> > diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
> > index 379910d..7ddd289 100644
> > --- a/hw/display/cirrus_vga.c
> > +++ b/hw/display/cirrus_vga.c
> > @@ -277,7 +277,8 @@ static bool blit_region_is_unsafe(struct CirrusVGAState
> > *s,
> > }
> > if (pitch < 0) {
> > int64_t min = addr
> > - + ((int64_t)s->cirrus_blt_height-1) * pitch;
> > + + ((int64_t)s->cirrus_blt_height-1) * pitch
> > + - s->cirrus_blt_width;
> > int32_t max = addr
> > + s->cirrus_blt_width;
> > if (min < 0 || max > s->vga.vram_size) {
> >
>
> I believe this is incorrect. In this case (AFAIR), "addr" points to the
> left-most pixel (= lowest address) of the bottom line (= highest
> address).
If I read the code correctly it is backwards *both* x and y axis, so
addr is the right-most pixel of the bottom line.
cheers,
Gerd
