new file mode 100644
--- /dev/null
+++ b/media/libtheora/bug468275-r18219.patch
@@ -0,0 +1,22 @@
+diff --git a/media/libtheora/lib/state.c b/media/libtheora/lib/state.c
+--- a/media/libtheora/lib/state.c
++++ b/media/libtheora/lib/state.c
+@@ -583,17 +583,17 @@ static int oc_state_ref_bufs_init(oc_the
+    ref_frame_sz<yplane_sz||ref_frame_data_sz/_nrefs!=ref_frame_sz){
+     return TH_EIMPL;
+   }
+   ref_frame_data=oc_aligned_malloc(ref_frame_data_sz,16);
+   frag_buf_offs=_state->frag_buf_offs=
+    _ogg_malloc(_state->nfrags*sizeof(*frag_buf_offs));
+   if(ref_frame_data==NULL||frag_buf_offs==NULL){
+     _ogg_free(frag_buf_offs);
+-    _ogg_free(ref_frame_data);
++    oc_aligned_free(ref_frame_data);
+     return TH_EFAULT;
+   }
+   /*Set up the width, height and stride for the image buffers.*/
+   _state->ref_frame_bufs[0][0].width=info->frame_width;
+   _state->ref_frame_bufs[0][0].height=info->frame_height;
+   _state->ref_frame_bufs[0][0].stride=yhstride;
+   _state->ref_frame_bufs[0][1].width=_state->ref_frame_bufs[0][2].width=
+    info->frame_width>>hdec;

--- a/media/libtheora/lib/state.c
+++ b/media/libtheora/lib/state.c
@@ -583,17 +583,17 @@ static int oc_state_ref_bufs_init(oc_the
    ref_frame_sz<yplane_sz||ref_frame_data_sz/_nrefs!=ref_frame_sz){
     return TH_EIMPL;
   }
   ref_frame_data=oc_aligned_malloc(ref_frame_data_sz,16);
   frag_buf_offs=_state->frag_buf_offs=
    _ogg_malloc(_state->nfrags*sizeof(*frag_buf_offs));
   if(ref_frame_data==NULL||frag_buf_offs==NULL){
     _ogg_free(frag_buf_offs);
-    _ogg_free(ref_frame_data);
+    oc_aligned_free(ref_frame_data);
     return TH_EFAULT;
   }
   /*Set up the width, height and stride for the image buffers.*/
   _state->ref_frame_bufs[0][0].width=info->frame_width;
   _state->ref_frame_bufs[0][0].height=info->frame_height;
   _state->ref_frame_bufs[0][0].stride=yhstride;
   _state->ref_frame_bufs[0][1].width=_state->ref_frame_bufs[0][2].width=
    info->frame_width>>hdec;

--- a/media/libtheora/update.sh
+++ b/media/libtheora/update.sh
@@ -74,8 +74,9 @@ cp $1/lib/x86_vc/x86cpu.c ./lib/x86_vc/
 cp $1/lib/x86_vc/x86cpu.h ./lib/x86_vc/
 cp $1/lib/x86_vc/x86int.h ./lib/x86_vc/
 cp $1/lib/x86_vc/x86state.c ./lib/x86_vc/
 cp $1/include/theora/theora.h ./include/theora/theora.h
 cp $1/include/theora/theoradec.h ./include/theora/theoradec.h
 cp $1/include/theora/theoraenc.h ./include/theora/theoraenc.h
 cp $1/include/theora/codec.h ./include/theora/codec.h
 patch -p3 < ./bug625773-r17780.patch
+patch -p3 < ./bug468275-r18219.patch