Fix for the buffer overflow in the PNG reading code

See: http://www.cups.org/str.php?L2974
Obtained from: http://www.cups.org/strfiles/2974/str2974.patch

Index: filter/image-png.c
===================================================================
--- filter/image-png.c	(revision 8062)
+++ filter/image-png.c	(working copy)
@@ -178,7 +178,7 @@
     {
       bufsize = img->xsize * img->ysize;
 
-      if ((bufsize / img->ysize) != img->xsize)
+      if ((bufsize / img->xsize) != img->ysize)
       {
 	fprintf(stderr, "DEBUG: PNG image dimensions (%ux%u) too large!\n",
 		(unsigned)width, (unsigned)height);
@@ -190,7 +190,7 @@
     {
       bufsize = img->xsize * img->ysize * 3;
 
-      if ((bufsize / (img->ysize * 3)) != img->xsize)
+      if ((bufsize / (img->xsize * 3)) != img->ysize)
       {
 	fprintf(stderr, "DEBUG: PNG image dimensions (%ux%u) too large!\n",
 		(unsigned)width, (unsigned)height);
