add some readme, fix a vulerability in decoding, more tests needed