LibGfx: Load correct durations for gifs

The wrong shift effectively set the upper byte to 0, meaning that
durations longer than 255 centiseconds (2.55 seconds) were wrapped
around. See serenity-fuzz-corpora for an example.
This commit is contained in:
Ben Wiederhake 2021-05-30 12:37:17 +02:00 committed by Linus Groh
parent 774107f37c
commit a49c77b76d
Notes: sideshowbarker 2024-07-18 17:10:07 +09:00

View file

@ -511,7 +511,7 @@ static bool load_gif_frame_descriptors(GIFLoadingContext& context)
u8 transparent = sub_block[0] & 1;
current_image->transparent = transparent == 1;
u16 duration = sub_block[1] + ((u16)sub_block[2] >> 8);
u16 duration = sub_block[1] + ((u16)sub_block[2] << 8);
current_image->duration = duration;
current_image->transparency_index = sub_block[3];