Fix possible off-by-one error in surface.c

Valgrind and Clang both say this is a bug, but maybe they are wrong?