diff -ur firefox-10.0.1/media/libpng/pngrutil.c firefox-10.0.2/media/libpng/pngrutil.c --- firefox-10.0.1/media/libpng/pngrutil.c 2012-02-08 15:16:36.000000000 +0100 +++ firefox-10.0.2/media/libpng/pngrutil.c 2012-02-16 07:40:46.000000000 +0100 @@ -401,8 +401,15 @@ { /* Success (maybe) - really uncompress the chunk. */ png_size_t new_size = 0; - png_charp text = png_malloc_warn(png_ptr, - prefix_size + expanded_size + 1); + png_charp text = NULL; + /* Need to check for both truncation (64-bit platforms) and integer + * overflow. + */ + if (prefix_size + expanded_size > prefix_size && + prefix_size + expanded_size < 0xffffffffU) + { + text = png_malloc_warn(png_ptr, prefix_size + expanded_size + 1); + } if (text != NULL) {