--- a/jdk/src/share/native/sun/awt/libpng/pngrtran.c	Mon Dec 23 14:29:27 2013 +0100
+++ b/jdk/src/share/native/sun/awt/libpng/pngrtran.c	Tue Jan 21 06:45:46 2014 +0400
@@ -1862,6 +1862,9 @@
 
          info_ptr->bit_depth = 8;
          info_ptr->num_trans = 0;
+
+         if (png_ptr->palette == NULL)
+            png_error (png_ptr, "Palette is NULL in indexed image");
       }
       else
       {

--- a/jdk/src/share/native/sun/awt/libpng/pngset.c	Mon Dec 23 14:29:27 2013 +0100
+++ b/jdk/src/share/native/sun/awt/libpng/pngset.c	Tue Jan 21 06:45:46 2014 +0400
@@ -512,6 +512,17 @@
       }
    }
 
+   if ((num_palette > 0 && palette == NULL) ||
+      (num_palette == 0
+#        ifdef PNG_MNG_FEATURES_SUPPORTED
+            && (png_ptr->mng_features_permitted & PNG_FLAG_MNG_EMPTY_PLTE) == 0
+#        endif
+      ))
+   {
+      png_error(png_ptr, "Invalid palette");
+      return;
+   }
+
    /* It may not actually be necessary to set png_ptr->palette here;
     * we do it for backward compatibility with the way the png_handle_tRNS
     * function used to do the allocation.