--- libpng3-1.2.1.orig/pngpread.c
+++ libpng3-1.2.1/pngpread.c
@@ -736,6 +736,13 @@
       }
       if (!(png_ptr->zstream.avail_out))
       {
+         if ((
+#if defined(PNG_READ_INTERLACING_SUPPORTED)
+             png_ptr->interlaced && png_ptr->pass > 6) ||
+             (!png_ptr->interlaced &&
+#endif
+             png_ptr->row_number == png_ptr->num_rows-1))
+           png_error(png_ptr, "Too much data in IDAT chunks");
          png_push_process_row(png_ptr);
          png_ptr->zstream.avail_out = (uInt)png_ptr->irowbytes;
          png_ptr->zstream.next_out = png_ptr->row_buf;