diff --git a/trunk/src/kernel/srs_kernel_buffer.cpp b/trunk/src/kernel/srs_kernel_buffer.cpp
index 0f0b9e1dc..e6fcfe1fa 100644
--- a/trunk/src/kernel/srs_kernel_buffer.cpp
+++ b/trunk/src/kernel/srs_kernel_buffer.cpp
@@ -94,6 +94,8 @@ bool SrsBuffer::require(int required_size)
 void SrsBuffer::skip(int size)
 {
     srs_assert(p);
+    srs_assert(p + size >= bytes);
+    srs_assert(p + size <= bytes + nb_bytes);
     
     p += size;
 }
diff --git a/trunk/src/kernel/srs_kernel_mp4.cpp b/trunk/src/kernel/srs_kernel_mp4.cpp
index ce7a36a25..8f19b2cb8 100644
--- a/trunk/src/kernel/srs_kernel_mp4.cpp
+++ b/trunk/src/kernel/srs_kernel_mp4.cpp
@@ -2599,11 +2599,6 @@ SrsMp4DataEntryUrlBox::~SrsMp4DataEntryUrlBox()
 
 int SrsMp4DataEntryUrlBox::nb_header()
 {
-    // a 24-bit integer with flags; one flag is defined (x000001) which means that the media
-    // data is in the same file as the Movie Box containing this data reference.
-    if (location.empty()) {
-        return SrsMp4FullBox::nb_header();
-    }
     return SrsMp4FullBox::nb_header()+srs_mp4_string_length(location);
 }
 
@@ -2621,9 +2616,7 @@ srs_error_t SrsMp4DataEntryUrlBox::encode_header(SrsBuffer* buf)
         return srs_error_wrap(err, "encode header");
     }
 
-    if (!location.empty()) {
-        srs_mp4_string_write(buf, location);
-    }
+    srs_mp4_string_write(buf, location);
 
     return err;
 }
@@ -2635,12 +2628,6 @@ srs_error_t SrsMp4DataEntryUrlBox::decode_header(SrsBuffer* buf)
     if ((err = SrsMp4FullBox::decode_header(buf)) != srs_success) {
         return srs_error_wrap(err, "decode header");
     }
-
-    // a 24-bit integer with flags; one flag is defined (x000001) which means that the media
-    // data is in the same file as the Movie Box containing this data reference.
-    if (flags == 0x01) {
-        return err;
-    }
     
     if ((err = srs_mp4_string_read(buf, location, left_space(buf))) != srs_success) {
         return srs_error_wrap(err, "url read location");
@@ -2651,7 +2638,9 @@ srs_error_t SrsMp4DataEntryUrlBox::decode_header(SrsBuffer* buf)
 
 stringstream& SrsMp4DataEntryUrlBox::dumps_detail(stringstream& ss, SrsMp4DumpContext dc)
 {
-    ss << "URL: " << location;
+    SrsMp4FullBox::dumps_detail(ss, dc);
+
+    ss << ", URL: " << location;
     if (location.empty()) {
         ss << "Same file";
     }
@@ -2707,7 +2696,9 @@ srs_error_t SrsMp4DataEntryUrnBox::decode_header(SrsBuffer* buf)
 
 stringstream& SrsMp4DataEntryUrnBox::dumps_detail(stringstream& ss, SrsMp4DumpContext dc)
 {
-    ss << "URN: " << name << ", " << location;
+    SrsMp4FullBox::dumps_detail(ss, dc);
+
+    ss << ", URN: " << name << ", " << location;
     return ss;
 }
 
diff --git a/trunk/src/kernel/srs_kernel_ts.cpp b/trunk/src/kernel/srs_kernel_ts.cpp
index 81328dd8d..1c3b92edf 100644
--- a/trunk/src/kernel/srs_kernel_ts.cpp
+++ b/trunk/src/kernel/srs_kernel_ts.cpp
@@ -620,7 +620,7 @@ srs_error_t SrsTsPacket::decode(SrsBuffer* stream, SrsTsMessage** ppmsg)
                 payload = new SrsTsPayloadPES(this);
             } else {
                 // left bytes as reserved.
-                stream->skip(nb_payload);
+                stream->skip(srs_min(stream->left(), nb_payload));
             }
         }
         
diff --git a/trunk/src/utest/srs_utest_mp4.cpp b/trunk/src/utest/srs_utest_mp4.cpp
index 12e87a1f1..d1ebdf34f 100644
--- a/trunk/src/utest/srs_utest_mp4.cpp
+++ b/trunk/src/utest/srs_utest_mp4.cpp
@@ -388,9 +388,9 @@ VOID TEST(KernelMp4Test, UUIDBoxDecode)
     if (true) {
         uint8_t data[24];
         SrsBuffer b((char*)data, sizeof(data));
-        b.write_4bytes(8); b.write_4bytes(SrsMp4BoxTypeUUID); b.skip(-24);
+        b.write_4bytes(8); b.write_4bytes(SrsMp4BoxTypeUUID); b.skip(-8);
         SrsMp4Box box;
-        HELPER_ASSERT_FAILED(box.decode(&b));
+        HELPER_EXPECT_SUCCESS(box.decode(&b));
     }
 
     if (true) {