hw/display/cirrus_vga: Fix packed-24 color-expansion transparent copies

For the "color expansion" subtype of raster operations, the source pixel format is a monochrome bitmap, and the destination can be any of 8, 16, 24 or 32bpp. For these pattern operations, the GR2F register includes a field which specifies how much to skip at the start of each scanline. In the 8, 16 and 32 bit cases, this field is 3 bits and is a count of pixels to skip. We get this case right. However, for the 24 bit case, the field is 5 bits and is a count of destination bytes to skip. In commit ad81218e40e27 ("depth=24 write mask fix (Volker Ruppert)") in 2005, we updated the code to (attempt to) handle the 5-bit mask case. However, we don't do the right thing when the 5-bit mask indicates that we need to skip more than 8 bits of the input bitmap: we will right-shift the 0x80 constant completely off the right hand side, and will be off-by-one for all the source bitmap loads. Fix this by calculating the whole number of input bytes we need to skip and the residual number of bits. In the 8/16/32bpp case the bytes to skip is always zero. Cc: qemu-stable@nongnu.org Fixes: ad81218e40e27 ("depth=24 write mask fix (Volker Ruppert)") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Junjie Cao <junjie.cao@intel.com> Tested-by: Junjie Cao <junjie.cao@intel.com> Message-ID: <20260410183249.4046456-3-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>