diff --git a/fontconfig-validate-offset-in-cache.patch b/fontconfig-validate-offset-in-cache.patch
new file mode 100644
index 0000000..f6d61c9
--- /dev/null
+++ b/fontconfig-validate-offset-in-cache.patch
@@ -0,0 +1,112 @@
+diff -pruN fontconfig-2.11.94.orig/src/fccache.c fontconfig-2.11.94/src/fccache.c
+--- fontconfig-2.11.94.orig/src/fccache.c	2016-08-05 20:07:43.053872110 +0900
++++ fontconfig-2.11.94/src/fccache.c	2016-08-05 20:09:35.819872110 +0900
+@@ -27,6 +27,7 @@
+ #include <fcntl.h>
+ #include <dirent.h>
+ #include <string.h>
++#include <limits.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
+ #include <assert.h>
+@@ -611,6 +612,82 @@ bail:
+     return ret;
+ }
+ 
++static FcBool
++FcCacheOffsetsValid (FcCache *cache)
++{
++    char		*base = (char *)cache;
++    char		*end = base + cache->size;
++    intptr_t		*dirs;
++    FcFontSet		*fs;
++    int			 i, j;
++
++    if (cache->dir < 0 || cache->dir > cache->size - sizeof (intptr_t) ||
++        memchr (base + cache->dir, '\0', cache->size - cache->dir) == NULL)
++        return FcFalse;
++
++    if (cache->dirs < 0 || cache->dirs >= cache->size ||
++        cache->dirs_count < 0 ||
++        cache->dirs_count > (cache->size - cache->dirs) / sizeof (intptr_t))
++        return FcFalse;
++
++    dirs = FcCacheDirs (cache);
++    if (dirs)
++    {
++        for (i = 0; i < cache->dirs_count; i++)
++        {
++            FcChar8	*dir;
++
++            if (dirs[i] < 0 ||
++                dirs[i] > end - (char *) dirs - sizeof (intptr_t))
++                return FcFalse;
++
++            dir = FcOffsetToPtr (dirs, dirs[i], FcChar8);
++            if (memchr (dir, '\0', end - (char *) dir) == NULL)
++                return FcFalse;
++         }
++    }
++
++    if (cache->set < 0 || cache->set > cache->size - sizeof (FcFontSet))
++        return FcFalse;
++
++    fs = FcCacheSet (cache);
++    if (fs)
++    {
++        if (fs->nfont > (end - (char *) fs) / sizeof (FcPattern))
++            return FcFalse;
++
++        if (fs->fonts != 0 && !FcIsEncodedOffset(fs->fonts))
++            return FcFalse;
++
++        for (i = 0; i < fs->nfont; i++)
++        {
++            FcPattern		*font = FcFontSetFont (fs, i);
++            FcPatternElt	*e;
++            FcValueListPtr	 l;
++
++            if ((char *) font < base ||
++                (char *) font > end - sizeof (FcFontSet) ||
++                font->elts_offset < 0 ||
++                font->elts_offset > end - (char *) font ||
++                font->num > (end - (char *) font - font->elts_offset) / sizeof (FcPatternElt))
++                return FcFalse;
++
++
++            e = FcPatternElts(font);
++            if (e->values != 0 && !FcIsEncodedOffset(e->values))
++                return FcFalse;
++
++            for (j = font->num, l = FcPatternEltValues(e); j >= 0 && l; j--, l = FcValueListNext(l))
++                if (l->next != NULL && !FcIsEncodedOffset(l->next))
++                    break;
++            if (j < 0)
++                return FcFalse;
++        }
++    }
++
++    return FcTrue;
++}
++
+ /*
+  * Map a cache file into memory
+  */
+@@ -620,7 +697,8 @@ FcDirCacheMapFd (FcConfig *config, int f
+     FcCache	*cache;
+     FcBool	allocated = FcFalse;
+ 
+-    if (fd_stat->st_size < (int) sizeof (FcCache))
++    if (fd_stat->st_size > INTPTR_MAX ||
++        fd_stat->st_size < (int) sizeof (FcCache))
+ 	return NULL;
+     cache = FcCacheFindByStat (fd_stat);
+     if (cache)
+@@ -677,6 +755,7 @@ FcDirCacheMapFd (FcConfig *config, int f
+     if (cache->magic != FC_CACHE_MAGIC_MMAP ||
+ 	cache->version < FC_CACHE_VERSION_NUMBER ||
+ 	cache->size != (intptr_t) fd_stat->st_size ||
++	!FcCacheOffsetsValid (cache) ||
+ 	!FcCacheTimeValid (config, cache, dir_stat) ||
+ 	!FcCacheDirsValid (config, cache) ||
+ 	!FcCacheInsert (cache, fd_stat))
diff --git a/fontconfig.spec b/fontconfig.spec
index 0ef491a..1f46967 100644
--- a/fontconfig.spec
+++ b/fontconfig.spec
@@ -3,7 +3,7 @@
 Summary:	Font configuration and customization library
 Name:		fontconfig
 Version:	2.11.94
-Release:	4%{?dist}
+Release:	5%{?dist}
 # src/ftglue.[ch] is in Public Domain
 # src/fccache.c contains Public Domain code
 # fc-case/CaseFolding.txt is in the UCD
@@ -18,6 +18,8 @@ Source1:	25-no-bitmap-fedora.conf
 Patch0:		%{name}-sleep-less.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1236034
 Patch1:		%{name}-lock-cache.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1364439
+Patch2:		%{name}-validate-offset-in-cache.patch
 
 BuildRequires:	expat-devel
 BuildRequires:	freetype-devel >= %{freetype_version}
@@ -62,6 +64,7 @@ which is useful for developing applications that uses fontconfig.
 %setup -q
 %patch0 -p1 -b .sleep-less
 %patch1 -p1 -b .lock-cache
+%patch2 -p1 -b .validate-offset
 
 %build
 # We don't want to rebuild the docs, but we want to install the included ones.
@@ -138,6 +141,9 @@ fi
 %doc fontconfig-devel.txt fontconfig-devel
 
 %changelog
+* Fri Aug  5 2016 Akira TAGOH <tagoh@redhat.com> - 2.11.94-5
+- CVE-2016-5384: Validate offsets in cache files properly. (#1364439)
+
 * Fri Aug 14 2015 Akira TAGOH <tagoh@redhat.com> - 2.11.94-4
 - Revise the patch. (#1236034)