Correct malloc_limit value for pre-relocation malloc()

The limit is measured from the start of the malloc() area and is not an
absolute address. Correct this.

Signed-off-by: Simon Glass <sjg@chromium.org>