1 files changed, 22 insertions, 0 deletions
diff --git a/media/libtheora/bug468275-r18219.patch b/media/libtheora/bug468275-r18219.patch
new file mode 100644
index 000000000..7b64b4195
--- /dev/null
+++ b/media/libtheora/bug468275-r18219.patch
@@ -0,0 +1,22 @@
+diff --git a/media/libtheora/lib/state.c b/media/libtheora/lib/state.c
+--- a/media/libtheora/lib/state.c
++++ b/media/libtheora/lib/state.c
+@@ -583,17 +583,17 @@ static int oc_state_ref_bufs_init(oc_the
+    ref_frame_sz<yplane_sz||ref_frame_data_sz/_nrefs!=ref_frame_sz){
+     return TH_EIMPL;
+   }
+   ref_frame_data=oc_aligned_malloc(ref_frame_data_sz,16);
+   frag_buf_offs=_state->frag_buf_offs=
+    _ogg_malloc(_state->nfrags*sizeof(*frag_buf_offs));
+   if(ref_frame_data==NULL||frag_buf_offs==NULL){
+     _ogg_free(frag_buf_offs);
+-    _ogg_free(ref_frame_data);
++    oc_aligned_free(ref_frame_data);
+     return TH_EFAULT;
+   }
+   /*Set up the width, height and stride for the image buffers.*/
+   _state->ref_frame_bufs[0][0].width=info->frame_width;
+   _state->ref_frame_bufs[0][0].height=info->frame_height;
+   _state->ref_frame_bufs[0][0].stride=yhstride;
+   _state->ref_frame_bufs[0][1].width=_state->ref_frame_bufs[0][2].width=
+    info->frame_width>>hdec;