tload: Prevent a buffer overflow when row equals nrows.

When max_scale is very small, scale_fact is very small, row is equal to
nrows, p points outside screen, and the write to *p is out-of-bounds.

diff --git a/tload.c b/tload.c
index 29e6a8ffbfc35888104171222a30d62e309f9cea..4b925e3705f466f64187ef13df5f5fa77ee3cfa9 100644 (file)
--- a/tload.c
+++ b/tload.c
@@ -190,7 +190,7 @@ int main(int argc, char **argv)
                for (i = 1;; ++i) {
                        char *p;
                        row = nrows - (i * scale_fact);
-                       if (row < 0)
+                       if (row < 0 || row >= nrows)
                                break;
                        if (*(p = screen + row * ncols + col) == ' ')
                                *p = '-';