diff --git a/pngminus/pnm2png.c b/pngminus/pnm2png.c
index 052fd32..bdcd083 100644
--- a/pngminus/pnm2png.c
+++ b/pngminus/pnm2png.c
@@ -375,6 +375,11 @@ BOOL do_pnm2png (png_struct *png_ptr, png_info *info_ptr,
   /* allocate the rows using the same memory layout as libpng, and transfer
    * their ownership to libpng, with the responsibility to clean everything up;
    * please note the use of png_calloc instead of png_malloc */
+  /* Guard against integer overflow: height * sizeof(png_byte*) can wrap on
+   * 32-bit systems when height is large, producing a tiny allocation that
+   * subsequent writes overrun. */
+  if (height > PNG_SIZE_MAX / sizeof (png_byte *))
+    png_error (png_ptr, "image height too large for row-pointer allocation");
   row_pointers = (png_byte **)
                  png_calloc (png_ptr, height * sizeof (png_byte *));
   png_set_rows (png_ptr, info_ptr, row_pointers);