1 files changed, 41 insertions, 0 deletions
diff --git a/gnu/packages/patches/icecat-CVE-2015-0836-pt-06.patch b/gnu/packages/patches/icecat-CVE-2015-0836-pt-06.patch
new file mode 100644
index 0000000000..181f9243e3
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-0836-pt-06.patch
@@ -0,0 +1,41 @@
+From 0758363d982b0b3e6cf021c164715a028a345b9e Mon Sep 17 00:00:00 2001
+From: "Byron Campen [:bwc]" <docfaraday@gmail.com>
+Date: Wed, 21 Jan 2015 08:56:36 -0800
+Subject: [PATCH] Bug 1123882 - Fix case where offset != 0. r=derf, a=bkerensa
+
+---
+ content/media/MediaDecoderStateMachine.cpp | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/content/media/MediaDecoderStateMachine.cpp b/content/media/MediaDecoderStateMachine.cpp
+index ce5870f..4ed496c 100644
+--- a/content/media/MediaDecoderStateMachine.cpp
++++ b/content/media/MediaDecoderStateMachine.cpp
+@@ -328,6 +328,8 @@ void MediaDecoderStateMachine::SendStreamAudio(AudioData* aAudio,
+   if (offset >= aAudio->mFrames)
+     return;
+ 
++  size_t framesToWrite = aAudio->mFrames - offset;
++
+   aAudio->EnsureAudioBuffer();
+   nsRefPtr<SharedBuffer> buffer = aAudio->mAudioBuffer;
+   AudioDataValue* bufferData = static_cast<AudioDataValue*>(buffer->Data());
+@@ -335,10 +337,11 @@ void MediaDecoderStateMachine::SendStreamAudio(AudioData* aAudio,
+   for (uint32_t i = 0; i < aAudio->mChannels; ++i) {
+     channels.AppendElement(bufferData + i*aAudio->mFrames + offset);
+   }
+-  aOutput->AppendFrames(buffer.forget(), channels, aAudio->mFrames);
+-  VERBOSE_LOG("writing %d frames of data to MediaStream for AudioData at %lld",
+-              aAudio->mFrames - int32_t(offset), aAudio->mTime);
+-  aStream->mAudioFramesWritten += aAudio->mFrames - int32_t(offset);
++  aOutput->AppendFrames(buffer.forget(), channels, framesToWrite);
++  VERBOSE_LOG("writing %u frames of data to MediaStream for AudioData at %lld",
++              static_cast<unsigned>(framesToWrite),
++              aAudio->mTime);
++  aStream->mAudioFramesWritten += framesToWrite;
+ }
+ 
+ static void WriteVideoToMediaStream(layers::Image* aImage,
+-- 
+2.2.1
+