--- /dev/null
+--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-bmp.c.bmp-colormap 2002-09-27 17:12:40.000000000 -0400
++++ gdk-pixbuf-0.22.0/gdk-pixbuf/io-bmp.c 2004-03-03 08:58:43.000000000 -0500
+@@ -129,6 +129,7 @@
+ guint depth;
+ guint Negative; /* Negative = 1 -> top down BMP,
+ Negative = 0 -> bottom up BMP */
++ guint n_colors;
+ };
+
+ /* Data needed for the "state" during decompression */
+@@ -153,8 +154,8 @@
+ guint Lines; /* # of finished lines */
+
+ guchar *buff;
+- gint BufferSize;
+- gint BufferDone;
++ guint BufferSize;
++ guint BufferDone;
+
+ guchar (*Colormap)[3];
+
+@@ -258,6 +259,8 @@
+ DecodeHeader (unsigned char *BFH, unsigned char *BIH,
+ struct bmp_progressive_state *State)
+ {
++ gint clrUsed;
++
+ g_assert (State->read_state == READ_STATE_HEADERS);
+
+ /* FIXME this is totally unrobust against bogus image data. */
+@@ -295,6 +298,23 @@
+ return FALSE;
+ }
+
++ clrUsed = (int) (BIH[35] << 24) + (BIH[34] << 16) + (BIH[33] << 8) + (BIH[32]);
++ if (clrUsed != 0)
++ State->Header.n_colors = clrUsed;
++ else
++ State->Header.n_colors = 1 << State->Header.depth;
++
++ if (State->Header.n_colors > 1 << State->Header.depth) {
++#if 0
++ g_set_error (error,
++ GDK_PIXBUF_ERROR,
++ GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
++ _("BMP image has bogus header data"));
++#endif
++ State->read_state = READ_STATE_ERROR;
++ return FALSE;
++ }
++
+ State->Type = State->Header.depth; /* This may be less trivial someday */
+
+ /* Negative heights indicates bottom-down pixelorder */
+@@ -422,16 +442,25 @@
+ struct bmp_progressive_state *State)
+ {
+ gint i;
+-
++ gint samples;
++
+ g_assert (State->read_state == READ_STATE_PALETTE);
+
++ samples = (State->Header.size == 12 ? 3 : 4);
++ if (State->BufferSize < State->Header.n_colors * samples) {
++ State->BufferSize = State->Header.n_colors * samples;
++ if (!grow_buffer (State))
++ return FALSE;
++ return TRUE;
++ }
++
+ State->Colormap = g_malloc ((1 << State->Header.depth) * sizeof (*State->Colormap));
+
+- for (i = 0; i < (1 << State->Header.depth); i++)
++ for (i = 0; i < State->Header.n_colors; i++)
+ {
+- State->Colormap[i][0] = buff[i * (State->Header.size == 12 ? 3 : 4)];
+- State->Colormap[i][1] = buff[i * (State->Header.size == 12 ? 3 : 4) + 1];
+- State->Colormap[i][2] = buff[i * (State->Header.size == 12 ? 3 : 4) + 2];
++ State->Colormap[i][0] = buff[i * samples];
++ State->Colormap[i][1] = buff[i * samples + 1];
++ State->Colormap[i][2] = buff[i * samples + 2];
+ }
+
+ State->read_state = READ_STATE_DATA;
--- /dev/null
+--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-ico.c.miscfix 2002-09-27 18:19:15.000000000 -0400
++++ gdk-pixbuf-0.22.0/gdk-pixbuf/io-ico.c 2004-03-03 09:30:00.000000000 -0500
+@@ -360,7 +360,7 @@
+ else if (State->Type == 24)
+ State->LineWidth = State->Header.width * 3;
+ else if (State->Type == 16)
+- State->LineWidth = State->Header.height * 2;
++ State->LineWidth = State->Header.width * 2;
+ else if (State->Type == 8)
+ State->LineWidth = State->Header.width * 1;
+ else if (State->Type == 4)