--- libpng-1.6.15/pngrutil.c	2014-11-20 09:33:24.154247319 -0600
+++ libpng-1.6.16/pngrutil.c	2014-12-21 21:08:07.563612499 -0600
@@ -2998,17 +2998,17 @@ png_check_chunk_name(png_structrp png_pt
  * (dp) is filled from the start by replicating the available pixels.  If
  * 'display' is false only those pixels present in the pass are filled in.
  */
 void /* PRIVATE */
 png_combine_row(png_const_structrp png_ptr, png_bytep dp, int display)
 {
    unsigned int pixel_depth = png_ptr->transformed_pixel_depth;
    png_const_bytep sp = png_ptr->row_buf + 1;
-   png_uint_32 row_width = png_ptr->width;
+   png_alloc_size_t row_width = png_ptr->width;
    unsigned int pass = png_ptr->pass;
    png_bytep end_ptr = 0;
    png_byte end_byte = 0;
    unsigned int end_mask;
 
    png_debug(1, "in png_combine_row");
 
    /* Added in 1.5.6: it should not be possible to enter this routine until at
@@ -3273,17 +3273,17 @@ png_combine_row(png_const_structrp png_p
             /* When doing the 'block' algorithm the pixel in the pass gets
              * replicated to adjacent pixels.  This is why the even (0,2,4,6)
              * passes are skipped above - the entire expanded row is copied.
              */
             bytes_to_copy = (1<<((6-pass)>>1)) * pixel_depth;
 
             /* But don't allow this number to exceed the actual row width. */
             if (bytes_to_copy > row_width)
-               bytes_to_copy = row_width;
+               bytes_to_copy = (unsigned int)/*SAFE*/row_width;
          }
 
          else /* normal row; Adam7 only ever gives us one pixel to copy. */
             bytes_to_copy = pixel_depth;
 
          /* In Adam7 there is a constant offset between where the pixels go. */
          bytes_to_jump = PNG_PASS_COL_OFFSET(pass) * pixel_depth;
 
@@ -3453,17 +3453,17 @@ png_combine_row(png_const_structrp png_p
 
                   if (row_width <= bytes_to_jump)
                      return;
 
                   sp += bytes_to_jump;
                   dp += bytes_to_jump;
                   row_width -= bytes_to_jump;
                   if (bytes_to_copy > row_width)
-                     bytes_to_copy = row_width;
+                     bytes_to_copy = (unsigned int)/*SAFE*/row_width;
                }
          }
 
          /* NOT REACHED*/
       } /* pixel_depth >= 8 */
 
       /* Here if pixel_depth < 8 to check 'end_ptr' below. */
    }