diff --git a/gdk-pixbuf/ChangeLog b/gdk-pixbuf/ChangeLog
index f7a07f30d7..fd6924645a 100644
--- a/gdk-pixbuf/ChangeLog
+++ b/gdk-pixbuf/ChangeLog
@@ -1,3 +1,8 @@
+2002-10-23  Matthias Clasen  <maclas@gmx.de>
+
+	* io-gif.c (lzw_read_byte): Check for stack overflow throughout.
+	(#91808, Elliot Lee)
+
 Thu Oct  3 18:25:57 2002  Owen Taylor  <otaylor@redhat.com>
 
 	* io-jpeg.c (gdk_pixbuf__jpeg_image_save): 
diff --git a/gdk-pixbuf/io-gif.c b/gdk-pixbuf/io-gif.c
index 09c843e840..e3293da405 100644
--- a/gdk-pixbuf/io-gif.c
+++ b/gdk-pixbuf/io-gif.c
@@ -534,6 +534,14 @@ gif_lzw_clear_code (GifContext *context)
 	return 0;
 }
 
+#define CHECK_LZW_SP() if(((guchar *)context->lzw_sp) >= (((guchar *)context->lzw_stack) + sizeof(context->lzw_stack))) { \
+        g_set_error (context->error,                  \
+                     GDK_PIXBUF_ERROR,                \
+                     GDK_PIXBUF_ERROR_CORRUPT_IMAGE,  \
+                     _("Stack overflow"));            \
+        return -2;                                    \
+}
+
 static int
 lzw_read_byte (GifContext *context)
 {
@@ -608,19 +616,20 @@ lzw_read_byte (GifContext *context)
 		incode = code;
 
 		if (code >= context->lzw_max_code) {
+                        CHECK_LZWP_SP ();
 			*(context->lzw_sp)++ = context->lzw_firstcode;
 			code = context->lzw_oldcode;
 		}
 
 		while (code >= context->lzw_clear_code) {
-                        if ((code >= (1 << MAX_LZW_BITS)) 
-                            || (context->lzw_sp >= context->lzw_stack + ((1 << (MAX_LZW_BITS)) * 2 + 1))) {
+                        if (code >= (1 << MAX_LZW_BITS)) {
                                 g_set_error (context->error,
                                              GDK_PIXBUF_ERROR,
                                              GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
                                              _("Bad code encountered"));
 				return -2;
                         }
+                        CHECK_LZWP_SP ();
 			*(context->lzw_sp)++ = context->lzw_table[1][code];
 
 			if (code == context->lzw_table[0][code]) {
@@ -633,6 +642,7 @@ lzw_read_byte (GifContext *context)
 			code = context->lzw_table[0][code];
 		}
 
+                CHECK_LZWP_SP ();
 		*(context->lzw_sp)++ = context->lzw_firstcode = context->lzw_table[1][code];
 
 		if ((code = context->lzw_max_code) < (1 << MAX_LZW_BITS)) {