From b36efe5226393c1f488047083d297147f6b8bdb1 Mon Sep 17 00:00:00 2001
From: Mark Pizzolato <mark@infocomm.com>
Date: Tue, 16 Apr 2013 11:46:48 -0700
Subject: [PATCH] Fix out of bounds array reference (off by 1) when validating
 a maximum line number on a multiplexer

---
 sim_tmxr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sim_tmxr.c b/sim_tmxr.c
index a0a5baf4..870bbcb7 100644
--- a/sim_tmxr.c
+++ b/sim_tmxr.c
@@ -1540,7 +1540,7 @@ while (*tptr) {
             if (0 == MATCH_CMD (gbuf, "LINE")) {
                 if ((NULL == cptr) || ('\0' == *cptr))
                     return SCPE_ARG;
-                nextline = (int32) get_uint (cptr, 10, mp->lines, &r);
+                nextline = (int32) get_uint (cptr, 10, mp->lines-1, &r);
                 if ((r != SCPE_OK) || (mp->lines == 1))
                     return SCPE_ARG;
                 break;