diff --git a/patches/libvorbis-1.3.5.local.patch b/patches/libvorbis-1.3.5.local.patch
new file mode 100644
index 0000000..e52de1d
--- /dev/null
+++ b/patches/libvorbis-1.3.5.local.patch
@@ -0,0 +1,57 @@
+diff -ru libvorbis-1.3.5.orig/lib/info.c libvorbis-1.3.5/lib/info.c
+--- libvorbis-1.3.5.orig/lib/info.c	2015-02-26 22:58:19.000000000 +0100
++++ libvorbis-1.3.5/lib/info.c	2018-02-27 16:47:27.373883142 +0100
+@@ -583,7 +583,8 @@
+   oggpack_buffer opb;
+   private_state *b=v->backend_state;
+ 
+-  if(!b||vi->channels<=0){
++  if(!b||vi->channels<=0||vi->channels>256){
++    b = NULL;
+     ret=OV_EFAULT;
+     goto err_out;
+   }
+diff -ru libvorbis-1.3.5.orig/lib/psy.c libvorbis-1.3.5/lib/psy.c
+--- libvorbis-1.3.5.orig/lib/psy.c	2013-11-12 05:01:54.000000000 +0100
++++ libvorbis-1.3.5/lib/psy.c	2018-02-27 16:47:58.285637422 +0100
+@@ -600,7 +600,7 @@
+     XY[i] = tXY;
+   }
+ 
+-  for (i = 0, x = 0.f;; i++, x += 1.f) {
++  for (i = 0, x = 0.f; i < n; i++, x += 1.f) {
+ 
+     lo = b[i] >> 16;
+     if( lo>=0 ) break;
+@@ -622,12 +622,11 @@
+     noise[i] = R - offset;
+   }
+ 
+-  for ( ;; i++, x += 1.f) {
++  for ( ; i < n; i++, x += 1.f) {
+ 
+     lo = b[i] >> 16;
+     hi = b[i] & 0xffff;
+     if(hi>=n)break;
+-
+     tN = N[hi] - N[lo];
+     tX = X[hi] - X[lo];
+     tXX = XX[hi] - XX[lo];
+@@ -652,7 +651,7 @@
+ 
+   if (fixed <= 0) return;
+ 
+-  for (i = 0, x = 0.f;; i++, x += 1.f) {
++  for (i = 0, x = 0.f; i < n; i++, x += 1.f) {
+     hi = i + fixed / 2;
+     lo = hi - fixed;
+     if(lo>=0)break;
+@@ -671,7 +670,7 @@
+ 
+     if (R - offset < noise[i]) noise[i] = R - offset;
+   }
+-  for ( ;; i++, x += 1.f) {
++  for ( ; i < n; i++, x += 1.f) {
+ 
+     hi = i + fixed / 2;
+     lo = hi - fixed;
diff --git a/vars/build.vars b/vars/build.vars
index 7e2abe6..f2bb90b 100644
--- a/vars/build.vars
+++ b/vars/build.vars
@@ -345,7 +345,7 @@ NATIVE_PACKAGES_DEPS_MAKEFLAGS_INSTALL="PREFIX= prefix=";
 NATIVE_PACKAGES_DEPS_PACKAGES="
 expat libxml2 alsa_lib apr apr_util bzip2 libdmtx libressl curl libz lmdb libpng
 libjpeg_turbo tiff giflib libffi gdbm geoip pcre glib gzip libarchive
-libatomic_ops libpipeline libevent libfetch libogg libgpg_error libassuan libfirm
+libatomic_ops libpipeline libevent libfetch libogg libvorbis libgpg_error libassuan libfirm
 libgcrypt libksba libudns lua ncurses ncursestw ncursesw libreadline npth
 popt shared_mime_info sqlite3 w32api w32lib xz cmake qrencode util_linux";
 NATIVE_PACKAGES_DEPS_PREFIX="${PREFIX_NATIVE}";
@@ -456,6 +456,9 @@ NATIVE_PACKAGES_DEPS_PYTHON="${PREFIX}/bin/python";
 : ${PKG_LIBOGG_SHA256SUM:=4f3fc6178a533d392064f14776b23c397ed4b9f48f5de297aba73b643f955c08};
 : ${PKG_LIBOGG_VERSION:=1.3.3};
 : ${PKG_LIBOGG_URL:=https://ftp.osuosl.org/pub/xiph/releases/ogg/libogg-${PKG_LIBOGG_VERSION}.tar.xz};
+: ${PKG_LIBVORBIS_SHA256SUM:=54f94a9527ff0a88477be0a71c0bab09a4c3febe0ed878b24824906cd4b0e1d1};
+: ${PKG_LIBVORBIS_VERSION:=1.3.5};
+: ${PKG_LIBVORBIS_URL:=https://ftp.osuosl.org/pub/xiph/releases/vorbis/libvorbis-${PKG_LIBVORBIS_VERSION}.tar.xz};
 : ${PKG_LIBGPG_ERROR_SHA256SUM:=f628f75843433b38b05af248121beb7db5bd54bb2106f384edac39934261320c};
 : ${PKG_LIBGPG_ERROR_VERSION:=1.25};
 : ${PKG_LIBGPG_ERROR_URL:=https://www.gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-${PKG_LIBGPG_ERROR_VERSION}.tar.bz2};