diff --git a/content/media/wave/nsWaveDecoder.cpp b/content/media/wave/nsWaveDecoder.cpp
index d58a746df6a..0b48a4a9231 100644
--- a/content/media/wave/nsWaveDecoder.cpp
+++ b/content/media/wave/nsWaveDecoder.cpp
@@ -976,19 +976,23 @@ nsWaveStateMachine::ScanForwardUntil(PRUint32 aWantedChunk, PRUint32* aChunkSize
     }
 
     PRUint32 magic = ReadUint32BE(&p);
-    PRUint32 size = ReadUint32LE(&p);
+    PRUint32 chunkSize = ReadUint32LE(&p);
 
     if (magic == aWantedChunk) {
-      *aChunkSize = size;
+      *aChunkSize = chunkSize;
       return PR_TRUE;
     }
 
     // RIFF chunks are two-byte aligned, so round up if necessary.
-    size += size % 2;
+    chunkSize += chunkSize % 2;
 
-    nsAutoArrayPtr<char> chunk(new char[size]);
-    if (!ReadAll(chunk.get(), size)) {
-      return PR_FALSE;
+    while (chunkSize > 0) {
+      PRUint32 size = PR_MIN(chunkSize, 1 << 16);
+      nsAutoArrayPtr<char> chunk(new char[size]);
+      if (!ReadAll(chunk.get(), size)) {
+        return PR_FALSE;
+      }
+      chunkSize -= size;
     }
   }
 }