vga: fix region calculation

vga: fix region calculation

Typically the scanline length and the line offset are identical.  But
in case they are not our calculation for region_end is incorrect.  Using
line_offset is fine for all scanlines, except the last one where we have
to use the actual scanline length.

Fixes: CVE-2018-7550
Reported-by: Ross Lagerwall <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>
Reviewed-by: Prasad J Pandit <[email protected]>
Tested-by: Ross Lagerwall <[email protected]>
Message-id: 20180309143704[email protected]