diff --git a/ChangeLog b/ChangeLog
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@ 2007-09-17  Sven Neumann  <sven@gimp.org
+2007-09-17  Nils Philippsen  <nphilipp@redhat.com>
+
+	* plug-ins/common/pcx.c (load_image): verify that the bytesperline header
+	field (number of bytes to allocate per plane and line) isn't less than the
+	width of the image
+
 2007-09-17  Sven Neumann  <sven@gimp.org>
 
 	* modules/cdisplay_proof.c: use a GimpColorProfileComboBox for
diff --git a/plug-ins/common/pcx.c b/plug-ins/common/pcx.c
--- a/plug-ins/common/pcx.c
+++ b/plug-ins/common/pcx.c
@@ -332,7 +332,7 @@ load_image (const gchar *filename)
   FILE         *fd;
   GimpDrawable *drawable;
   GimpPixelRgn  pixel_rgn;
-  guint16       offset_x, offset_y;
+  guint16       offset_x, offset_y, bytesperline;
   gint32        width, height;
   gint32        image, layer;
   guchar       *dest, cmap[768];
@@ -369,6 +369,7 @@ load_image (const gchar *filename)
   offset_y = GUINT16_FROM_LE (pcx_header.y1);
   width = GUINT16_FROM_LE (pcx_header.x2) - offset_x + 1;
   height = GUINT16_FROM_LE (pcx_header.y2) - offset_y + 1;
+  bytesperline = GUINT16_FROM_LE (pcx_header.bytesperline);
 
   if ((width < 0) || (width > GIMP_MAX_IMAGE_SIZE))
     {
@@ -378,6 +379,11 @@ load_image (const gchar *filename)
   if ((height < 0) || (height > GIMP_MAX_IMAGE_SIZE))
     {
       g_message (_("Unsupported or invalid image height: %d"), height);
+      return -1;
+    }
+  if (bytesperline < width)
+    {
+      g_message (_("Insufficient number of bytes per plane and line: %d (must be %d at minimum)"), bytesperline, width);
       return -1;
     }
 
@@ -401,22 +407,19 @@ load_image (const gchar *filename)
   if (pcx_header.planes == 1 && pcx_header.bpp == 1)
     {
       dest = (guchar *) g_malloc (width * height);
-      load_1 (fd, width, height, dest,
-              GUINT16_FROM_LE (pcx_header.bytesperline));
+      load_1 (fd, width, height, dest, bytesperline);
       gimp_image_set_colormap (image, mono, 2);
     }
   else if (pcx_header.planes == 4 && pcx_header.bpp == 1)
     {
       dest = (guchar *) g_malloc (width * height);
-      load_4 (fd, width, height, dest,
-              GUINT16_FROM_LE (pcx_header.bytesperline));
+      load_4 (fd, width, height, dest, bytesperline);
       gimp_image_set_colormap (image, pcx_header.colormap, 16);
     }
   else if (pcx_header.planes == 1 && pcx_header.bpp == 8)
     {
       dest = (guchar *) g_malloc (width * height);
-      load_8 (fd, width, height, dest,
-              GUINT16_FROM_LE (pcx_header.bytesperline));
+      load_8 (fd, width, height, dest, bytesperline);
       fseek (fd, -768L, SEEK_END);
       fread (cmap, 768, 1, fd);
       gimp_image_set_colormap (image, cmap, 256);
@@ -424,8 +427,7 @@ load_image (const gchar *filename)
   else if (pcx_header.planes == 3 && pcx_header.bpp == 8)
     {
       dest = (guchar *) g_malloc (width * height * 3);
-      load_24 (fd, width, height, dest,
-               GUINT16_FROM_LE (pcx_header.bytesperline));
+      load_24 (fd, width, height, dest, bytesperline);
     }
   else
     {
