On Mi, 2016-02-10 at 17:17 +0100, Paolo Bonzini wrote: > The "max" value is being compared with >=, but addr + width points to > the first byte that will _not_ be copied. Laszlo suggested using a > "greater than" comparison, instead of subtracting one like it is > already done above for the height, so that max remains always > positive. > > The mistake is "safe"---it will reject some blits, but will never > cause > out-of-bounds writes.
added to vga queue. thanks, Gerd
