diff -r -U 3 libpng-1.0.1/png.h libpng-1.0.1patch04c/png.h
--- libpng-1.0.1/png.h	Sun Mar 15 18:20:23 1998
+++ libpng-1.0.1patch04c/png.h	Fri Jul 23 22:32:46 2004
@@ -404,6 +404,11 @@
 typedef png_info FAR * png_infop;
 typedef png_info FAR * FAR * png_infopp;
 
+/* Maximum positive integer used in PNG is (2^31)-1 */
+#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL)
+#define PNG_UINT_32_MAX (~((png_uint_32)0))
+#define PNG_SIZE_MAX (~((png_size_t)0))
+
 /* These describe the color_type field in png_info. */
 /* color type masks */
 #define PNG_COLOR_MASK_PALETTE    1
@@ -1591,6 +1596,8 @@
 PNG_EXTERN png_uint_32 png_get_uint_32 PNGARG((png_bytep buf));
 PNG_EXTERN png_uint_16 png_get_uint_16 PNGARG((png_bytep buf));
 #endif /* PNG_BIG_ENDIAN_GET_SUPPORTED */
+PNG_EXTERN png_uint_32 png_get_uint_31 PNGARG((png_structp png_ptr,
+  png_bytep buf));
 
 /* Initialize png_ptr struct for reading, and allocate any other memory.
  * (old interface - NOT DLL EXPORTED).
diff -r -U 3 libpng-1.0.1/pngrutil.c libpng-1.0.1patch04c/pngrutil.c
--- libpng-1.0.1/pngrutil.c	Sun Mar 15 18:20:23 1998
+++ libpng-1.0.1patch04c/pngrutil.c	Fri Jul 23 22:32:46 2004
@@ -15,6 +15,14 @@
 #define PNG_INTERNAL
 #include "png.h"
 
+png_uint_32 /* PRIVATE */
+png_get_uint_31(png_structp png_ptr, png_bytep buf)
+{
+   png_uint_32 i = png_get_uint_32(buf);
+   if (i > PNG_UINT_31_MAX)
+     png_error(png_ptr, "PNG unsigned integer out of range.\n");
+   return (i);
+}
 #ifndef PNG_READ_BIG_ENDIAN_SUPPORTED
 /* Grab an unsigned 32-bit integer from a buffer in big endian format. */
 png_uint_32