The Tor Browser / file revision

 diff --git a/media/libtheora/lib/decode.c b/media/libtheora/lib/decode.c

 --- a/media/libtheora/lib/decode.c

 +++ b/media/libtheora/lib/decode.c

 @@ -2072,18 +2072,17 @@ static void oc_dec_init_dummy_frame(th_d

     sizeof(_dec->pp_frame_buf[0])*3);

    info=&_dec->state.info;

    yhstride=abs(_dec->state.ref_ystride[0]);

    yheight=info->frame_height+2*OC_UMV_PADDING;

    chstride=abs(_dec->state.ref_ystride[1]);

    cheight=yheight>>!(info->pixel_fmt&2);

    yplane_sz=yhstride*(size_t)yheight+16;

    cplane_sz=chstride*(size_t)cheight;

 -  yoffset=_dec->state.ref_ystride[0]*(yheight-1)-

 -   (OC_UMV_PADDING+OC_UMV_PADDING*(ptrdiff_t)yhstride);

 +  yoffset=yhstride*(ptrdiff_t)(yheight-OC_UMV_PADDING-1)+OC_UMV_PADDING;

    memset(_dec->state.ref_frame_data[0]-yoffset,0x80,yplane_sz+2*cplane_sz);

  }

  int th_decode_packetin(th_dec_ctx *_dec,const ogg_packet *_op,

   ogg_int64_t *_granpos){

    int ret;

    if(_dec==NULL||_op==NULL)return TH_EFAULT;

    /*A completely empty packet indicates a dropped frame and is treated exactly