$OpenBSD$

index 8af284c..11f67cd 100644
--- content/media/webm/WebMReader.cpp.orig	Fri Feb 20 15:40:36 2015
+++ content/media/webm/WebMReader.cpp	Fri Feb 20 15:40:36 2015
@@ -664,7 +664,15 @@ bool WebMReader::DecodeAudioPacket(nestegg_packet* aPacket, int64_t aOffset)
           return true;
         }
         int32_t keepFrames = frames - skipFrames;
+        if (keepFrames < 0) {
+          NS_WARNING("Int overflow in keepFrames");
+          return false;
+	}
         int samples = keepFrames * channels;
+	if (samples < 0) {
+          NS_WARNING("Int overflow in samples");
+          return false;
+	}
         nsAutoArrayPtr<AudioDataValue> trimBuffer(new AudioDataValue[samples]);
         for (int i = 0; i < samples; i++)
           trimBuffer[i] = buffer[skipFrames*channels + i];
@@ -687,6 +695,10 @@ bool WebMReader::DecodeAudioPacket(nestegg_packet* aPacket, int64_t aOffset)
         int32_t keepFrames = frames - discardFrames.value();
         if (keepFrames > 0) {
           int samples = keepFrames * channels;
+          if (samples < 0) {
+            NS_WARNING("Int overflow in samples");
+            return false;
+          }
           nsAutoArrayPtr<AudioDataValue> trimBuffer(new AudioDataValue[samples]);
           for (int i = 0; i < samples; i++)
             trimBuffer[i] = buffer[i];