LibGfx: Load correct durations for gifs

The wrong shift effectively set the upper byte to 0, meaning that
durations longer than 255 centiseconds (2.55 seconds) were wrapped
around. See serenity-fuzz-corpora for an example.

1 files changed, 1 insertions, 1 deletions

diff --git a/Userland/Libraries/LibGfx/GIFLoader.cpp b/Userland/Libraries/LibGfx/GIFLoader.cpp
index 41a33b736f..a4d9a9d497 100644
--- a/Userland/Libraries/LibGfx/GIFLoader.cpp
+++ b/Userland/Libraries/LibGfx/GIFLoader.cpp
@@ -511,7 +511,7 @@ static bool load_gif_frame_descriptors(GIFLoadingContext& context)
                 u8 transparent = sub_block[0] & 1;
                 current_image->transparent = transparent == 1;
 
-                u16 duration = sub_block[1] + ((u16)sub_block[2] >> 8);
+                u16 duration = sub_block[1] + ((u16)sub_block[2] << 8);
                 current_image->duration = duration;
 
                 current_image->transparency_index = sub_block[3];