diff --git a/audio_utils/include/audio_utils/spdif/SPDIFEncoder.h b/audio_utils/include/audio_utils/spdif/SPDIFEncoder.h
index 3c84d73..1a432d8 100644
--- a/audio_utils/include/audio_utils/spdif/SPDIFEncoder.h
+++ b/audio_utils/include/audio_utils/spdif/SPDIFEncoder.h
@@ -83,6 +83,7 @@
 
 protected:
     void   clearBurstBuffer();
+    bool   wouldOverflowBuffer(size_t numBytes) const; // Would this many bytes cause an overflow?
     void   writeBurstBufferShorts(const uint16_t* buffer, size_t numBytes);
     void   writeBurstBufferBytes(const uint8_t* buffer, size_t numBytes);
     void   sendZeroPad();
diff --git a/audio_utils/spdif/AC3FrameScanner.cpp b/audio_utils/spdif/AC3FrameScanner.cpp
index 6ebe9e3..3cd9d15 100644
--- a/audio_utils/spdif/AC3FrameScanner.cpp
+++ b/audio_utils/spdif/AC3FrameScanner.cpp
@@ -194,7 +194,13 @@
 
         // Frame size is explicit in EAC3. Paragraph E2.3.1.3
         uint32_t frmsiz = ((mHeaderBuffer[2] & 0x07) << 8) + mHeaderBuffer[3];
-        mFrameSizeBytes = (frmsiz + 1) * sizeof(int16_t);
+        uint32_t frameSizeBytes = (frmsiz + 1) * sizeof(int16_t);
+        if (frameSizeBytes < mHeaderLength) {
+            ALOGW("AC3 frame size = %d, less than header size = %d", frameSizeBytes, mHeaderLength);
+            android_errorWriteLog(0x534e4554, "145262423");
+            return false;
+        }
+        mFrameSizeBytes = frameSizeBytes;
 
         uint32_t numblkscod = 3; // 6 blocks default
         if (fscod == 3) {
diff --git a/audio_utils/spdif/FrameScanner.cpp b/audio_utils/spdif/FrameScanner.cpp
index 81de943..893dfca 100644
--- a/audio_utils/spdif/FrameScanner.cpp
+++ b/audio_utils/spdif/FrameScanner.cpp
@@ -36,7 +36,7 @@
  , mFormatDumpCount(0)
  , mSampleRate(0)
  , mRateMultiplier(1)
- , mFrameSizeBytes(0)
+ , mFrameSizeBytes(headerLength) // minimum
  , mDataType(dataType)
  , mDataTypeInfo(0)
 {
diff --git a/audio_utils/spdif/SPDIFEncoder.cpp b/audio_utils/spdif/SPDIFEncoder.cpp
index 250f961..8a1bf51 100644
--- a/audio_utils/spdif/SPDIFEncoder.cpp
+++ b/audio_utils/spdif/SPDIFEncoder.cpp
@@ -101,14 +101,21 @@
     return SPDIF_ENCODED_CHANNEL_COUNT * sizeof(int16_t);
 }
 
+bool SPDIFEncoder::wouldOverflowBuffer(size_t numBytes) const {
+    // Avoid numeric overflow when calculating whether the buffer would overflow.
+    return (numBytes > mBurstBufferSizeBytes)
+        || (mByteCursor > (mBurstBufferSizeBytes - numBytes));  // (max - n) won't overflow
+}
+
 void SPDIFEncoder::writeBurstBufferShorts(const uint16_t *buffer, size_t numShorts)
 {
     // avoid static analyser warning
     LOG_ALWAYS_FATAL_IF((mBurstBuffer == NULL), "mBurstBuffer never allocated");
+
     mByteCursor = (mByteCursor + 1) & ~1; // round up to even byte
     size_t bytesToWrite = numShorts * sizeof(uint16_t);
-    if ((mByteCursor + bytesToWrite) > mBurstBufferSizeBytes) {
-        ALOGE("SPDIFEncoder: Burst buffer overflow!");
+    if (wouldOverflowBuffer(bytesToWrite)) {
+        ALOGE("SPDIFEncoder::%s() Burst buffer overflow!", __func__);
         reset();
         return;
     }
@@ -126,14 +133,13 @@
 // Big and Little Endian CPUs.
 void SPDIFEncoder::writeBurstBufferBytes(const uint8_t *buffer, size_t numBytes)
 {
-    size_t bytesToWrite = numBytes;
-    if ((mByteCursor + bytesToWrite) > mBurstBufferSizeBytes) {
-        ALOGE("SPDIFEncoder: Burst buffer overflow!");
+    if (wouldOverflowBuffer(numBytes)) {
+        ALOGE("SPDIFEncoder::%s() Burst buffer overflow!", __func__);
         clearBurstBuffer();
         return;
     }
     uint16_t pad = mBurstBuffer[mByteCursor >> 1];
-    for (size_t i = 0; i < bytesToWrite; i++) {
+    for (size_t i = 0; i < numBytes; i++) {
         if (mByteCursor & 1 ) {
             pad |= *buffer++; // put second byte in LSB
             mBurstBuffer[mByteCursor >> 1] = pad;
@@ -219,9 +225,16 @@
 size_t SPDIFEncoder::startSyncFrame()
 {
     // Write start of encoded frame that was buffered in frame detector.
-    size_t syncSize = mFramer->getHeaderSizeBytes();
-    writeBurstBufferBytes(mFramer->getHeaderAddress(), syncSize);
-    return mFramer->getFrameSizeBytes() - syncSize;
+    size_t headerSize = mFramer->getHeaderSizeBytes();
+    writeBurstBufferBytes(mFramer->getHeaderAddress(), headerSize);
+    // This is provided by the encoded audio file and may be invalid.
+    size_t frameSize = mFramer->getFrameSizeBytes();
+    if (frameSize < headerSize) {
+        ALOGE("SPDIFEncoder: invalid frameSize = %zu", frameSize);
+        return 0;
+    }
+    // Calculate how many more bytes we need to complete the frame.
+    return frameSize - headerSize;
 }
 
 // Wraps raw encoded data into a data burst.
diff --git a/audio_utils/tests/Android.bp b/audio_utils/tests/Android.bp
index e104868..25357e0 100644
--- a/audio_utils/tests/Android.bp
+++ b/audio_utils/tests/Android.bp
@@ -369,3 +369,20 @@
         },
     }
 }
+
+cc_test {
+    name: "spdif_tests",
+
+    shared_libs: [
+        "libaudioutils",
+        "libaudiospdif",
+        "liblog",
+        "libcutils",
+    ],
+    srcs: ["spdif_tests.cpp"],
+    cflags: [
+        "-Werror",
+        "-Wall",
+    ],
+}
+
diff --git a/audio_utils/tests/spdif_tests.cpp b/audio_utils/tests/spdif_tests.cpp
new file mode 100644
index 0000000..96a8a16
--- /dev/null
+++ b/audio_utils/tests/spdif_tests.cpp
@@ -0,0 +1,152 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <array>
+#include <climits>
+#include <math.h>
+#include <memory>
+#include <string.h>
+
+#include <gtest/gtest.h>
+
+#include <audio_utils/spdif/SPDIFEncoder.h>
+
+using namespace android;
+
+class MySPDIFEncoder : public SPDIFEncoder {
+public:
+
+    explicit MySPDIFEncoder(audio_format_t format)
+            : SPDIFEncoder(format)
+    {
+    }
+    // Defaults to AC3 format. Was in original API.
+    MySPDIFEncoder() = default;
+
+    ssize_t writeOutput( const void* /* buffer */, size_t numBytes ) override {
+        mOutputSizeBytes = numBytes;
+        return numBytes;
+    }
+
+    FrameScanner *getFramer() const { return mFramer; }
+    size_t        getByteCursor() const { return mByteCursor; }
+    size_t        getPayloadBytesPending() const { return mPayloadBytesPending; }
+    size_t        getBurstBufferSizeBytes() const { return mBurstBufferSizeBytes; }
+
+    size_t                     mOutputSizeBytes = 0;
+};
+
+// This is the beginning of the file voice1-48k-64kbps-15s.ac3
+static const uint8_t sVoice1ch48k_AC3[] = {
+    0x0b, 0x77, 0x44, 0xcd, 0x08, 0x40, 0x2f, 0x84, 0x29, 0xca, 0x6e, 0x44, 0xa4, 0xfd, 0xce, 0xf7,
+    0xc9, 0x9f, 0x3e, 0x74, 0xfa, 0x01, 0x0a, 0xda, 0xb3, 0x3e, 0xb0, 0x95, 0xf2, 0x5a, 0xef, 0x9e
+};
+
+// This is the beginning of the file channelcheck_48k6ch.eac3
+static const uint8_t sChannel6ch48k_EAC3[] = {
+    0x0b, 0x77, 0x01, 0xbf, 0x3f, 0x85, 0x7f, 0xe8, 0x1e, 0x40, 0x82, 0x10, 0x00, 0x00, 0x00, 0x01,
+    0x00, 0x00, 0x00, 0x03, 0xfc, 0x60, 0x80, 0x7e, 0x59, 0x00, 0xfc, 0xf3, 0xcf, 0x01, 0xf9, 0xe7
+};
+
+static const uint8_t sZeros[32] = { 0 };
+
+static constexpr int kBytesPerOutputFrame = 2 * sizeof(int16_t); // stereo
+
+TEST(audio_utils_spdif, SupportedFormats)
+{
+    ASSERT_FALSE(SPDIFEncoder::isFormatSupported(AUDIO_FORMAT_PCM_FLOAT));
+    ASSERT_FALSE(SPDIFEncoder::isFormatSupported(AUDIO_FORMAT_PCM_16_BIT));
+    ASSERT_FALSE(SPDIFEncoder::isFormatSupported(AUDIO_FORMAT_MP3));
+
+    ASSERT_TRUE(SPDIFEncoder::isFormatSupported(AUDIO_FORMAT_AC3));
+    ASSERT_TRUE(SPDIFEncoder::isFormatSupported(AUDIO_FORMAT_E_AC3));
+    ASSERT_TRUE(SPDIFEncoder::isFormatSupported(AUDIO_FORMAT_DTS));
+    ASSERT_TRUE(SPDIFEncoder::isFormatSupported(AUDIO_FORMAT_DTS_HD));
+}
+
+TEST(audio_utils_spdif, ScanAC3)
+{
+    MySPDIFEncoder encoder(AUDIO_FORMAT_AC3);
+    FrameScanner *scanner = encoder.getFramer();
+    // It should recognize the valid AC3 header.
+    int i = 0;
+    while (i < 5) {
+        ASSERT_FALSE(scanner->scan(sVoice1ch48k_AC3[i++]));
+    }
+    ASSERT_TRUE(scanner->scan(sVoice1ch48k_AC3[i++]));
+    ASSERT_FALSE(scanner->scan(sVoice1ch48k_AC3[i++]));
+}
+
+TEST(audio_utils_spdif, WriteAC3)
+{
+    MySPDIFEncoder encoder(AUDIO_FORMAT_AC3);
+    encoder.write(sVoice1ch48k_AC3, sizeof(sVoice1ch48k_AC3));
+    ASSERT_EQ(48000, encoder.getFramer()->getSampleRate());
+    ASSERT_EQ(kBytesPerOutputFrame, encoder.getBytesPerOutputFrame());
+    ASSERT_EQ(1, encoder.getRateMultiplier());
+
+    // Check to make sure that the pending bytes calculation did not overflow.
+    size_t burstBufferSizeBytes = encoder.getBurstBufferSizeBytes(); // allocated maximum size
+    size_t pendingBytes = encoder.getPayloadBytesPending();
+    ASSERT_GE(burstBufferSizeBytes, pendingBytes);
+
+    // Write some fake compressed audio to force an output data burst.
+    for (int i = 0; i < 7; i++) {
+        auto result = encoder.write(sZeros, sizeof(sZeros));
+        ASSERT_EQ(sizeof(sZeros), result);
+    }
+    // This value is calculated in SPDIFEncoder::sendZeroPad()
+    //    size_t burstSize = mFramer->getSampleFramesPerSyncFrame() * sizeof(uint16_t)
+    //        * SPDIF_ENCODED_CHANNEL_COUNT;
+    // If it changes then there is probably a regression.
+    const int kExpectedBurstSize = 6144;
+    ASSERT_EQ(kExpectedBurstSize, encoder.mOutputSizeBytes);
+}
+
+TEST(audio_utils_spdif, ValidEAC3)
+{
+    MySPDIFEncoder encoder(AUDIO_FORMAT_E_AC3);
+    auto result = encoder.write(sChannel6ch48k_EAC3, sizeof(sChannel6ch48k_EAC3));
+    ASSERT_EQ(sizeof(sChannel6ch48k_EAC3), result);
+    ASSERT_EQ(4, encoder.getRateMultiplier()); // EAC3_RATE_MULTIPLIER
+    ASSERT_EQ(48000, encoder.getFramer()->getSampleRate());
+    ASSERT_EQ(kBytesPerOutputFrame, encoder.getBytesPerOutputFrame());
+
+    // Check to make sure that the pending bytes calculation did not overflow.
+    size_t bufferSize = encoder.getBurstBufferSizeBytes();
+    size_t pendingBytes = encoder.getPayloadBytesPending();
+    ASSERT_GE(bufferSize, pendingBytes);
+}
+
+TEST(audio_utils_spdif, InvalidLengthEAC3)
+{
+    MySPDIFEncoder encoder(AUDIO_FORMAT_E_AC3);
+    // Mangle a valid header and try to force a numeric overflow.
+    uint8_t mangled[sizeof(sChannel6ch48k_EAC3)] = {0};
+    memcpy(mangled, sChannel6ch48k_EAC3, sizeof(sChannel6ch48k_EAC3));
+
+    // force frmsiz to zero!
+    mangled[2] = mangled[2] & 0xF8;
+    mangled[3] = 0;
+    auto result = encoder.write(mangled, sizeof(mangled));
+    ASSERT_EQ(sizeof(mangled), result);
+
+    // Check to make sure that the pending bytes calculation did not overflow.
+    size_t bufferSize = encoder.getBurstBufferSizeBytes();
+    size_t pendingBytes = encoder.getPayloadBytesPending();
+    ASSERT_GE(bufferSize, pendingBytes);
+
+}