diff --git a/ANNOUNCE b/ANNOUNCE
index 360f5d1a8..ec945b507 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -1,5 +1,5 @@
 
-Libpng 1.7.0beta69 - November 13, 2015
+Libpng 1.7.0beta69 - November 14, 2015
 
 This is not intended to be a public release.  It will be replaced
 within a few weeks by a public version or by another test version.
@@ -960,11 +960,15 @@ Version 1.7.0beta67 [November 3, 2015]
   Removed much of the long list of previous versions from png.h and
     libpng.3.
 
-Version 1.7.0beta68 [November 13, 2015]
+Version 1.7.0beta68 [November 12, 2015]
   Fixed new bug with CRC error after reading an over-length palette
     (bug report by Cosmin Truta).
   Cleaned up coding style in png_handle_PLTE().
 
+Version 1.7.0beta69 [November 14, 2015]
+  Avoid potential pointer overflow in png_handle_sPLT() and
+    png_handle_pCAL() (Bug report by John Regehr).
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
diff --git a/CHANGES b/CHANGES
index ffe90d58b..bbaac9e6c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5259,10 +5259,14 @@ Version 1.7.0beta67 [November 3, 2015]
   Removed much of the long list of previous versions from png.h and
     libpng.3.
 
-Version 1.7.0beta68 [November 13, 2015]
+Version 1.7.0beta68 [November 12, 2015]
   Fixed new bug with CRC error after reading an over-length palette
     (bug report by Cosmin Truta) (CVE-2015-8126).
   Cleaned up coding style in png_handle_PLTE().
+
+Version 1.7.0beta69 [November 14, 2015]
+  Avoid potential pointer overflow in png_handle_sPLT() and
+    png_handle_pCAL() (Bug report by John Regehr).
    
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
diff --git a/pngrutil.c b/pngrutil.c
index 2e443be28..e7f5bfe1b 100644
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -1530,7 +1530,7 @@ png_handle_sPLT(png_structrp png_ptr, png_inforp info_ptr)
    ++entry_start;
 
    /* A sample depth should follow the separator, and we should be on it  */
-   if (entry_start > buffer + length - 2)
+   if (length < 2 || entry_start > buffer + length - 2)
    {
       png_chunk_benign_error(png_ptr, "malformed");
       return;
@@ -1948,7 +1948,7 @@ png_handle_pCAL(png_structrp png_ptr, png_inforp info_ptr)
    /* We need to have at least 12 bytes after the purpose string
     * in order to get the parameter information.
     */
-   if (endptr <= buf + 12)
+   if (png_ptr->chunk_length < 12 || endptr <= buf + 12)
    {
       png_chunk_benign_error(png_ptr, "invalid");
       return;