Fix to upstream bug
https://github.com/python-pillow/Pillow/pull/1060

Patch based on upstream commit to Pillow 2.7.0 (PIL fork)
https://github.com/wiredfool/Pillow/commit/44286ba3c9bfa6ed565d11bd61460d8ec215e1ea

Note that this patch includes a test of the fix, which requires an 
image file which is copied in from files/png_decompress_dos.png,
since it cannot be patched in.

--- Imaging-1.1.7-orig/PIL/PngImagePlugin.py	2015-01-21 17:45:12.000000000 -0800
+++ Imaging-1.1.7/PIL/PngImagePlugin.py	2015-01-21 19:37:23.000000000 -0800
@@ -68,6 +68,12 @@ _MODES = {
     (16,6): ("RGBA", "RGBA;16B"),
 }
 
+def _safe_zlib_decompress(s):
+    dobj = zlib.decompressobj()
+    plaintext = dobj.decompress(s, ImageFile.SAFEBLOCK)
+    if dobj.unconsumed_tail:
+        raise ValueError("Decompressed Data Too Large")
+    return plaintext
 
 # --------------------------------------------------------------------
 # Support classes.  Suitable for PNG and related formats like MNG etc.
@@ -197,7 +203,7 @@ class PngStream(ChunkStream):
         if comp_method != 0:
             raise SyntaxError("Unknown compression method %s in iCCP chunk" % comp_method)
         try:
-            icc_profile = zlib.decompress(s[i+2:])
+            icc_profile = _safe_zlib_decompress(s[i+2:])
         except zlib.error:
             icc_profile = None # FIXME
         self.im_info["icc_profile"] = icc_profile
@@ -293,7 +299,7 @@ class PngStream(ChunkStream):
         if comp_method != 0:
             raise SyntaxError("Unknown compression method %s in zTXt chunk" % comp_method)
         import zlib
-        self.im_info[k] = self.im_text[k] = zlib.decompress(v[1:])
+        self.im_info[k] = self.im_text[k] = _safe_zlib_decompress(v[1:])
         return s
 
 # --------------------------------------------------------------------
--- Imaging-1.1.7-orig/selftest.py	2015-01-21 17:44:51.000000000 -0800
+++ Imaging-1.1.7/selftest.py	2015-07-02 17:06:23.636751412 -0700
@@ -9,6 +9,7 @@ from PIL import Image
 from PIL import ImageDraw
 from PIL import ImageFilter
 from PIL import ImageMath
+from PIL import PngImagePlugin
 
 try:
     Image.core.ping
@@ -146,6 +147,15 @@ def testimage():
     >>> im.mode, im.size
     ('F', (128, 128))
 
+    Test fix to PNG decompression DOS #1060
+
+    >>> try:
+    ...  im = Image.open("Images/png_decompression_dos.png")
+    ...  im.load()
+    ... except ValueError as msg:
+    ...  print msg
+    Decompressed Data Too Large
+
     PIL can do many other things, but I'll leave that for another
     day.  If you're curious, check the handbook, available from: