--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-bmp.c.bmp-colormap	2002-09-27 17:12:40.000000000 -0400

+++ gdk-pixbuf-0.22.0/gdk-pixbuf/io-bmp.c	2004-03-03 08:58:43.000000000 -0500

@@ -129,6 +129,7 @@

 	guint depth;

 	guint Negative;		/* Negative = 1 -> top down BMP,

 				   Negative = 0 -> bottom up BMP */

+	guint  n_colors;

 };

 /* Data needed for the "state" during decompression */

@@ -153,8 +154,8 @@

 	guint Lines;		/* # of finished lines */

 	guchar *buff;

-	gint BufferSize;

-	gint BufferDone;

+	guint BufferSize;

+	guint BufferDone;

 	guchar (*Colormap)[3];

@@ -258,6 +259,8 @@

 DecodeHeader (unsigned char *BFH, unsigned char *BIH,

 	      struct bmp_progressive_state *State)

 {

+ 	gint clrUsed;

+ 

 	g_assert (State->read_state == READ_STATE_HEADERS);

         /* FIXME this is totally unrobust against bogus image data. */

@@ -295,6 +298,23 @@

 		return FALSE;

 	}

+	clrUsed = (int) (BIH[35] << 24) + (BIH[34] << 16) + (BIH[33] << 8) + (BIH[32]);

+	if (clrUsed != 0)

+		State->Header.n_colors = clrUsed;

+	else

+            State->Header.n_colors = 1 << State->Header.depth;

+	

+	if (State->Header.n_colors > 1 << State->Header.depth) {

+#if 0	  

+		g_set_error (error,

+			     GDK_PIXBUF_ERROR,

+			     GDK_PIXBUF_ERROR_CORRUPT_IMAGE,

+			     _("BMP image has bogus header data"));

+#endif		

+		State->read_state = READ_STATE_ERROR;

+		return FALSE;

+	}

+

 	State->Type = State->Header.depth;	/* This may be less trivial someday */

 	/* Negative heights indicates bottom-down pixelorder */

@@ -422,16 +442,25 @@

 		struct bmp_progressive_state *State)

 {

 	gint i;

-

+ 	gint samples;

+ 

 	g_assert (State->read_state == READ_STATE_PALETTE);

+ 	samples = (State->Header.size == 12 ? 3 : 4);

+ 	if (State->BufferSize < State->Header.n_colors * samples) {

+ 		State->BufferSize = State->Header.n_colors * samples;

+ 		if (!grow_buffer (State))

+ 			return FALSE;

+ 		return TRUE;

+ 	}

+	

 	State->Colormap = g_malloc ((1 << State->Header.depth) * sizeof (*State->Colormap));

-	for (i = 0; i < (1 << State->Header.depth); i++)

+ 	for (i = 0; i < State->Header.n_colors; i++)

 	{

-		State->Colormap[i][0] = buff[i * (State->Header.size == 12 ? 3 : 4)];

-		State->Colormap[i][1] = buff[i * (State->Header.size == 12 ? 3 : 4) + 1];

-		State->Colormap[i][2] = buff[i * (State->Header.size == 12 ? 3 : 4) + 2];

+ 		State->Colormap[i][0] = buff[i * samples];

+ 		State->Colormap[i][1] = buff[i * samples + 1];

+ 		State->Colormap[i][2] = buff[i * samples + 2];

 	}

 	State->read_state = READ_STATE_DATA;