gifdec: fix invalid write in giff_fill_rect

Signed-off-by: Paul B Mahol <onemda@gmail.com>
12 years ago · c004de0b1c
parent 103410d67e
commit c004de0b1c
1 changed files with 1 additions and 1 deletions
--- a/libavcodec/gifdec.c
+++ b/libavcodec/gifdec.c
@ -99,7 +99,7 @@ static void gif_fill_rect(AVFrame *picture, uint32_t color, int l, int t, int w,
 {
    const int linesize = picture->linesize[0] / sizeof(uint32_t);
    const uint32_t *py = (uint32_t *)picture->data[0] + t * linesize;
-    const uint32_t *pr, *pb = py + (t + h) * linesize;
+    const uint32_t *pr, *pb = py + h * linesize;
    uint32_t *px;

    for (; py < pb; py += linesize) {