From 3a29fb79919148f38a643366dab9c7f23712f5b1 Mon Sep 17 00:00:00 2001
From: nick black <dankamongmen@gmail.com>
Date: Fri, 7 May 2021 05:54:04 -0400
Subject: [PATCH] sixel_wipe: fix off-by-one in bounds computations #1628

---
 src/lib/sixel.c  | 10 +++++-----
 src/lib/sprite.c |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/lib/sixel.c b/src/lib/sixel.c
index 8d3ebc26f..f28f24587 100644
--- a/src/lib/sixel.c
+++ b/src/lib/sixel.c
@@ -801,7 +801,7 @@ wipe_color(sixelmap* smap, int color, int sband, int eband,
   // we're going to repurpose starty as "starting row of this band", so keep it
   // around as originy for auxvecidx computations
   int originy = starty;
-  for(int b = sband ; b <= eband && b * 6 < endy ; ++b){
+  for(int b = sband ; b <= eband && b * 6 <= endy ; ++b){
     const int boff = coff + b * dimx; // offset in data where band starts
     unsigned char mask = 63;
     for(int i = 0 ; i < 6 ; ++i){
@@ -855,12 +855,12 @@ int sixel_wipe(sprixel* s, int ycell, int xcell){
   const int startx = xcell * s->cellpxx;
   const int starty = ycell * s->cellpxy;
   int endx = ((xcell + 1) * s->cellpxx) - 1;
-  if(endx > s->pixx){
-    endx = s->pixx;
+  if(endx >= s->pixx){
+    endx = s->pixx - 1;
   }
   int endy = ((ycell + 1) * s->cellpxy) - 1;
-  if(endy > s->pixy){
-    endy = s->pixy;
+  if(endy >= s->pixy){
+    endy = s->pixy - 1;
   }
   const int startband = starty / 6;
   const int endband = endy / 6;
diff --git a/src/lib/sprite.c b/src/lib/sprite.c
index 7e2ea51ec..5b7d50b01 100644
--- a/src/lib/sprite.c
+++ b/src/lib/sprite.c
@@ -25,7 +25,7 @@ void sprixel_debug(FILE* out, const sprixel* s){
           if(s->n->tam[idx].auxvector){
             fprintf(out, "%03d] ", idx);
             for(int p = 0 ; p < s->cellpxx * s->cellpxy ; ++p){
-              fprintf(out, "%02x ", s->n->tam[idx].auxvector[idx]);
+              fprintf(out, "%02x ", s->n->tam[idx].auxvector[p]);
             }
             fprintf(out, "\n");
           }else{