--- a/modules/libpr0n/encoders/png/nsPNGEncoder.cpp
+++ b/modules/libpr0n/encoders/png/nsPNGEncoder.cpp
@@ -696,16 +696,17 @@ nsPNGEncoder::WriteCallback(png_structp 
 
     // expand buffer, just double each time
     that->mImageBufferSize *= 2;
     PRUint8* newBuf = (PRUint8*)PR_Realloc(that->mImageBuffer,
                                            that->mImageBufferSize);
     if (! newBuf) {
       // can't resize, just zero (this will keep us from writing more)
       PR_Free(that->mImageBuffer);
+      that->mImageBuffer = nsnull;
       that->mImageBufferSize = 0;
       that->mImageBufferUsed = 0;
       return;
     }
     that->mImageBuffer = newBuf;
   }
   memcpy(&that->mImageBuffer[that->mImageBufferUsed], data, size);
   that->mImageBufferUsed += size;