diff -r -U 3 libpng-1.2.5/pngread.c libpng-1.2.5patch06/pngread.c
--- libpng-1.2.5/pngread.c	Thu Oct  3 06:32:29 2002
+++ libpng-1.2.5patch06/pngread.c	Fri Jul 23 18:59:57 2004
@@ -384,7 +384,7 @@
       png_uint_32 length;
 
       png_read_data(png_ptr, chunk_length, 4);
-      length = png_get_uint_32(chunk_length);
+      length = png_get_uint_31(png_ptr,chunk_length);
 
       png_reset_crc(png_ptr);
       png_crc_read(png_ptr, png_ptr->chunk_name, 4);
@@ -392,9 +392,6 @@
       png_debug2(0, "Reading %s chunk, length=%lu.\n", png_ptr->chunk_name,
          length);
 
-      if (length > PNG_MAX_UINT)
-         png_error(png_ptr, "Invalid chunk length.");
-
       /* This should be a binary subdivision search or a hash for
        * matching the chunk name rather than a linear search.
        */
@@ -673,10 +670,7 @@
             png_crc_finish(png_ptr, 0);
 
             png_read_data(png_ptr, chunk_length, 4);
-            png_ptr->idat_size = png_get_uint_32(chunk_length);
-
-            if (png_ptr->idat_size > PNG_MAX_UINT)
-              png_error(png_ptr, "Invalid chunk length.");
+            png_ptr->idat_size = png_get_uint_31(png_ptr,chunk_length);
 
             png_reset_crc(png_ptr);
             png_crc_read(png_ptr, png_ptr->chunk_name, 4);
@@ -946,15 +940,12 @@
 #endif /* PNG_GLOBAL_ARRAYS */
 
       png_read_data(png_ptr, chunk_length, 4);
-      length = png_get_uint_32(chunk_length);
+      length = png_get_uint_31(png_ptr,chunk_length);
 
       png_reset_crc(png_ptr);
       png_crc_read(png_ptr, png_ptr->chunk_name, 4);
 
       png_debug1(0, "Reading %s chunk.\n", png_ptr->chunk_name);
-
-      if (length > PNG_MAX_UINT)
-         png_error(png_ptr, "Invalid chunk length.");
 
       if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4))
          png_handle_IHDR(png_ptr, info_ptr, length);