Imported from libpng-1.4.0beta34.tar
diff --git a/pngpread.c b/pngpread.c
index eda6d04..28e2c76 100644
--- a/pngpread.c
+++ b/pngpread.c
@@ -1,7 +1,7 @@
 
 /* pngpread.c - read a png file in push mode
  *
- * Last changed in libpng 1.4.0 [August 20, 2008]
+ * Last changed in libpng 1.4.0 [September 6, 2008]
  * For conditions of distribution and use, see copyright notice in png.h
  * Copyright (c) 1998-2008 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
@@ -1277,7 +1277,7 @@
                tmp = text;
                text = (png_charp)png_malloc(png_ptr, text_size +
                   (png_ptr->zbuf_size 
-                  - png_ptr->zstream.avail_out));
+                  - png_ptr->zstream.avail_out + 1));
                png_memcpy(text, tmp, text_size);
                png_free(png_ptr, tmp);
                png_memcpy(text + text_size, png_ptr->zbuf,