[FFmpeg-cvslog] gifdec: fix invalid write in giff_fill_rect

[Paul B Mahol]

ffmpeg | branch: master | Paul B Mahol <onemda at gmail.com> | Thu Dec 20 17:45:04 2012 +0000| [c004de0b1c5b44849f9619910c173d1a2204c16e] | committer: Paul B Mahol

gifdec: fix invalid write in giff_fill_rect

Signed-off-by: Paul B Mahol <onemda at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c004de0b1c5b44849f9619910c173d1a2204c16e
---

 libavcodec/gifdec.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/gifdec.c b/libavcodec/gifdec.c
index 53b1bb8..59574e9 100644
--- a/libavcodec/gifdec.c
+++ b/libavcodec/gifdec.c
@@ -99,7 +99,7 @@ static void gif_fill_rect(AVFrame *picture, uint32_t color, int l, int t, int w,
 {
     const int linesize = picture->linesize[0] / sizeof(uint32_t);
     const uint32_t *py = (uint32_t *)picture->data[0] + t * linesize;
-    const uint32_t *pr, *pb = py + (t + h) * linesize;
+    const uint32_t *pr, *pb = py + h * linesize;
     uint32_t *px;
 
     for (; py < pb; py += linesize) {