File libpng-1.2.31-CVE-2008-3964.patch of Package libpng12-0

--- pngpread.c
+++ pngpread.c
@@ -1279,7 +1279,7 @@
                tmp = text;
                text = (png_charp)png_malloc(png_ptr, text_size +
                   (png_uint_32)(png_ptr->zbuf_size 
-                  - png_ptr->zstream.avail_out));
+                  - png_ptr->zstream.avail_out + 1));
                png_memcpy(text, tmp, text_size);
                png_free(png_ptr, tmp);
                png_memcpy(text + text_size, png_ptr->zbuf,