Index: gdk-pixbuf/io-ico.c
===================================================================
--- gdk-pixbuf/io-ico.c	(revision 357)
+++ gdk-pixbuf/io-ico.c	(working copy)
@@ -269,6 +269,13 @@
 	   so we know how many bytes are in the "header" part. */
 	      
 	State->HeaderSize = State->DIBoffset + 40; /* 40 = sizeof(InfoHeader) */
+	if (State->HeaderSize < 0) {
+		g_set_error (error,
+			     GDK_PIXBUF_ERROR,
+			     GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
+			     _("Invalid header in icon"));
+		return;
+	}
 	
  	if (State->HeaderSize>State->BytesInHeaderBuf) {
  		guchar *tmp=g_try_realloc(State->HeaderBuf,State->HeaderSize);
