--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-bmp.c.bmp-colormap	2002-09-27 17:12:40.000000000 -0400
+++ gdk-pixbuf-0.22.0/gdk-pixbuf/io-bmp.c	2004-03-03 08:58:43.000000000 -0500
@@ -129,6 +129,7 @@
 	guint depth;
 	guint Negative;		/* Negative = 1 -> top down BMP,
 				   Negative = 0 -> bottom up BMP */
+	guint  n_colors;
 };
 
 /* Data needed for the "state" during decompression */
@@ -153,8 +154,8 @@
 	guint Lines;		/* # of finished lines */
 
 	guchar *buff;
-	gint BufferSize;
-	gint BufferDone;
+	guint BufferSize;
+	guint BufferDone;
 
 	guchar (*Colormap)[3];
 
@@ -258,6 +259,8 @@
 DecodeHeader (unsigned char *BFH, unsigned char *BIH,
 	      struct bmp_progressive_state *State)
 {
+ 	gint clrUsed;
+ 
 	g_assert (State->read_state == READ_STATE_HEADERS);
 
         /* FIXME this is totally unrobust against bogus image data. */
@@ -295,6 +298,23 @@
 		return FALSE;
 	}
 
+	clrUsed = (int) (BIH[35] << 24) + (BIH[34] << 16) + (BIH[33] << 8) + (BIH[32]);
+	if (clrUsed != 0)
+		State->Header.n_colors = clrUsed;
+	else
+            State->Header.n_colors = 1 << State->Header.depth;
+	
+	if (State->Header.n_colors > 1 << State->Header.depth) {
+#if 0	  
+		g_set_error (error,
+			     GDK_PIXBUF_ERROR,
+			     GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
+			     _("BMP image has bogus header data"));
+#endif		
+		State->read_state = READ_STATE_ERROR;
+		return FALSE;
+	}
+
 	State->Type = State->Header.depth;	/* This may be less trivial someday */
 
 	/* Negative heights indicates bottom-down pixelorder */
@@ -422,16 +442,25 @@
 		struct bmp_progressive_state *State)
 {
 	gint i;
-
+ 	gint samples;
+ 
 	g_assert (State->read_state == READ_STATE_PALETTE);
 
+ 	samples = (State->Header.size == 12 ? 3 : 4);
+ 	if (State->BufferSize < State->Header.n_colors * samples) {
+ 		State->BufferSize = State->Header.n_colors * samples;
+ 		if (!grow_buffer (State))
+ 			return FALSE;
+ 		return TRUE;
+ 	}
+	
 	State->Colormap = g_malloc ((1 << State->Header.depth) * sizeof (*State->Colormap));
 
-	for (i = 0; i < (1 << State->Header.depth); i++)
+ 	for (i = 0; i < State->Header.n_colors; i++)
 	{
-		State->Colormap[i][0] = buff[i * (State->Header.size == 12 ? 3 : 4)];
-		State->Colormap[i][1] = buff[i * (State->Header.size == 12 ? 3 : 4) + 1];
-		State->Colormap[i][2] = buff[i * (State->Header.size == 12 ? 3 : 4) + 2];
+ 		State->Colormap[i][0] = buff[i * samples];
+ 		State->Colormap[i][1] = buff[i * samples + 1];
+ 		State->Colormap[i][2] = buff[i * samples + 2];
 	}
 
 	State->read_state = READ_STATE_DATA;