diff --git a/content/media/test/Makefile.in b/content/media/test/Makefile.in
index 2e74996fb36a..467e741d181e 100644
--- a/content/media/test/Makefile.in
+++ b/content/media/test/Makefile.in
@@ -134,6 +134,7 @@ _TEST_FILES += \
 		bug506094.ogv \
 		bug516323.ogv \
 		bug520493.ogg \
+		bug520500.ogg \
 		chain.ogv \
 		dirac.ogg \
 		seek.ogv \
diff --git a/content/media/test/bug520500.ogg b/content/media/test/bug520500.ogg
new file mode 100644
index 000000000000..b91d3dd97d24
Binary files /dev/null and b/content/media/test/bug520500.ogg differ
diff --git a/content/media/test/manifest.js b/content/media/test/manifest.js
index ac37dcebec3e..055be755f340 100644
--- a/content/media/test/manifest.js
+++ b/content/media/test/manifest.js
@@ -47,7 +47,9 @@ var gPlayTests = [
   { name:"beta-phrasebook.ogg", type:"audio/ogg", duration:4 },
   // Small file, only 1 frame with audio only.
   { name:"bug520493.ogg", type:"audio/ogg", duration:0.458 },
- 
+  // Small file with vorbis comments with 0 length values and names.
+  { name:"bug520500.ogg", type:"audio/ogg", duration:0.123 },
+
   { name:"bogus.duh", type:"bogus/duh" }
 ];
 
diff --git a/media/libfishsound/README_MOZILLA b/media/libfishsound/README_MOZILLA
index 3af2110ac151..6cebce8d2df3 100644
--- a/media/libfishsound/README_MOZILLA
+++ b/media/libfishsound/README_MOZILLA
@@ -14,4 +14,5 @@ endian.patch is applied to fix Bug 45269.
 bug487519.patch: Fixes for bug487519
 trac497.patch: Annodex trac ticket 497 fix and mozilla bug 462141.
 fishsound_reset.patch: Fixes bug 516323.
-
+bug520500.patch: Don't reject files with vorbis comments with name or
+                 values of length 0.
diff --git a/media/libfishsound/bug520500.patch b/media/libfishsound/bug520500.patch
new file mode 100644
index 000000000000..9d2450b70e37
--- /dev/null
+++ b/media/libfishsound/bug520500.patch
@@ -0,0 +1,54 @@
+diff --git a/media/libfishsound/src/libfishsound/fishsound_comments.c b/media/libfishsound/src/libfishsound/fishsound_comments.c
+--- a/media/libfishsound/src/libfishsound/fishsound_comments.c
++++ b/media/libfishsound/src/libfishsound/fishsound_comments.c
+@@ -480,44 +480,47 @@ fish_sound_comments_decode (FishSound * 
+       len=readint(c, 0);
+       debug_printf (1, "[%d] len %d\n", i, len);
+ 
+       c+=4;
+       if (len > (unsigned long) (end-c)) return -1;
+ 
+       name = c;
+       value = fs_index_len (c, '=', len);
++      n = 0;
+       if (value) {
+ 	*value = '\0';
+ 	value++;
+-
+ 	n = c+len - value;
++	
++      }
++      if (n) {
+ 	if ((nvalue = fs_strdup_len (value, n)) == NULL)
+           return FISH_SOUND_ERR_OUT_OF_MEMORY;
+ 
+ 	debug_printf (1, "%s -> %s (length %d)", name, nvalue, n);
+ 
+ 	if ((comment = fs_comment_new (name, nvalue)) == NULL) {
+ 	  fs_free (nvalue);
+           return FISH_SOUND_ERR_OUT_OF_MEMORY;
+ 	}
+ 
+ 	if (_fs_comment_add (fsound, comment) == NULL) {
+ 	  fs_free (nvalue);
+           return FISH_SOUND_ERR_OUT_OF_MEMORY;
+ 	}
+ 
+ 	fs_free (nvalue);
+-      } else {
++      } else if (len > 0) {
+         debug_printf (1, "[%d] %s (no value)", i, name, len);
+ 
+ 	if ((nvalue = fs_strdup_len (name, len)) == NULL)
+           return FISH_SOUND_ERR_OUT_OF_MEMORY;
+ 
+-	if ((comment = fs_comment_new (nvalue, NULL)) == NULL) {
++	if ((comment = fs_comment_new (nvalue, "")) == NULL) {
+ 	  fs_free (nvalue);
+           return FISH_SOUND_ERR_OUT_OF_MEMORY;
+ 	}
+ 
+ 	if (_fs_comment_add (fsound, comment) == NULL) {
+ 	  fs_free (nvalue);
+           return FISH_SOUND_ERR_OUT_OF_MEMORY;
+ 	}
diff --git a/media/libfishsound/src/libfishsound/fishsound_comments.c b/media/libfishsound/src/libfishsound/fishsound_comments.c
index 414e210cb7c9..52d28f48ed88 100644
--- a/media/libfishsound/src/libfishsound/fishsound_comments.c
+++ b/media/libfishsound/src/libfishsound/fishsound_comments.c
@@ -485,11 +485,14 @@ fish_sound_comments_decode (FishSound * fsound, unsigned char * comments,
 
       name = c;
       value = fs_index_len (c, '=', len);
+      n = 0;
       if (value) {
 	*value = '\0';
 	value++;
-
 	n = c+len - value;
+	
+      }
+      if (n) {
 	if ((nvalue = fs_strdup_len (value, n)) == NULL)
           return FISH_SOUND_ERR_OUT_OF_MEMORY;
 
@@ -506,13 +509,13 @@ fish_sound_comments_decode (FishSound * fsound, unsigned char * comments,
 	}
 
 	fs_free (nvalue);
-      } else {
+      } else if (len > 0) {
         debug_printf (1, "[%d] %s (no value)", i, name, len);
 
 	if ((nvalue = fs_strdup_len (name, len)) == NULL)
           return FISH_SOUND_ERR_OUT_OF_MEMORY;
 
-	if ((comment = fs_comment_new (nvalue, NULL)) == NULL) {
+	if ((comment = fs_comment_new (nvalue, "")) == NULL) {
 	  fs_free (nvalue);
           return FISH_SOUND_ERR_OUT_OF_MEMORY;
 	}
diff --git a/media/libfishsound/update.sh b/media/libfishsound/update.sh
index d87e2f1ca26b..ff02493a7141 100644
--- a/media/libfishsound/update.sh
+++ b/media/libfishsound/update.sh
@@ -43,4 +43,4 @@ patch -p3 <endian.patch
 patch -p3 <bug487519.patch
 patch -p3 <trac497.patch
 patch -p3 <fishsound_reset.patch
-
+patch -p3 <bug520500.patch