diff --git a/tests/test_invariant_rpng2-x.c b/tests/test_invariant_rpng2-x.c
new file mode 100644
index 00000000000..f5fd77f3c54
--- /dev/null
+++ b/tests/test_invariant_rpng2-x.c
@@ -0,0 +1,80 @@
+#include <check.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+
+/* Declare the vulnerable function from the actual source file */
+extern void create_titlebar(char *titlebar, const char *appname, const char *filename);
+
+START_TEST(test_buffer_reads_never_exceed_declared_length)
+{
+    /* Invariant: Buffer reads never exceed the declared length of 1024 bytes */
+    const char *appname = "rpng2";
+    const char *payloads[] = {
+        /* Exact exploit case: alen=5, flen=1020, total=1028 > 1023, triggers truncation */
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+        /* Boundary case: alen=5, flen=1018, total=1026 > 1023, triggers truncation */
+        "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+        "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+        "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+        "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+        "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+        "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+        "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+        "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+        "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+        "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+        "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+        "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+        "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+        "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+        "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+        "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB",
+        /* Valid input: alen=5, flen=10, total=18 < 1023, no truncation */
+        "short.png"
+    };
+    int num_payloads = sizeof(payloads) / sizeof(payloads[0]);
+
+    for (int i = 0; i < num_payloads; i++) {
+        char titlebar[1024];
+        /* Initialize buffer with sentinel values to detect overflow */
+        memset(titlebar, 0xAA, sizeof(titlebar));
+        titlebar[1023] = '\0';
+        
+        /* Call the actual production function */
+        create_titlebar(titlebar, appname, payloads[i]);
+        
+        /* Check that buffer null-terminator is within bounds */
+        ck_assert_msg(strnlen(titlebar, 1024) < 1024,
+                     "Buffer overflow detected: titlebar exceeds 1023 characters");
+        /* Verify sentinel byte after buffer (simulated via last byte check) */
+        ck_assert_msg(titlebar[1023] == '\0',
+                     "Buffer null-terminator corrupted, indicating overflow");
+    }
+}
+END_TEST
+
+Suite *security_suite(void)
+{
+    Suite *s;
+    TCase *tc_core;
+
+    s = suite_create("Security");
+    tc_core = tcase_create("Core");
+
+    tcase_add_test(tc_core, test_buffer_reads_never
\ No newline at end of file
diff --git a/workbench/libs/png/contrib/gregbook/rpng2-x.c b/workbench/libs/png/contrib/gregbook/rpng2-x.c
index af944c0f2bf..c10ce042066 100644
--- a/workbench/libs/png/contrib/gregbook/rpng2-x.c
+++ b/workbench/libs/png/contrib/gregbook/rpng2-x.c
@@ -564,10 +564,10 @@ int main(int argc, char **argv)
 
     alen = strlen(appname);
     flen = strlen(filename);
-    if (alen + flen + 3 > 1023)
-        sprintf(titlebar, "%s:  ...%s", appname, filename+(alen+flen+6-1023));
+    if (alen + flen + 6 > 1023)
+        snprintf(titlebar, 1024, "%s:  ...%s", appname, filename+(alen+flen+6-1023));
     else
-        sprintf(titlebar, "%s:  %s", appname, filename);
+        snprintf(titlebar, 1024, "%s:  %s", appname, filename);
 
 
     /* set some final rpng2_info variables before entering main data loop */
@@ -789,13 +789,13 @@ static void rpng2_x_init(void)
         return;
     }
 
-    rpng2_info.image_data = (uch *)malloc(rowbytes * rpng2_info.height);
+    rpng2_info.image_data = (uch *)calloc(rpng2_info.height, rowbytes);
     if (!rpng2_info.image_data) {
         readpng2_cleanup(&rpng2_info);
         return;
     }
 
-    rpng2_info.row_pointers = (uch **)malloc(rpng2_info.height * sizeof(uch *));
+    rpng2_info.row_pointers = (uch **)calloc(rpng2_info.height, sizeof(uch *));
     if (!rpng2_info.row_pointers) {
         free(rpng2_info.image_data);
         rpng2_info.image_data = NULL;
@@ -1003,13 +1003,13 @@ static int rpng2_x_create_window(void)
   ---------------------------------------------------------------------------*/
 
     if (depth == 24 || depth == 32) {
-        xdata = (uch *)malloc(4*rpng2_info.width*rpng2_info.height);
+        xdata = (uch *)calloc(rpng2_info.height, 4*rpng2_info.width);
         pad = 32;
     } else if (depth == 16) {
-        xdata = (uch *)malloc(2*rpng2_info.width*rpng2_info.height);
+        xdata = (uch *)calloc(rpng2_info.height, 2*rpng2_info.width);
         pad = 16;
     } else /* depth == 8 */ {
-        xdata = (uch *)malloc(rpng2_info.width*rpng2_info.height);
+        xdata = (uch *)calloc(rpng2_info.height, rpng2_info.width);
         pad = 8;
     }
 
@@ -1103,7 +1103,7 @@ static int rpng2_x_load_bg_image(void)
   ---------------------------------------------------------------------------*/
 
     bg_rowbytes = 3 * rpng2_info.width;
-    bg_data = (uch *)malloc(bg_rowbytes * rpng2_info.height);
+    bg_data = (uch *)calloc(rpng2_info.height, bg_rowbytes);
     if (!bg_data) {
         fprintf(stderr, PROGNAME
           ":  unable to allocate memory for background image\n");