diff -r -U 3 libpng-1.0.3/png.h libpng-1.0.3patch4b/png.h
--- libpng-1.0.3/png.h	Wed Jan 13 22:06:39 1999
+++ libpng-1.0.3patch4b/png.h	Fri Jul 23 22:26:02 2004
@@ -460,6 +460,11 @@
 typedef png_info FAR * png_infop;
 typedef png_info FAR * FAR * png_infopp;
 
+/* Maximum positive integer used in PNG is (2^31)-1 */
+#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL)
+#define PNG_UINT_32_MAX (~((png_uint_32)0))
+#define PNG_SIZE_MAX (~((png_size_t)0))
+
 /* These describe the color_type field in png_info. */
 /* color type masks */
 #define PNG_COLOR_MASK_PALETTE    1
@@ -1749,6 +1754,8 @@
 PNG_EXTERN png_uint_32 png_get_uint_32 PNGARG((png_bytep buf));
 PNG_EXTERN png_uint_16 png_get_uint_16 PNGARG((png_bytep buf));
 #endif /* PNG_READ_BIG_ENDIAN_SUPPORTED */
+PNG_EXTERN png_uint_32 png_get_uint_31 PNGARG((png_structp png_ptr,
+  png_bytep buf));
 
 /* Initialize png_ptr struct for reading, and allocate any other memory.
  * (old interface - NOT DLL EXPORTED).
diff -r -U 3 libpng-1.0.3/pngrutil.c libpng-1.0.3patch4b/pngrutil.c
--- libpng-1.0.3/pngrutil.c	Wed Jan 13 22:06:39 1999
+++ libpng-1.0.3patch4b/pngrutil.c	Fri Jul 23 22:26:02 2004
@@ -14,6 +14,14 @@
 #define PNG_INTERNAL
 #include "png.h"
 
+png_uint_32 /* PRIVATE */
+png_get_uint_31(png_structp png_ptr, png_bytep buf)
+{
+   png_uint_32 i = png_get_uint_32(buf);
+   if (i > PNG_UINT_31_MAX)
+     png_error(png_ptr, "PNG unsigned integer out of range.\n");
+   return (i);
+}
 #ifndef PNG_READ_BIG_ENDIAN_SUPPORTED
 /* Grab an unsigned 32-bit integer from a buffer in big-endian format. */
 png_uint_32