diff --git a/src/gl/render_img.c b/src/gl/render_img.c
index 13f29ca..2d8379a 100644
--- a/src/gl/render_img.c
+++ b/src/gl/render_img.c
@@ -50,7 +50,7 @@ void render_blit_img_toimg(uint32_t *pixels, int width, int height, int pitch,
 	float scalex, float scaley);
 
 img_t *render_dump_img(int width, int height, int sx, int sy) {
-	size_t img_size = (width - sx) * (height - sy) * 3;
+	size_t img_size = width * height * 3;
 	img_t *img = malloc(sizeof(img_t) + img_size);
 	img->head.idlen = 0; // no ID
 	img->head.cmtype = 0; // no colourmap
@@ -60,8 +60,8 @@ img_t *render_dump_img(int width, int height, int sx, int sy) {
 	img->head.cmbpp = 0;
 	img->head.xstart = 0;
 	img->head.ystart = height - sy;
-	img->head.width = width - sx;
-	img->head.height = height - sy;
+	img->head.width = width;
+	img->head.height = height;
 	img->head.bpp = 24;
 	img->head.flags = 0x0;
 	img->udtype = UD_IMG;
diff --git a/src/png.c b/src/png.c
index 084f3b7..1631b09 100644
--- a/src/png.c
+++ b/src/png.c
@@ -526,14 +526,18 @@ void img_write_png(const char *fname, img_t *img)
 	size_t img_size = row_size * img->head.height;
 	size_t img_uncomp_len = (row_size - (gap-1)) * img->head.height;
 	uint8_t *img_uncomp = malloc(img_uncomp_len);
-#ifdef _MSC_VER
-	// TODO: broken?
-	uint8_t **rowP = alloca(row_size * 1);
-	uint8_t **rowC = alloca(row_size * 5);
-#else
-	uint8_t rowP[1][row_size];
-	uint8_t rowC[5][row_size];
-#endif
+
+	uint8_t *rowPbuf = malloc(row_size * 1);
+	uint8_t *rowCbuf = malloc(row_size * 5);
+	uint8_t *rowP[1];
+	uint8_t *rowC[5];
+
+	rowP[0] = rowPbuf;
+	for(i = 0; i < 5; i++)
+	{
+		rowC[i] = &rowCbuf[row_size*i];
+	}
+
 	uint8_t *src_pixels = (uint8_t *)(img->pixels);
 	int rowsel = 0;
 
@@ -549,7 +553,7 @@ void img_write_png(const char *fname, img_t *img)
 			rowC[0][x] = 0;
 
 		// Copy to last
-		memcpy(rowP, rowC[0], row_size);
+		memcpy(rowP[0], rowC[0], row_size);
 
 		// Grab current pixel run
 		memcpy(rowC[0] + gap,
@@ -649,6 +653,10 @@ void img_write_png(const char *fname, img_t *img)
 			rowC[rbest] + (gap-1), row_size - (gap-1));
 	}
 
+	// Free buffers
+	free(rowCbuf);
+	free(rowPbuf);
+
 	// Compress image
 	uLongf cbound = compressBound(img_size);
 	uint8_t *img_comp = malloc(cbound);