if (ff) free(ff);
 }
 
-void mp4ff_track_add(mp4ff_t *f)
+static void mp4ff_track_add(mp4ff_t *f)
 {
     f->total_tracks++;
 
+    if (f->total_tracks > MAX_TRACKS)
+    {
+        f->total_tracks = 0;
+        f->error++;
+        return;
+    }
+
     f->track[f->total_tracks - 1] = malloc(sizeof(mp4ff_track_t));
 
     memset(f->track[f->total_tracks - 1], 0, sizeof(mp4ff_track_t));
@@ -185,6 +204,7 @@ int32_t parse_atoms(mp4ff_t *f,int meta_only)
     uint8_t header_size = 0;
 
     f->file_size = 0;
+    f->stream->read_error = 0;
 
     while ((size = mp4ff_atom_read_header(f, &atom_type, &header_size)) != 0)
     {
diff --git a/common/mp4ff/mp4ffint.h b/common/mp4ff/mp4ffint.h
index 8c5455c..1757044 100644
--- a/common/mp4ff/mp4ffint.h
+++ b/common/mp4ff/mp4ffint.h
@@ -144,6 +144,7 @@ typedef struct
     uint32_t (*seek)(void *user_data, uint64_t position);
     uint32_t (*truncate)(void *user_data);
     void *user_data;
+    uint32_t read_error;
 } mp4ff_callback_t;
 
 
@@ -223,6 +224,7 @@ typedef struct
     uint64_t moov_size;
     uint8_t last_atom;
     uint64_t file_size;
+    uint32_t error;
 
     /* mvhd */
     int32_t time_scale;
diff --git a/common/mp4ff/mp4meta.c b/common/mp4ff/mp4meta.c
index def2149..54117f5 100644
--- a/common/mp4ff/mp4meta.c
+++ b/common/mp4ff/mp4meta.c
@@ -240,7 +240,7 @@ static int32_t mp4ff_parse_tag(mp4ff_t *f, const uint8_t parent_atom_type, const
     uint32_t len = 0;
 
 
-    while (sumsize < size)
+    while (sumsize < size && !f->stream->read_error) /* CVE-2017-9222 */
     {
 		uint64_t destpos;
         subsize = mp4ff_atom_read_header(f, &atom_type, &header_size);
@@ -500,4 +500,4 @@ int32_t mp4ff_meta_get_coverart(const mp4ff_t *f, char **value)
     return mp4ff_meta_find_by_name_and_return_len(f, "cover", value);
 }
 
-#endif
\ No newline at end of file
+#endif
diff --git a/common/mp4ff/mp4util.c b/common/mp4ff/mp4util.c
index 24d89c7..75a1620 100644
--- a/common/mp4ff/mp4util.c
+++ b/common/mp4ff/mp4util.c
@@ -37,6 +37,9 @@ int32_t mp4ff_read_data(mp4ff_t *f, int8_t *data, uint32_t size)
 
     result = f->stream->read(f->stream->user_data, data, size);
 
+    if (result < size)
+        f->stream->read_error++;
+
     f->current_position += size;
 
     return result;