diff --git a/ANNOUNCE b/ANNOUNCE
index 749e49f7e..f8b093ca4 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -1,5 +1,5 @@
 
-Libpng 1.4.1beta08 - February 7, 2010
+Libpng 1.4.1beta09 - February 8, 2010
 
 This is not intended to be a public release.  It will be replaced
 within a few weeks by a public version or by another test version.
@@ -9,20 +9,20 @@ Files available for download:
 Source files with LF line endings (for Unix/Linux) and with a
 "configure" script
 
-   1.4.1beta08.tar.xz (LZMA-compressed, recommended)
-   1.4.1beta08.tar.gz
-   1.4.1beta08.tar.bz2
+   1.4.1beta09.tar.xz (LZMA-compressed, recommended)
+   1.4.1beta09.tar.gz
+   1.4.1beta09.tar.bz2
 
 Source files with CRLF line endings (for Windows), without the
 "configure" script
 
-   lp141b08.zip
-   lp141b08.7z
+   lp141b09.zip
+   lp141b09.7z
 
 Other information:
 
-   1.4.1beta08-README.txt
-   1.4.1beta08-LICENSE.txt
+   1.4.1beta09-README.txt
+   1.4.1beta09-LICENSE.txt
 
 Changes since the last public release (1.4.0):
 
@@ -66,7 +66,11 @@ version 1.4.1beta07 [February 6, 2010]
     png_ptr->png_user_chunk_malloc_max.
   Revised png_push_save_buffer() to do fewer but larger png_malloc() calls.
 
-version 1.4.1beta08 [February 7, 2010]
+version 1.4.1beta08 [February 6, 2010]
+  Minor cleanup and updating of dates and copyright year.
+
+version 1.4.1beta09 [February 8, 2010]
+  Fixed incorrect test in new png_push_save_buffer() code.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
diff --git a/CHANGES b/CHANGES
index cf13e9b1f..d569d4e7f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2499,7 +2499,11 @@ version 1.4.1beta07 [February 6, 2010]
     png_ptr->png_user_chunk_malloc_max.
   Revised png_push_save_buffer() to do fewer but larger png_malloc() calls.
 
-version 1.4.1beta08 [February 7, 2010]
+version 1.4.1beta08 [February 6, 2010]
+  Minor cleanup and updating of dates and copyright year.
+
+version 1.4.1beta09 [February 8, 2010]
+  Fixed incorrect test in new png_push_save_buffer() code.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
diff --git a/pngpread.c b/pngpread.c
index 40ae34995..999aec43b 100644
--- a/pngpread.c
+++ b/pngpread.c
@@ -1,7 +1,7 @@
 
 /* pngpread.c - read a png file in push mode
  *
- * Last changed in libpng 1.4.1 [February 7, 2010]
+ * Last changed in libpng 1.4.1 [February 8, 2010]
  * Copyright (c) 1998-2010 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
@@ -692,8 +692,10 @@ png_push_save_buffer(png_structp png_ptr)
       png_size_t new_max;
       png_bytep old_buffer;
 
-      if (png_ptr->save_buffer_size == PNG_SIZE_MAX)
-        png_error(png_ptr, "Overflow of save_buffer");
+      if (png_ptr->save_buffer_max == PNG_SIZE_MAX ||
+          (png_ptr->save_buffer_size > PNG_SIZE_MAX -
+          png_ptr->current_buffer_size))
+         png_error(png_ptr, "Overflow of save_buffer");
 
       if (png_ptr->save_buffer_size > PNG_SIZE_MAX -
           (png_ptr->current_buffer_size +
@@ -805,7 +807,7 @@ png_push_read_IDAT(png_structp png_ptr)
 
       png_calculate_crc(png_ptr, png_ptr->current_buffer_ptr, save_size);
       if (!(png_ptr->flags & PNG_FLAG_ZLIB_FINISHED))
-        png_process_IDAT_data(png_ptr, png_ptr->current_buffer_ptr, save_size);
+         png_process_IDAT_data(png_ptr, png_ptr->current_buffer_ptr, save_size);
 
       png_ptr->idat_size -= save_size;
       png_ptr->buffer_size -= save_size;