From 6da7445762ece33ebcb3211ca95128207bb95e1c Mon Sep 17 00:00:00 2001 From: "reed%reedloden.com" Date: Sat, 19 Jan 2008 07:00:24 +0000 Subject: [PATCH] Bug 411874 - "Crash [@ ffff068b nsGIFDecoder2::EndImageFrame] while loading MySpace page (hard to repro)" [p=alfredkayser@gmail.com (Alfred Kayser) r=stuart a1.9=schrep] git-svn-id: svn://10.0.0.236/trunk@243528 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mozilla/modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp b/mozilla/modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp index 37476e88902..5d8eb9728f2 100644 --- a/mozilla/modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp +++ b/mozilla/modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp @@ -395,7 +395,7 @@ void nsGIFDecoder2::EndImageFrame() if (mGIFStruct.rows_remaining != mGIFStruct.height) { if (mGIFStruct.rows_remaining && mGIFStruct.images_decoded) { // Clear the remaining rows (only needed for the animation frames) - PRUint8 *rowp = mImageData + ((mGIFStruct.rows_remaining - mGIFStruct.height) * mGIFStruct.width); + PRUint8 *rowp = mImageData + ((mGIFStruct.height - mGIFStruct.rows_remaining) * mGIFStruct.width); memset(rowp, 0, mGIFStruct.rows_remaining * mGIFStruct.width); }