diff --git a/cupsfilters/image-png.c b/cupsfilters/image-png.c
index 9f482fafa..0346b2c83 100644
--- a/cupsfilters/image-png.c
+++ b/cupsfilters/image-png.c
@@ -165,7 +165,8 @@ _cfImageReadPNG(
     img->colorspace = secondary;
 
   if (width == 0 || width > CF_IMAGE_MAX_WIDTH ||
-      height == 0 || height > CF_IMAGE_MAX_HEIGHT)
+      height == 0 || height > CF_IMAGE_MAX_HEIGHT ||
+      width > CF_IMAGE_MAX_PIXELS || height > CF_IMAGE_MAX_PIXELS)
   {
     DEBUG_printf(("DEBUG: PNG image has invalid dimensions %ux%u!\n",
 		  (unsigned)width, (unsigned)height));
diff --git a/cupsfilters/image-private.h b/cupsfilters/image-private.h
index d0c2daf7f..461c8b6a6 100644
--- a/cupsfilters/image-private.h
+++ b/cupsfilters/image-private.h
@@ -52,6 +52,14 @@
 #  define CF_IMAGE_MAX_HEIGHT	0x3fffffff
 					// 2^30-1
 
+#  define CF_IMAGE_MAX_PIXELS	283465
+					// Max pixels per side: 5 m at 1440 dpi,
+					// the largest realistic print (5 m-wide
+					// inkjets exist). Bounding each dimension
+					// keeps the decoded buffer-size
+					// multiplication from overflowing;
+					// allocations too large for the machine
+					// then fail gracefully at malloc().
 #  define CF_TILE_SIZE		256	// 256x256 pixel tiles
 #  define CF_TILE_MINIMUM	10	// Minimum number of tiles