Fix off-by-one in dirty bitmap functions

Reported-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

exec-obsolete.h

diff --git a/exec-obsolete.h b/exec-obsolete.h
index 03cf35e..d2749d3 100644
--- a/exec-obsolete.h
+++ b/exec-obsolete.h
@@ -83,9 +83,10 @@
     uint8_t *p;
     ram_addr_t addr, end;
 
-    end = start + length;
+    end = TARGET_PAGE_ALIGN(start + length);
+    start &= TARGET_PAGE_MASK;
     p = ram_list.phys_dirty + (start >> TARGET_PAGE_BITS);
-    for (addr = start; addr <= end; addr += TARGET_PAGE_SIZE) {
+    for (addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
         *p++ |= dirty_flags;
     }
 }
@@ -98,10 +99,11 @@
     uint8_t *p;
     ram_addr_t addr, end;
 
-    end = start + length;
+    end = TARGET_PAGE_ALIGN(start + length);
+    start &= TARGET_PAGE_MASK;
     mask = ~dirty_flags;
     p = ram_list.phys_dirty + (start >> TARGET_PAGE_BITS);
-    for (addr = start; addr <= end; addr += TARGET_PAGE_SIZE) {
+    for (addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
         *p++ &= mask;
     }
 }