cirrus_vga: fix off-by-one in blit_region_is_unsafe

cirrus_vga: fix off-by-one in blit_region_is_unsafe

The "max" value is being compared with >=, but addr + width points to
the first byte that will _not_ be copied.  Laszlo suggested using a
"greater than" comparison, instead of subtracting one like it is
already done above for the height, so that max remains always positive.

The mistake is "safe"---it will reject some blits, but will never cause
out-of-bounds writes.

Cc: Gerd Hoffmann <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
Reviewed-by: Laszlo Ersek <[email protected]>
Message-id: 1455121059[email protected]
Signed-off-by: Gerd Hoffmann <[email protected]>