diff --git a/3rdparty/FreeImage/Source/LibPNG/pngpread.c b/3rdparty/FreeImage/Source/LibPNG/pngpread.c
index c4ba51c..e9f7239 100644
--- a/3rdparty/FreeImage/Source/LibPNG/pngpread.c
+++ b/3rdparty/FreeImage/Source/LibPNG/pngpread.c
@@ -223,6 +223,22 @@ png_push_read_chunk(png_structrp png_ptr, png_inforp info_ptr)
       if ((png_ptr->mode & PNG_AFTER_IDAT) != 0)
          png_benign_error(png_ptr, "Too many IDATs found");
    }
+   
+   else
+   {
+      png_alloc_size_t limit = PNG_SIZE_MAX;
+   # ifdef PNG_SET_USER_LIMITS_SUPPORTED
+      if (png_ptr->user_chunk_malloc_max > 0 &&
+          png_ptr->user_chunk_malloc_max < limit)
+         limit = png_ptr->user_chunk_malloc_max;
+   # elif PNG_USER_CHUNK_MALLOC_MAX > 0
+      if (PNG_USER_CHUNK_MALLOC_MAX < limit)
+         limit = PNG_USER_CHUNK_MALLOC_MAX;
+   # endif
+      if (png_ptr->push_length > limit)
+         png_chunk_error(png_ptr, "chunk data is too large");
+   }
+
 
    if (chunk_name == png_IHDR)
    {
diff --git a/3rdparty/FreeImage/Source/LibPNG/pngrutil.c b/3rdparty/FreeImage/Source/LibPNG/pngrutil.c
index 7001f19..71ec370 100644
--- a/3rdparty/FreeImage/Source/LibPNG/pngrutil.c
+++ b/3rdparty/FreeImage/Source/LibPNG/pngrutil.c
@@ -183,6 +183,23 @@ png_read_chunk_header(png_structrp png_ptr)
 
    /* Check for too-large chunk length */
    png_check_chunk_length(png_ptr, length);
+   
+      /* Check for too-large chunk length */
+   if (png_ptr->chunk_name != png_IDAT)
+   {
+      png_alloc_size_t limit = PNG_SIZE_MAX;
+   # ifdef PNG_SET_USER_LIMITS_SUPPORTED
+      if (png_ptr->user_chunk_malloc_max > 0 &&
+          png_ptr->user_chunk_malloc_max < limit)
+         limit = png_ptr->user_chunk_malloc_max;
+   # elif PNG_USER_CHUNK_MALLOC_MAX > 0
+      if (PNG_USER_CHUNK_MALLOC_MAX < limit)
+         limit = PNG_USER_CHUNK_MALLOC_MAX;
+   # endif
+      if (length > limit)
+         png_chunk_error(png_ptr, "chunk data is too large");
+   }
+
 
 #ifdef PNG_IO_STATE_SUPPORTED
    png_ptr->io_state = PNG_IO_READING | PNG_IO_CHUNK_DATA;