[Qemu-devel] [PATCH] cirrus_vga: fix off-by-one in blit_region_is_unsafe

[Paolo Bonzini]

The "max" value is being compared with >=, but addr + width points to
the first byte that will _not_ be copied.  Subtract one like it is
already done above for the height.

Cc: Gerd Hoffmann <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
 hw/display/cirrus_vga.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index b6ce1c8..e7939d2 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -275,14 +275,14 @@ static bool blit_region_is_unsafe(struct CirrusVGAState 
*s,
         int64_t min = addr
             + ((int64_t)s->cirrus_blt_height-1) * pitch;
         int32_t max = addr
-            + s->cirrus_blt_width;
+            + s->cirrus_blt_width-1;
         if (min < 0 || max >= s->vga.vram_size) {
             return true;
         }
     } else {
         int64_t max = addr
             + ((int64_t)s->cirrus_blt_height-1) * pitch
-            + s->cirrus_blt_width;
+            + s->cirrus_blt_width-1;
         if (max >= s->vga.vram_size) {
             return true;
         }
-- 
2.5.0