Fix memory copy in QGIFFormat::disposePrevious()

Fix invalid destination address in memcpy operation when RestoreImage disposal method is used.

Task-number: QTBUG-71599
Change-Id: Ib74a044c0e45250ff708268c463f831ee54933e6
Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>

1 files changed, 2 insertions, 2 deletions

diff --git a/src/plugins/imageformats/gif/qgifhandler.cpp b/src/plugins/imageformats/gif/qgifhandler.cpp
index ebe5964664..1aef1a24d2 100644
--- a/src/plugins/imageformats/gif/qgifhandler.cpp
+++ b/src/plugins/imageformats/gif/qgifhandler.cpp
@@ -213,7 +213,7 @@ void QGIFFormat::disposePrevious(QImage *image)
       case RestoreImage: {
         if (frame >= 0) {
             for (int ln=t; ln<=b; ln++) {
-                memcpy(image->scanLine(ln)+l,
+                memcpy(image->scanLine(ln)+l*sizeof(QRgb),
                     backingstore.constScanLine(ln-t),
                     (r-l+1)*sizeof(QRgb));
             }
@@ -426,7 +426,7 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length,
                     unsigned char *dest_data = backingstore.bits();
                     for (int ln=0; ln<h; ln++) {
                         memcpy(FAST_SCAN_LINE(dest_data, dest_bpl, ln),
-                               FAST_SCAN_LINE(bits, bpl, t+ln) + l, w*sizeof(QRgb));
+                               FAST_SCAN_LINE(bits, bpl, t+ln) + l*sizeof(QRgb), w*sizeof(QRgb));
                     }
                 }