From 9f2216667a96c2de94b28e4fd2891b6d3b938cb9 Mon Sep 17 00:00:00 2001
From: Andrew Smolko <andrewsmolko@gmail.com>
Date: Tue, 6 Nov 2018 11:20:34 +0300
Subject: Fix memory copy in QGIFFormat::disposePrevious()

Fix invalid destination address in memcpy operation when RestoreImage disposal method is used.

Task-number: QTBUG-71599
Change-Id: Ib74a044c0e45250ff708268c463f831ee54933e6
Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
---
 src/plugins/imageformats/gif/qgifhandler.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'src/plugins/imageformats/gif/qgifhandler.cpp')

diff --git a/src/plugins/imageformats/gif/qgifhandler.cpp b/src/plugins/imageformats/gif/qgifhandler.cpp
index ebe5964664..1aef1a24d2 100644
--- a/src/plugins/imageformats/gif/qgifhandler.cpp
+++ b/src/plugins/imageformats/gif/qgifhandler.cpp
@@ -213,7 +213,7 @@ void QGIFFormat::disposePrevious(QImage *image)
       case RestoreImage: {
         if (frame >= 0) {
             for (int ln=t; ln<=b; ln++) {
-                memcpy(image->scanLine(ln)+l,
+                memcpy(image->scanLine(ln)+l*sizeof(QRgb),
                     backingstore.constScanLine(ln-t),
                     (r-l+1)*sizeof(QRgb));
             }
@@ -426,7 +426,7 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length,
                     unsigned char *dest_data = backingstore.bits();
                     for (int ln=0; ln<h; ln++) {
                         memcpy(FAST_SCAN_LINE(dest_data, dest_bpl, ln),
-                               FAST_SCAN_LINE(bits, bpl, t+ln) + l, w*sizeof(QRgb));
+                               FAST_SCAN_LINE(bits, bpl, t+ln) + l*sizeof(QRgb), w*sizeof(QRgb));
                     }
                 }
 
-- 
cgit v1.2.3