diff --git a/README.md b/README.md
index af84aa06fb..387fe09620 100755
--- a/README.md
+++ b/README.md
@@ -215,6 +215,7 @@ Please select your language:
 
 ### V2 changes
 
+* v2.0, 2017-05-29, Merge [#899][bug #899] to fix [#893][bug #893], ts PES ext length. 2.0.243
 * v2.0, 2017-05-01, Fix [#865][bug #865], shouldn't remove ts/m3u8 when hls_dispose disabled. 2.0.242
 * v2.0, 2017-04-30, Fix [#636][bug #636], FD leak for requesting empty HTTP stream. 2.0.241
 * v2.0, 2017-04-23, Fix [#851][bug #851], HTTP API support number of video frames for FPS. 2.0.240
@@ -1403,6 +1404,8 @@ Winlin
 [bug #851]: https://github.com/ossrs/srs/issues/851
 [bug #636]: https://github.com/ossrs/srs/issues/636
 [bug #865]: https://github.com/ossrs/srs/issues/865
+[bug #893]: https://github.com/ossrs/srs/issues/893
+[bug #899]: https://github.com/ossrs/srs/issues/899
 [bug #xxxxxxxxxx]: https://github.com/ossrs/srs/issues/xxxxxxxxxx
 
 [bug #735]: https://github.com/ossrs/srs/issues/735
diff --git a/trunk/src/kernel/srs_kernel_ts.cpp b/trunk/src/kernel/srs_kernel_ts.cpp
index ec948ec9ad..19ebea5ff5 100644
--- a/trunk/src/kernel/srs_kernel_ts.cpp
+++ b/trunk/src/kernel/srs_kernel_ts.cpp
@@ -1676,7 +1676,7 @@ int SrsTsPayloadPES::decode(SrsBuffer* stream, SrsTsMessage** ppmsg)
                      * the PES extension field up to and including any reserved bytes.
                      */
                     uint8_t PES_extension_field_length = stream->read_1bytes();
-                    PES_extension_field_length &= 0x07;
+                    PES_extension_field_length &= 0x7F;
                     
                     if (PES_extension_field_length > 0) {
                         if (!stream->require(PES_extension_field_length)) {
@@ -2464,7 +2464,7 @@ int SrsTsPayloadPMTESInfo::decode(SrsBuffer* stream)
     elementary_PID = epv & 0x1FFF;
     
     int16_t eilv = stream->read_2bytes();
-    const1_value1 = (epv >> 12) & 0x0f;
+    const1_value1 = (eilv >> 12) & 0x0f;
     /**
      * This is a 12-bit field, the first two bits of which shall be '00'. The remaining 10 bits specify the number
      * of bytes of the descriptors of the associated program element immediately following the ES_info_length field.
@@ -2486,7 +2486,7 @@ int SrsTsPayloadPMTESInfo::decode(SrsBuffer* stream)
 
 int SrsTsPayloadPMTESInfo::size()
 {
-    return 5 + ES_info.size();
+    return 5 + (int)ES_info.size();
 }
 
 int SrsTsPayloadPMTESInfo::encode(SrsBuffer* stream)