src/share/classes/com/sun/imageio/plugins/png/PNGImageReader.java

@@ -662,10 +662,16 @@
         int colorType = metadata.IHDR_colorType;
         if (ignoreMetadata && colorType != PNG_COLOR_PALETTE) {
             try {
                 while (true) {
                     int chunkLength = stream.readInt();
+
+                    // verify the chunk length first
+                    if (chunkLength < 0 || chunkLength + 4 < 0) {
+                        throw new IIOException("Invalid chunk lenght " + chunkLength);
+                    }
+
                     int chunkType = stream.readInt();
 
                     if (chunkType == IDAT_TYPE) {
                         // We've reached the image data
                         stream.skipBytes(-8);