(tputs): Don't let ospeed overrun the speeds array.

diff --git a/src/termcap.c b/src/termcap.c
index 595fc42..26a1229 100644 (file)
--- a/src/termcap.c
+++ b/src/termcap.c
@@ -300,8 +300,10 @@ tputs (str, nlines, outfun)
 #else
   if (ospeed == 0)
     speed = tputs_baud_rate;
-  else
+  else if (ospeed > 0 && ospeed < (sizeof speeds / sizeof speeds[0]))
     speed = speeds[ospeed];
+  else
+    speed = 0;
 #endif
 
   if (!str)