diff --git a/media/libvorbis/0001-alloca-to-malloc-in-vorbis_book_init_decode.patch b/media/libvorbis/0001-alloca-to-malloc-in-vorbis_book_init_decode.patch
new file mode 100644
index 00000000000..41525434bc7
--- /dev/null
+++ b/media/libvorbis/0001-alloca-to-malloc-in-vorbis_book_init_decode.patch
@@ -0,0 +1,49 @@
+diff --git a/lib/sharedbook.c b/lib/sharedbook.c
+index 7a98b479..abe4c24d 100644
+--- a/lib/sharedbook.c
++++ b/lib/sharedbook.c
+@@ -352,9 +352,13 @@ int vorbis_book_init_decode(codebook *c,const static_codebook *s){
+
+     /* perform sort */
+     ogg_uint32_t *codes=_make_words(s->lengthlist,s->entries,c->used_entries);
+-    ogg_uint32_t **codep=alloca(sizeof(*codep)*n);
++    ogg_uint32_t **codep=_ogg_malloc(sizeof(*codep)*n);
+
+-    if(codes==NULL)goto err_out;
++    if(codes==NULL || codep==NULL){
++      if(codes)_ogg_free(codes);
++      if(codep)_ogg_free(codep);
++      goto err_out;
++    }
+
+     for(i=0;i<n;i++){
+       codes[i]=bitreverse(codes[i]);
+@@ -363,13 +367,19 @@ int vorbis_book_init_decode(codebook *c,const static_codebook *s){
+
+     qsort(codep,n,sizeof(*codep),sort32a);
+
+-    sortindex=alloca(n*sizeof(*sortindex));
++    sortindex=_ogg_malloc(n*sizeof(*sortindex));
++    if(sortindex==NULL){
++      _ogg_free(codes);
++      _ogg_free(codep);
++      goto err_out;
++    }
+     c->codelist=_ogg_malloc(n*sizeof(*c->codelist));
+     /* the index is a reverse index */
+     for(i=0;i<n;i++){
+       int position=codep[i]-codes;
+       sortindex[position]=i;
+     }
++    _ogg_free(codep);
+
+     for(i=0;i<n;i++)
+       c->codelist[sortindex[i]]=codes[i];
+@@ -390,6 +400,7 @@ int vorbis_book_init_decode(codebook *c,const static_codebook *s){
+         if(s->lengthlist[i]>c->dec_maxlength)
+           c->dec_maxlength=s->lengthlist[i];
+       }
++    _ogg_free(sortindex);
+
+     if(n==1 && c->dec_maxlength==1){
+       /* special case the 'single entry codebook' with a single bit
diff --git a/media/libvorbis/0002-null-checks-in-vorbis_book_init_decode.patch b/media/libvorbis/0002-null-checks-in-vorbis_book_init_decode.patch
new file mode 100644
index 00000000000..4a0023cce0f
--- /dev/null
+++ b/media/libvorbis/0002-null-checks-in-vorbis_book_init_decode.patch
@@ -0,0 +1,54 @@
+diff --git a/lib/sharedbook.c b/lib/sharedbook.c
+index abe4c24d..11af49e3 100644
+--- a/lib/sharedbook.c
++++ b/lib/sharedbook.c
+@@ -374,6 +374,12 @@ int vorbis_book_init_decode(codebook *c,const static_codebook *s){
+       goto err_out;
+     }
+     c->codelist=_ogg_malloc(n*sizeof(*c->codelist));
++    if(c->codelist==NULL){
++      _ogg_free(sortindex);
++      _ogg_free(codep);
++      _ogg_free(codes);
++      goto err_out;
++    }
+     /* the index is a reverse index */
+     for(i=0;i<n;i++){
+       int position=codep[i]-codes;
+@@ -387,12 +393,20 @@ int vorbis_book_init_decode(codebook *c,const static_codebook *s){
+
+     c->valuelist=_book_unquantize(s,n,sortindex);
+     c->dec_index=_ogg_malloc(n*sizeof(*c->dec_index));
++    if(c->dec_index==NULL){
++      _ogg_free(sortindex);
++      goto err_out;
++    }
+
+     for(n=0,i=0;i<s->entries;i++)
+       if(s->lengthlist[i]>0)
+         c->dec_index[sortindex[n++]]=i;
+
+     c->dec_codelengths=_ogg_malloc(n*sizeof(*c->dec_codelengths));
++    if(c->dec_codelengths==NULL){
++      _ogg_free(sortindex);
++      goto err_out;
++    }
+     c->dec_maxlength=0;
+     for(n=0,i=0;i<s->entries;i++)
+       if(s->lengthlist[i]>0){
+@@ -408,6 +422,7 @@ int vorbis_book_init_decode(codebook *c,const static_codebook *s){
+        unmodified decode paths. */
+       c->dec_firsttablen=1;
+       c->dec_firsttable=_ogg_calloc(2,sizeof(*c->dec_firsttable));
++      if(c->dec_firsttable==NULL)goto err_out;
+       c->dec_firsttable[0]=c->dec_firsttable[1]=1;
+
+     }else{
+@@ -417,6 +432,7 @@ int vorbis_book_init_decode(codebook *c,const static_codebook *s){
+
+       tabn=1<<c->dec_firsttablen;
+       c->dec_firsttable=_ogg_calloc(tabn,sizeof(*c->dec_firsttable));
++      if(c->dec_firsttable==NULL)goto err_out;
+
+       for(i=0;i<n;i++){
+         if(c->dec_codelengths[i]<=c->dec_firsttablen){
diff --git a/media/libvorbis/lib/vorbis_sharedbook.c b/media/libvorbis/lib/vorbis_sharedbook.c
index 7a98b479cac..11af49e3343 100644
--- a/media/libvorbis/lib/vorbis_sharedbook.c
+++ b/media/libvorbis/lib/vorbis_sharedbook.c
@@ -352,9 +352,13 @@ int vorbis_book_init_decode(codebook *c,const static_codebook *s){
 
     /* perform sort */
     ogg_uint32_t *codes=_make_words(s->lengthlist,s->entries,c->used_entries);
-    ogg_uint32_t **codep=alloca(sizeof(*codep)*n);
+    ogg_uint32_t **codep=_ogg_malloc(sizeof(*codep)*n);
 
-    if(codes==NULL)goto err_out;
+    if(codes==NULL || codep==NULL){
+      if(codes)_ogg_free(codes);
+      if(codep)_ogg_free(codep);
+      goto err_out;
+    }
 
     for(i=0;i<n;i++){
       codes[i]=bitreverse(codes[i]);
@@ -363,13 +367,25 @@ int vorbis_book_init_decode(codebook *c,const static_codebook *s){
 
     qsort(codep,n,sizeof(*codep),sort32a);
 
-    sortindex=alloca(n*sizeof(*sortindex));
+    sortindex=_ogg_malloc(n*sizeof(*sortindex));
+    if(sortindex==NULL){
+      _ogg_free(codes);
+      _ogg_free(codep);
+      goto err_out;
+    }
     c->codelist=_ogg_malloc(n*sizeof(*c->codelist));
+    if(c->codelist==NULL){
+      _ogg_free(sortindex);
+      _ogg_free(codep);
+      _ogg_free(codes);
+      goto err_out;
+    }
     /* the index is a reverse index */
     for(i=0;i<n;i++){
       int position=codep[i]-codes;
       sortindex[position]=i;
     }
+    _ogg_free(codep);
 
     for(i=0;i<n;i++)
       c->codelist[sortindex[i]]=codes[i];
@@ -377,12 +393,20 @@ int vorbis_book_init_decode(codebook *c,const static_codebook *s){
 
     c->valuelist=_book_unquantize(s,n,sortindex);
     c->dec_index=_ogg_malloc(n*sizeof(*c->dec_index));
+    if(c->dec_index==NULL){
+      _ogg_free(sortindex);
+      goto err_out;
+    }
 
     for(n=0,i=0;i<s->entries;i++)
       if(s->lengthlist[i]>0)
         c->dec_index[sortindex[n++]]=i;
 
     c->dec_codelengths=_ogg_malloc(n*sizeof(*c->dec_codelengths));
+    if(c->dec_codelengths==NULL){
+      _ogg_free(sortindex);
+      goto err_out;
+    }
     c->dec_maxlength=0;
     for(n=0,i=0;i<s->entries;i++)
       if(s->lengthlist[i]>0){
@@ -390,6 +414,7 @@ int vorbis_book_init_decode(codebook *c,const static_codebook *s){
         if(s->lengthlist[i]>c->dec_maxlength)
           c->dec_maxlength=s->lengthlist[i];
       }
+    _ogg_free(sortindex);
 
     if(n==1 && c->dec_maxlength==1){
       /* special case the 'single entry codebook' with a single bit
@@ -397,6 +422,7 @@ int vorbis_book_init_decode(codebook *c,const static_codebook *s){
        unmodified decode paths. */
       c->dec_firsttablen=1;
       c->dec_firsttable=_ogg_calloc(2,sizeof(*c->dec_firsttable));
+      if(c->dec_firsttable==NULL)goto err_out;
       c->dec_firsttable[0]=c->dec_firsttable[1]=1;
 
     }else{
@@ -406,6 +432,7 @@ int vorbis_book_init_decode(codebook *c,const static_codebook *s){