diff --git a/wavpack/trunk/PKGBUILD b/wavpack/trunk/PKGBUILD
index 248bd8f94e7..74569d8a9db 100644
--- a/wavpack/trunk/PKGBUILD
+++ b/wavpack/trunk/PKGBUILD
@@ -2,14 +2,25 @@
 
 pkgname=wavpack
 pkgver=5.3.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Audio compression format with lossless, lossy and hybrid compression modes"
 arch=('x86_64')
 url="http://www.wavpack.com/"
 license=('BSD')
 depends=('glibc')
-source=(http://www.wavpack.com/${pkgname}-${pkgver}.tar.bz2)
-sha512sums=('2c5038abfbe7ab3b51fb30b3fc8b636117e9afe1821c40832fbdfb960d1153e0cb4a68dd84a89b205c3cdc10030d3aa7a7340b296d9c148e8847471c2e7c0cd1')
+source=(https://github.com/dbry/WavPack/releases/download/${pkgver}/${pkgname}-${pkgver}.tar.xz
+https://github.com/dbry/WavPack/commit/89df160596132e3bd666322e1c20b2ebd4b92cd0.patch
+https://github.com/dbry/WavPack/commit/63f3ec70129843dd64e11aa4c21c4a1cf00c9f1c.patch)
+sha512sums=('4029df6a70fac804924b4fdb223b5b65bbc25c2bd2a363c72ce1d1100fdea26ca5d889cf755caed226c66722eff491ce656ad28dc61fc535792ca5c82af54100'
+            'd0310d6cd85250a1111d49defae800f99ba8eefadfb3b28c700a968d7f483b645ab86864200da616f85320a7ef113e19ec4633e96c7a3839fc53414aa6fbca47'
+            'e4c342091cd55e3ea76e4187669fbb84c83b57c37e1b534d8cedc3d4d80ca9745687a9cc64eae76f0a6b35c20f6e010fdb8d6740bfc594e4309ea349c53fb01c')
+
+prepare() {
+  cd ${pkgname}-${pkgver}
+  # CVE-2020-35738
+  patch -Np1 < ../89df160596132e3bd666322e1c20b2ebd4b92cd0.patch
+  patch -Np1 < ../63f3ec70129843dd64e11aa4c21c4a1cf00c9f1c.patch
+}
 
 build() {
   cd ${pkgname}-${pkgver}