fix ts audio bug, aac adts header and PES_packet_length fixed

@@ -1941,6 +1941,10 @@ public:
 		layer = (syncword >> 1) & 0x03;
 		ID = (syncword >> 3) & 0x01;
 		syncword = (syncword >> 4) & 0x0FFF;
+		if (syncword != 0xfff) {
+			trace("ts+aac invalid sync word. expect 0xfff, actual %#x", syncword);
+			return -1;
+		}
 
 		// adts_variable_header
 		int64_t temp = 0;
@@ -2228,7 +2232,7 @@ int main(int argc, char** argv)
 	        
 	        if ((ret = consume(msg, &aac_muxer)) != 0) {
 	            trace("demuxer+consume parse and consume message failed. ret=%d", ret);
-	            break;
+	            return -1;
 	        }
 	        
 	        srs_freep(msg);

@@ -560,6 +560,9 @@ int SrsTSMuxer::write_audio(u_int32_t time, SrsCodec* codec, SrsCodecSample* sam
 			return ret;
 		}
 		
+		// the frame length is the AAC raw data plus the adts header size.
+		int32_t frame_length = size + 7;
+		
 		// AAC-ADTS
 		// 6.2 Audio Data Transport Stream, ADTS
 		// in aac-iso-13818-7.pdf, page 26.
@@ -593,12 +596,14 @@ int SrsTSMuxer::write_audio(u_int32_t time, SrsCodec* codec, SrsCodecSample* sam
 		// sampling_frequency_index 4bits
 		adts_header[2] |= (codec->aac_sample_rate << 2) & 0x3c;
 		// channel_configuration 3bits
-		adts_header[2] |= (codec->aac_channels >> 1) & 0x01;
-		adts_header[3] = (codec->aac_channels << 5) & 0xc0;
+		adts_header[2] |= (codec->aac_channels >> 2) & 0x01;
+		adts_header[3] = (codec->aac_channels << 6) & 0xc0;
 		// frame_length 13bits
-		adts_header[3] |= (size >> 11) & 0x03;
-		adts_header[4] = (size >> 3) & 0xff;
-		adts_header[5] = (size << 5) & 0xcf;
+		adts_header[3] |= (frame_length >> 11) & 0x03;
+		adts_header[4] = (frame_length >> 3) & 0xff;
+		adts_header[5] = ((frame_length << 5) & 0xe0);
+		// adts_buffer_fullness; //11bits
+		adts_header[5] |= 0x1f;
 
 		// copy to audio buffer
 		audio_buffer->append(adts_header, sizeof(adts_header));