diff options
author | Andrew Smolko <andrewsmolko@gmail.com> | 2018-11-06 11:20:34 +0300 |
---|---|---|
committer | Andrew Smolko <andrewsmolko@gmail.com> | 2018-11-06 12:54:17 +0000 |
commit | 9f2216667a96c2de94b28e4fd2891b6d3b938cb9 (patch) | |
tree | 9964acb64763a7b7880b6260073cddee2dbfffa2 /src/plugins/imageformats/gif | |
parent | 033cc3403a8238d1b6d56c42e9e9be4fba1069dc (diff) |
Fix memory copy in QGIFFormat::disposePrevious()
Fix invalid destination address in memcpy operation when RestoreImage disposal method is used.
Task-number: QTBUG-71599
Change-Id: Ib74a044c0e45250ff708268c463f831ee54933e6
Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
Diffstat (limited to 'src/plugins/imageformats/gif')
-rw-r--r-- | src/plugins/imageformats/gif/qgifhandler.cpp | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/plugins/imageformats/gif/qgifhandler.cpp b/src/plugins/imageformats/gif/qgifhandler.cpp index ebe5964664..1aef1a24d2 100644 --- a/src/plugins/imageformats/gif/qgifhandler.cpp +++ b/src/plugins/imageformats/gif/qgifhandler.cpp @@ -213,7 +213,7 @@ void QGIFFormat::disposePrevious(QImage *image) case RestoreImage: { if (frame >= 0) { for (int ln=t; ln<=b; ln++) { - memcpy(image->scanLine(ln)+l, + memcpy(image->scanLine(ln)+l*sizeof(QRgb), backingstore.constScanLine(ln-t), (r-l+1)*sizeof(QRgb)); } @@ -426,7 +426,7 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length, unsigned char *dest_data = backingstore.bits(); for (int ln=0; ln<h; ln++) { memcpy(FAST_SCAN_LINE(dest_data, dest_bpl, ln), - FAST_SCAN_LINE(bits, bpl, t+ln) + l, w*sizeof(QRgb)); + FAST_SCAN_LINE(bits, bpl, t+ln) + l*sizeof(QRgb), w*sizeof(QRgb)); } } |