An integer underflow was found in gdk-pixbuf that allows an attacker to make different calls
to gdk_pixbuf_loader_write with a huge (2^32-1) count (size of buffer) that can be bigger than the actual size of given buffer. It is possible to give the loader any data we want so we can call any desired loader that it's data is recognized. This may lead to various behaviors - multiple out-of-buffer reads, infinite loops, or allocation attempt with the size.

References:

http://seclists.org/oss-sec/2017/q1/466
http://mov.sx/2017/02/21/bug-hunting-gdk-pixbuf.html

Upstream bug:

https://bugzilla.gnome.org/show_bug.cgi?id=779016