diff -NurdB gdk-pixbuf-0.22.0/gdk-pixbuf/io-ico.c gdk-pixbuf-0.22.0-patched/gdk-pixbuf/io-ico.c
--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-ico.c	2002-09-27 17:19:15.000000000 -0500
+++ gdk-pixbuf-0.22.0-patched/gdk-pixbuf/io-ico.c	2005-10-27 11:28:23.000000000 -0500
@@ -330,6 +330,9 @@
 
 	State->HeaderSize+=I;
 
+ 	if (State->HeaderSize < 0)
+ 		return FALSE;
+ 
  	if (State->HeaderSize>State->BytesInHeaderBuf) {
 		guchar *tmp=realloc(State->HeaderBuf,State->HeaderSize);
 		if (!tmp)
diff -NurdB gdk-pixbuf-0.22.0/gdk-pixbuf/io-xpm.c gdk-pixbuf-0.22.0-patched/gdk-pixbuf/io-xpm.c
--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-xpm.c	2001-03-01 15:16:28.000000000 -0500
+++ gdk-pixbuf-0.22.0-patched/gdk-pixbuf/io-xpm.c	2005-10-27 11:29:14.000000000 -0500
@@ -243,8 +243,8 @@
 			break;
 		else {
 			if (numnames > 0) {
-				space -= 1;
-				strcat (color, " ");
+				strncat (color, " ", space);
+				space -= MIN (space, 1);
 			}
 
 			strncat (color, temp, space);
@@ -281,7 +281,8 @@
 		/* Fall through to the xpm_read_string. */
 
 	case op_body:
-		xpm_read_string (h->infile, &h->buffer, &h->buffer_size);
+		if(!xpm_read_string (h->infile, &h->buffer, &h->buffer_size))
+			return NULL;
 		return h->buffer;
 
 	default:
@@ -317,13 +318,6 @@
 	return NULL;
 }
 
-/* Destroy notification function for the pixbuf */
-static void
-free_buffer (guchar *pixels, gpointer data)
-{
-	free (pixels);
-}
-
 static gboolean
 xpm_color_parse (const char *spec, XColor *color)
 {
@@ -342,7 +336,8 @@
 	gchar pixel_str[32];
 	GHashTable *color_hash;
 	_XPMColor *colors, *color, *fallbackcolor;
-	guchar *pixels, *pixtmp;
+	guchar *pixtmp;
+	GdkPixbuf* pixbuf;
 
 	fallbackcolor = NULL;
 
@@ -352,16 +347,33 @@
 		return NULL;
 	}
 	sscanf (buffer, "%d %d %d %d", &w, &h, &n_col, &cpp);
-	if (cpp >= 32) {
-		g_warning ("XPM has more than 31 chars per pixel.");
+	if (cpp <= 0 || cpp >= 32) {
+		g_warning ("XPM has invalid number of chars per pixel.");
 		return NULL;
 	}
+	if (n_col <= 0 ||
+	    n_col >= G_MAXINT / (cpp + 1) ||
+	    n_col >= G_MAXINT / sizeof (_XPMColor)) {
+		g_warning ("XPM file has invalid number of colors");
+  		return NULL;
+  	}
 
 	/* The hash is used for fast lookups of color from chars */
 	color_hash = g_hash_table_new (g_str_hash, g_str_equal);
 
-	name_buf = g_new (gchar, n_col * (cpp + 1));
-	colors = g_new (_XPMColor, n_col);
+ 	name_buf = g_new (gchar, n_col * (cpp + 1));
+ 	if (!name_buf) {
+		g_warning ("Cannot allocate memory for loading XPM image");
+ 		g_hash_table_destroy (color_hash);
+ 		return NULL;
+ 	}
+ 	colors = g_new (_XPMColor, n_col);
+ 	if (!colors) {
+		g_warning ("Cannot allocate memory for loading XPM image");
+ 		g_hash_table_destroy (color_hash);
+ 		g_free (name_buf);
+ 		return NULL;
+ 	}
 
 	for (cnt = 0; cnt < n_col; cnt++) {
 		gchar *color_name;
@@ -397,12 +409,8 @@
 			fallbackcolor = color;
 	}
 
-	if (is_trans)
-		pixels = malloc (w * h * 4);
-	else
-		pixels = malloc (w * h * 3);
-
-	if (!pixels) {
+	pixbuf = gdk_pixbuf_new(GDK_COLORSPACE_RGB, is_trans, 8, w, h);
+	if (!pixbuf) {
 		g_hash_table_destroy (color_hash);
 		g_free (colors);
 		g_free (name_buf);
@@ -410,7 +418,7 @@
 	}
 
 	wbytes = w * cpp;
-	pixtmp = pixels;
+	pixtmp = pixbuf->pixels;
 
 	for (ycnt = 0; ycnt < h; ycnt++) {
 		buffer = (*get_buf) (op_body, handle);
@@ -443,9 +451,7 @@
 	g_free (colors);
 	g_free (name_buf);
 
-	return gdk_pixbuf_new_from_data (pixels, GDK_COLORSPACE_RGB, is_trans, 8,
-					 w, h, is_trans ? (w * 4) : (w * 3),
-					 free_buffer, NULL);
+	return pixbuf;
 }
 
 /* Shared library entry point for file loading */