diff --git a/doc/html/format.html b/doc/html/format.html
index 908eab5c..de993e1f 100644
--- a/doc/html/format.html
+++ b/doc/html/format.html
@@ -399,7 +399,10 @@
 					<TT>5</TT> : CUESHEET
 				</LI>
 				<LI>
-					<TT>6-127</TT> : reserved
+					<TT>6-126</TT> : reserved
+				</LI>
+				<LI>
+					<TT>127</TT> : invalid, to avoid confusion with a frame sync code
 				</LI>
 				</UL>
 			</TD>
diff --git a/include/FLAC/format.h b/include/FLAC/format.h
index 77597575..e003c34f 100644
--- a/include/FLAC/format.h
+++ b/include/FLAC/format.h
@@ -88,6 +88,9 @@ extern "C" {
 	format specification.  There is nothing to tune here.
 */
 
+/** The largest legal metadata type code. */
+#define FLAC__MAX_METADATA_TYPE_CODE (126u)
+
 /** The minimum block size, in samples, permitted by the format. */
 #define FLAC__MIN_BLOCK_SIZE (16u)
 
diff --git a/include/FLAC/metadata.h b/include/FLAC/metadata.h
index 7465f307..d17d1658 100644
--- a/include/FLAC/metadata.h
+++ b/include/FLAC/metadata.h
@@ -1084,7 +1084,8 @@ FLAC_API FLAC__bool FLAC__metadata_iterator_insert_block_after(FLAC__Metadata_It
  *
  * \param type  Type of object to create
  * \retval FLAC__StreamMetadata*
- *    \c NULL if there was an error allocating memory, else the new instance.
+ *    \c NULL if there was an error allocating memory or the type code is
+ *    greater than FLAC__MAX_METADATA_TYPE_CODE, else the new instance.
  */
 FLAC_API FLAC__StreamMetadata *FLAC__metadata_object_new(FLAC__MetadataType type);
 
diff --git a/src/libFLAC/metadata_object.c b/src/libFLAC/metadata_object.c
index 074611b8..1e718ef4 100644
--- a/src/libFLAC/metadata_object.c
+++ b/src/libFLAC/metadata_object.c
@@ -334,7 +334,12 @@ static FLAC__bool cuesheet_set_track_(FLAC__StreamMetadata *object, FLAC__Stream
 
 FLAC_API FLAC__StreamMetadata *FLAC__metadata_object_new(FLAC__MetadataType type)
 {
-	FLAC__StreamMetadata *object = (FLAC__StreamMetadata*)calloc(1, sizeof(FLAC__StreamMetadata));
+	FLAC__StreamMetadata *object;
+
+	if(type > FLAC__MAX_METADATA_TYPE_CODE)
+		return 0;
+
+	object = (FLAC__StreamMetadata*)calloc(1, sizeof(FLAC__StreamMetadata));
 	if(0 != object) {
 		object->is_last = false;
 		object->type = type;
diff --git a/src/libFLAC/stream_decoder.c b/src/libFLAC/stream_decoder.c
index 4b6f6e2e..4369d6de 100644
--- a/src/libFLAC/stream_decoder.c
+++ b/src/libFLAC/stream_decoder.c
@@ -402,9 +402,9 @@ FLAC_API FLAC__bool FLAC__stream_decoder_set_metadata_respond(FLAC__StreamDecode
 	FLAC__ASSERT(0 != decoder);
 	FLAC__ASSERT(0 != decoder->private_);
 	FLAC__ASSERT(0 != decoder->protected_);
-	FLAC__ASSERT((unsigned)type < (1u << FLAC__STREAM_METADATA_TYPE_LEN));
+	FLAC__ASSERT((unsigned)type <= FLAC__MAX_METADATA_TYPE_CODE);
 	/* double protection */
-	if((unsigned)type >= (1u << FLAC__STREAM_METADATA_TYPE_LEN))
+	if((unsigned)type > FLAC__MAX_METADATA_TYPE_CODE)
 		return false;
 	if(decoder->protected_->state != FLAC__STREAM_DECODER_UNINITIALIZED)
 		return false;
@@ -459,9 +459,9 @@ FLAC_API FLAC__bool FLAC__stream_decoder_set_metadata_ignore(FLAC__StreamDecoder
 	FLAC__ASSERT(0 != decoder);
 	FLAC__ASSERT(0 != decoder->private_);
 	FLAC__ASSERT(0 != decoder->protected_);
-	FLAC__ASSERT((unsigned)type < (1u << FLAC__STREAM_METADATA_TYPE_LEN));
+	FLAC__ASSERT((unsigned)type <= FLAC__MAX_METADATA_TYPE_CODE);
 	/* double protection */
-	if((unsigned)type >= (1u << FLAC__STREAM_METADATA_TYPE_LEN))
+	if((unsigned)type > FLAC__MAX_METADATA_TYPE_CODE)
 		return false;
 	if(decoder->protected_->state != FLAC__STREAM_DECODER_UNINITIALIZED)
 		return false;