palemoon-dev/platform/media/libtheora/bug625773-r17780.patch

diff --git a/media/libtheora/lib/decode.c b/media/libtheora/lib/decode.c
--- a/media/libtheora/lib/decode.c
+++ b/media/libtheora/lib/decode.c
@@ -2072,18 +2072,17 @@ static void oc_dec_init_dummy_frame(th_d
    sizeof(_dec->pp_frame_buf[0])*3);
   info=&_dec->state.info;
   yhstride=abs(_dec->state.ref_ystride[0]);
   yheight=info->frame_height+2*OC_UMV_PADDING;
   chstride=abs(_dec->state.ref_ystride[1]);
   cheight=yheight>>!(info->pixel_fmt&2);
   yplane_sz=yhstride*(size_t)yheight+16;
   cplane_sz=chstride*(size_t)cheight;
-  yoffset=_dec->state.ref_ystride[0]*(yheight-1)-
-   (OC_UMV_PADDING+OC_UMV_PADDING*(ptrdiff_t)yhstride);
+  yoffset=yhstride*(ptrdiff_t)(yheight-OC_UMV_PADDING-1)+OC_UMV_PADDING;
   memset(_dec->state.ref_frame_data[0]-yoffset,0x80,yplane_sz+2*cplane_sz);
 }
 
 int th_decode_packetin(th_dec_ctx *_dec,const ogg_packet *_op,
  ogg_int64_t *_granpos){
   int ret;
   if(_dec==NULL||_op==NULL)return TH_EFAULT;
   /*A completely empty packet indicates a dropped frame and is treated exactly