gifdec: fix invalid write in giff_fill_rect

Signed-off-by: Paul B Mahol <onemda@gmail.com>

libavcodec/gifdec.c

@@ -99,7 +99,7 @@ static void gif_fill_rect(AVFrame *picture, uint32_t color, int l, int t, int w,
 {
     const int linesize = picture->linesize[0] / sizeof(uint32_t);
     const uint32_t *py = (uint32_t *)picture->data[0] + t * linesize;
-    const uint32_t *pr, *pb = py + (t + h) * linesize;
+    const uint32_t *pr, *pb = py + h * linesize;
     uint32_t *px;
 
     for (; py < pb; py += linesize) {