--- gdk-pixbuf-2.36.0-plain/gdk-pixbuf/io-ico.c	2016-09-13 03:17:02.000000000 +0000
+++ gdk-pixbuf-2.36.0/gdk-pixbuf/io-ico.c	2016-11-19 22:40:27.791673055 +0000
@@ -310,7 +310,7 @@ static void DecodeHeader(guchar *Data, g
 	for (l = State->entries; l != NULL; l = g_list_next (l)) {
 		entry = l->data;
 
-		if (entry->DIBoffset < 0) {
+		if (entry->DIBoffset < 0 || INT_MAX-40 < entry->DIBoffset) {
 			g_set_error (error,
 			             GDK_PIXBUF_ERROR,
 			             GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
