diff --git a/mozilla/modules/libimg/png/MOZCHANGES b/mozilla/modules/libimg/png/MOZCHANGES
index 8d2254f91a8..b4d122e15d5 100644
--- a/mozilla/modules/libimg/png/MOZCHANGES
+++ b/mozilla/modules/libimg/png/MOZCHANGES
@@ -14,3 +14,6 @@ Bug 81794 - crash/leak fix for pngrutil.c
 Bug 135579 - small interlaced PNG images not decoded correctly.
 	Affected files: pngpread.c
 
+Bug 154996 - PNG files with invalid IHDR can crash/hand browser.
+	Affected files: pngpread.c
+
diff --git a/mozilla/modules/libimg/png/pngpread.c b/mozilla/modules/libimg/png/pngpread.c
index 3c8e08379f7..41ebb5e62fd 100644
--- a/mozilla/modules/libimg/png/pngpread.c
+++ b/mozilla/modules/libimg/png/pngpread.c
@@ -736,6 +736,13 @@ png_process_IDAT_data(png_structp png_ptr, png_bytep buffer,
       }
       if (!(png_ptr->zstream.avail_out))
       {
+         if ((
+#if defined(PNG_READ_INTERLACING_SUPPORTED)
+             png_ptr->interlaced && png_ptr->pass > 6) ||
+             (!png_ptr->interlaced &&
+#endif
+             png_ptr->row_number == png_ptr->num_rows-1))
+           png_error(png_ptr, "Too much data in IDAT chunks");
          png_push_process_row(png_ptr);
          png_ptr->zstream.avail_out = (uInt)png_ptr->irowbytes;
          png_ptr->zstream.next_out = png_ptr->row_buf;