diff -Naur original/generic/tkImgGIF.c patched/generic/tkImgGIF.c
--- original/generic/tkImgGIF.c	2017-03-29 21:02:38.000000000 +0100
+++ patched/generic/tkImgGIF.c	2017-04-06 18:30:48.683360575 +0100
@@ -1571,6 +1571,7 @@
 	}
 	memcpy(dst, handle->data, (size_t) (hunk * count));
 	handle->data += hunk * count;
+	handle->length -= hunk * count;
 	return (int)(hunk * count);
     }
 
diff -Naur original/tests/imgPhoto.test patched/tests/imgPhoto.test
--- original/tests/imgPhoto.test	2017-03-29 21:02:38.000000000 +0100
+++ patched/tests/imgPhoto.test	2017-04-08 13:28:33.527582980 +0100
@@ -59,6 +59,25 @@
 set teapotPhotoFile [file join [file dirname [info script]] teapot.ppm]
 testConstraint hasTeapotPhoto [file exists $teapotPhotoFile]
 
+# - Tests 18.1-18.9 cause segfault on Tk 8.5 < 8.5.20.
+proc test18ok {} {
+    expr {
+            ([package vsatisfies $::tk_patchLevel 8.6])
+	 || (    ($::tk_version eq "8.5")
+              && ([package vcompare $::tk_patchLevel 8.5.20] == 1)
+	    )
+    }
+}
+
+proc base64ok {} {
+    expr {
+        ![catch {package require base64}]
+    }
+}
+
+testConstraint SegfaultOn8.5 [test18ok]
+testConstraint base64PackageNeeded [base64ok]
+
 # ----------------------------------------------------------------------
 
 test imgPhoto-1.1 {options for photo images} -body {
@@ -1169,6 +1188,144 @@
     catch {removeFile $f}
 } -result "P6\n"
 
+# Reject corrupted or truncated image [Bug b601ce3ab1].
+# WARNING - tests marked "SegfaultOn8.5" will cause a segfault on
+# 8.5.19 and lower.
+test imgPhoto-18.1 {Reject corrupted GIF (binary string)} -constraints {
+    SegfaultOn8.5 base64PackageNeeded
+} -setup {
+    package require base64
+    set data [base64::decode {
+	R0lGODlhwjMz//8zM/8z/zP/MzP/////M////yH5CiwheLrcLTBCd6Tv2qW16tdK4jhV
+	5qpraXIvM1JlNyAgOw==
+    }]
+} -body {
+    image create photo gif1 -data $data
+} -cleanup {
+    catch {image delete gif1}
+} -returnCodes error -result {error reading color map}
+test imgPhoto-18.2 {Reject corrupted GIF (base 64 string)} -constraints {
+    SegfaultOn8.5
+} -setup {
+    set data {
+	R0lGODlhwjMz//8zM/8z/zP/MzP/////M////yH5CiwheLrcLTBCd6Tv2qW16tdK4jhV
+	5qpraXIvM1JlNyAgOw==
+    }
+} -body {
+    image create photo gif1 -data $data
+} -cleanup {
+    catch {image delete gif1}
+} -returnCodes error -result {error reading color map}
+test imgPhoto-18.3 {Reject corrupted GIF (file)} -constraints {
+    SegfaultOn8.5
+} -setup {
+    set fileName [file join [file dirname [info script]] corruptMangled.gif]
+} -body {
+    image create photo gif1 -file $fileName
+} -cleanup {
+    catch {image delete gif1}
+} -returnCodes error -result {error reading color map}
+test imgPhoto-18.4 {Reject truncated GIF (binary string)} -constraints {
+    SegfaultOn8.5 base64PackageNeeded
+} -setup {
+    package require base64
+    set data [base64::decode {
+	R0lGODlhEAAQAMIHAAAAADMz//8zM/8z/zP/MzP///8=
+    }]
+} -body {
+    image create photo gif1 -data $data
+} -cleanup {
+    catch {image delete gif1}
+} -returnCodes error -result {error reading color map}
+test imgPhoto-18.5 {Reject truncated GIF (base 64 string)} -constraints {
+    SegfaultOn8.5
+} -setup {
+    set data {
+	R0lGODlhEAAQAMIHAAAAADMz//8zM/8z/zP/MzP///8=
+    }
+} -body {
+    image create photo gif1 -data $data
+} -cleanup {
+    catch {image delete gif1}
+} -returnCodes error -result {error reading color map}
+test imgPhoto-18.6 {Reject truncated GIF (file)} -constraints {
+    SegfaultOn8.5
+} -setup {
+    set fileName [file join [file dirname [info script]] corruptTruncated.gif]
+} -body {
+    image create photo gif1 -file $fileName
+} -cleanup {
+    catch {image delete gif1}
+} -returnCodes error -result {error reading color map}
+test imgPhoto-18.7 {Reject corrupted GIF (> 4Gb) (binary string)} -constraints {
+    SegfaultOn8.5 base64PackageNeeded
+} -setup {
+    package require base64
+    set data [base64::decode {
+	R0lGODlhwmYz//8zM/8z/zP/MzP/////M////yH5Ciwhe
+	LrcLTBCd6Tv2qW16tdK4jhV5qpraXIvM1JlNyAgOw==
+    }]
+} -body {
+    image create photo gif1 -data $data
+} -cleanup {
+    catch {image delete gif1}
+} -returnCodes error -result {not enough free memory for image buffer}
+test imgPhoto-18.8 {Reject corrupted GIF (> 4Gb) (base 64 string)} -constraints {
+    SegfaultOn8.5
+} -setup {
+    set data {
+	R0lGODlhwmYz//8zM/8z/zP/MzP/////M////yH5Ciwhe
+	LrcLTBCd6Tv2qW16tdK4jhV5qpraXIvM1JlNyAgOw==
+    }
+} -body {
+    image create photo gif1 -data $data
+} -cleanup {
+    catch {image delete gif1}
+} -returnCodes error -result {not enough free memory for image buffer}
+test imgPhoto-18.9 {Reject corrupted GIF (> 4Gb) (file)} -constraints {
+    SegfaultOn8.5
+} -setup {
+    set fileName [file join [file dirname [info script]] corruptMangled4G.gif]
+} -body {
+    image create photo gif1 -file $fileName
+} -cleanup {
+    catch {image delete gif1}
+} -returnCodes error -result {not enough free memory for image buffer}
+test imgPhoto-18.10 {Valid GIF (binary string)} -constraints {
+    base64PackageNeeded
+} -setup {
+    # Test the binary string reader with a valid GIF.
+    # This is not tested elsewhere.
+    # Tests 18.11, 18.12, with matching data, are included for completeness.
+    package require base64
+    set data [base64::decode {
+	R0lGODlhEAAQAMIHAAAAADMz//8zM/8z/zP/MzP/////M////yH5BAEKAAcALAAA
+	AAAQABAAAAMheLrcLTBCd6QV79qlterXB0riOFXmmapraXIvM1IdZTcJADs=
+    }]
+} -body {
+    image create photo gif1 -data $data
+} -cleanup {
+    catch {image delete gif1}
+} -result gif1
+test imgPhoto-18.11 {Valid GIF (base 64 string)} -setup {
+    set data {
+	R0lGODlhEAAQAMIHAAAAADMz//8zM/8z/zP/MzP/////M////yH5BAEKAAcALAAA
+	AAAQABAAAAMheLrcLTBCd6QV79qlterXB0riOFXmmapraXIvM1IdZTcJADs=
+    }
+} -body {
+    image create photo gif1 -data $data
+} -cleanup {
+    catch {image delete gif1}
+} -result gif1
+test imgPhoto-18.12 {Valid GIF (file)} -setup {
+    set fileName [file join [file dirname [info script]] red.gif]
+} -body {
+    image create photo gif1 -file $fileName
+} -cleanup {
+    catch {image delete gif1}
+} -result gif1
+
+
 # ----------------------------------------------------------------------
 
 catch {rename foreachPixel {}}
