libpng integer overflow

Integer overflow on PNG parsing leads to heap buffer overflow...