diff --git a/0001-speexdec-Don-t-unmap-or-finish_frame-an-invalid-GstB.patch b/0001-speexdec-Don-t-unmap-or-finish_frame-an-invalid-GstB.patch
new file mode 100644
index 0000000..ce0eb21
--- /dev/null
+++ b/0001-speexdec-Don-t-unmap-or-finish_frame-an-invalid-GstB.patch
@@ -0,0 +1,61 @@
+From 0bf17544e3c2a9277975659ce6e52d265d9b3e8a Mon Sep 17 00:00:00 2001
+From: Debarshi Ray <rishi@gnu.org>
+Date: Fri, 2 Nov 2012 16:39:28 +0100
+Subject: [PATCH] speexdec: Don't unmap or finish_frame an invalid GstBuffer
+
+https://bugzilla.gnome.org/show_bug.cgi?id=687464
+---
+ ext/speex/gstspeexdec.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/ext/speex/gstspeexdec.c b/ext/speex/gstspeexdec.c
+index 36cc68b..cd78804 100644
+--- a/ext/speex/gstspeexdec.c
++++ b/ext/speex/gstspeexdec.c
+@@ -392,6 +392,7 @@ gst_speex_dec_parse_data (GstSpeexDec * dec, GstBuffer * buf)
+   /* now decode each frame, catering for unknown number of them (e.g. rtp) */
+   for (i = 0; i < fpp; i++) {
+     GstBuffer *outbuf;
++    gboolean corrupted = FALSE;
+     gint ret;
+ 
+     GST_LOG_OBJECT (dec, "decoding frame %d/%d, %d bits remaining", i, fpp,
+@@ -425,18 +426,15 @@ gst_speex_dec_parse_data (GstSpeexDec * dec, GstBuffer * buf)
+       } else {
+         GST_WARNING_OBJECT (dec, "Unexpected end of stream found");
+       }
+-      gst_audio_decoder_finish_frame (GST_AUDIO_DECODER (dec), NULL, 1);
+-      gst_buffer_unref (outbuf);
++      corrupted = TRUE;
+     } else if (ret == -2) {
+       GST_WARNING_OBJECT (dec, "Decoding error: corrupted stream?");
+-      gst_audio_decoder_finish_frame (GST_AUDIO_DECODER (dec), NULL, 1);
+-      gst_buffer_unref (outbuf);
++      corrupted = TRUE;
+     }
+ 
+     if (bits && speex_bits_remaining (bits) < 0) {
+       GST_WARNING_OBJECT (dec, "Decoding overflow: corrupted stream?");
+-      gst_audio_decoder_finish_frame (GST_AUDIO_DECODER (dec), NULL, 1);
+-      gst_buffer_unref (outbuf);
++      corrupted = TRUE;
+     }
+     if (dec->header->nb_channels == 2)
+       speex_decode_stereo_int ((spx_int16_t *) map.data, dec->frame_size,
+@@ -444,7 +442,12 @@ gst_speex_dec_parse_data (GstSpeexDec * dec, GstBuffer * buf)
+ 
+     gst_buffer_unmap (outbuf, &map);
+ 
+-    res = gst_audio_decoder_finish_frame (GST_AUDIO_DECODER (dec), outbuf, 1);
++    if (!corrupted) {
++      res = gst_audio_decoder_finish_frame (GST_AUDIO_DECODER (dec), outbuf, 1);
++    } else {
++      res = gst_audio_decoder_finish_frame (GST_AUDIO_DECODER (dec), NULL, 1);
++      gst_buffer_unref (outbuf);
++    }
+ 
+     if (res != GST_FLOW_OK) {
+       GST_DEBUG_OBJECT (dec, "flow: %s", gst_flow_get_name (res));
+-- 
+1.7.12.1
+
diff --git a/0001-v4l2src-Check-for-obj-pool-NULL.patch b/0001-v4l2src-Check-for-obj-pool-NULL.patch
new file mode 100644
index 0000000..f3c0081
--- /dev/null
+++ b/0001-v4l2src-Check-for-obj-pool-NULL.patch
@@ -0,0 +1,37 @@
+From 5f41f4683d50fce293d770ae35f3f9a0083744a6 Mon Sep 17 00:00:00 2001
+From: Debarshi Ray <rishi@gnu.org>
+Date: Tue, 6 Nov 2012 19:49:45 +0100
+Subject: [PATCH] v4l2src: Check for obj->pool == NULL
+
+Not sure how it could happen and can not reproduce it either, but it
+did happen once during a VoIP call and the backtrace lays the blame
+on obj->pool being NULL.
+
+https://bugzilla.gnome.org/show_bug.cgi?id=687793
+---
+ sys/v4l2/gstv4l2src.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sys/v4l2/gstv4l2src.c b/sys/v4l2/gstv4l2src.c
+index 6197f78..58ff481 100644
+--- a/sys/v4l2/gstv4l2src.c
++++ b/sys/v4l2/gstv4l2src.c
+@@ -763,11 +763,14 @@ gst_v4l2src_fill (GstPushSrc * src, GstBuffer * buf)
+ {
+   GstV4l2Src *v4l2src = GST_V4L2SRC (src);
+   GstV4l2Object *obj = v4l2src->v4l2object;
+-  GstFlowReturn ret;
++  GstFlowReturn ret = GST_FLOW_ERROR;
+   GstClock *clock;
+   GstClockTime abs_time, base_time, timestamp, duration;
+   GstClockTime delay;
+ 
++  if (G_UNLIKELY (obj->pool == NULL))
++    goto error;
++
+   ret =
+       gst_v4l2_buffer_pool_process (GST_V4L2_BUFFER_POOL_CAST (obj->pool), buf);
+ 
+-- 
+1.7.12.1
+
diff --git a/gstreamer1-plugins-good.spec b/gstreamer1-plugins-good.spec
index 3f23ece..620331e 100644
--- a/gstreamer1-plugins-good.spec
+++ b/gstreamer1-plugins-good.spec
@@ -9,7 +9,7 @@
 
 Name:           gstreamer1-plugins-good
 Version:        1.0.2
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        GStreamer plugins with good code and licensing
 
 License:        LGPLv2+
@@ -17,6 +17,8 @@ URL:            http://gstreamer.freedesktop.org/
 Source0:        http://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-%{version}.tar.xz
 Patch0:         0001-vp8dec-Short-circuit-gst_vp8_dec_handle_frame-if-key.patch
 Patch1:         0002-vp8dec-Immediately-return-if-opening-the-decoder-fai.patch
+Patch2:         0001-speexdec-Don-t-unmap-or-finish_frame-an-invalid-GstB.patch
+Patch3:         0001-v4l2src-Check-for-obj-pool-NULL.patch
 
 BuildRequires:  gstreamer1-devel >= %{version}
 BuildRequires:  gstreamer1-plugins-base-devel >= %{version}
@@ -87,6 +89,8 @@ to be installed.
 %setup -q -n gst-plugins-good-%{version}
 %patch0 -p1
 %patch1 -p1
+%patch2 -p1
+%patch3 -p1
 
 
 %build
@@ -203,6 +207,9 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
 
 
 %changelog
+* Wed Nov  7 2012 Debarshi Ray <rishi@fedoraproject.org> - 1.0.2-3
+- Fixes for GNOME #687464 and #687793
+
 * Fri Nov  2 2012 Debarshi Ray <rishi@fedoraproject.org> - 1.0.2-2
 - Fixes for vp8dec including GNOME #687376