diff --git a/ANNOUNCE b/ANNOUNCE
index a5e091aaa..575a01408 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -35,6 +35,7 @@ Version 1.5.14beta01 [October 24, 2012]
 Version 1.5.14beta02 [December 10, 2012]
   Added missing "-" in front of DNO_GZIP in contrib/pngminim/*/makefile.
   Check for png_ptr==NULL earlier in png_zalloc().
+  Ignore, with a warning, out-of-range value of num_trans in png_set_tRNS().
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
diff --git a/CHANGES b/CHANGES
index 657ba60bf..e2b909e9a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3928,6 +3928,7 @@ Version 1.5.14beta01 [October 24, 2012]
 Version 1.5.14beta02 [December 10, 2012]
   Added missing "-" in front of DNO_GZIP in contrib/pngminim/*/makefile.
   Check for png_ptr==NULL earlier in png_zalloc().
+  Ignore, with a warning, out-of-range value of num_trans in png_set_tRNS().
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
diff --git a/pngset.c b/pngset.c
index 8c07eec3e..95975e665 100644
--- a/pngset.c
+++ b/pngset.c
@@ -897,6 +897,12 @@ png_set_tRNS(png_structp png_ptr, png_infop info_ptr,
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
+   if (num_trans < 0 || num_trans > PNG_MAX_PALETTE_LENGTH)
+      {
+        png_warning(png_ptr, "Ignoring invalid num_trans value");
+        return;
+      }
+
    if (trans_alpha != NULL)
    {
        /* It may not actually be necessary to set png_ptr->trans_alpha here;