[vte/wip/sixels: 67/111] sixel: Fix out-of-bounds write caused by parser arithmetic error

[Christian Persch <chpe src gnome org>]

commit 66b45a906b3186a801c240661331f114a9455fa9
Author: Hans Petter Jansson <hpj cl no>
Date:   Sat Aug 8 20:42:49 2020 +0200

    sixel: Fix out-of-bounds write caused by parser arithmetic error

 src/sixel.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
---
diff --git a/src/sixel.cc b/src/sixel.cc
index 035c8752..2ef26901 100644
--- a/src/sixel.cc
+++ b/src/sixel.cc
@@ -548,7 +548,7 @@ sixel_parser_parse(sixel_state_t *st, unsigned char *p, size_t len)
                                        if (st->pos_x + st->repeat_count > image->width)
                                                st->repeat_count = image->width - st->pos_x;
 
-                                       if (st->repeat_count > 0 && st->pos_y - 5 < image->height) {
+                                       if (st->repeat_count > 0 && st->pos_y + 5 < image->height) {
                                                bits = *p - '?';
                                                if (bits != 0) {
                                                        sixel_vertical_mask = 0x01;