cirrus: fix off-by-one in cirrus_bitblt_rop_bkwd_transp_*_16

The switch from pointers to addresses (commit
026aeffc and
ffaf8577) added
a off-by-one bug to 16bit backward blits.  Fix.

Reported-by: 李强 <liqiang6-s@360.cn>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Li Qiang <liqiang6-s@360.cn>
Message-id: 1489735296-19047-1-git-send-email-kraxel@redhat.com
(cherry picked from commit f019722c)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>