dialog (k): safety check of main_rt list boundaries

modules_k/dialog/dlg_handlers.c

@@ -964,7 +964,8 @@ void dlg_ontimeout( struct dlg_tl *tl)
 	dlg = ((struct dlg_cell*)((char *)(tl) -
 		(unsigned long)(&((struct dlg_cell*)0)->tl)));
 
-	if(dlg->toroute>0 && main_rt.rlist[dlg->toroute]!=NULL)
+	if(dlg->toroute>0 && dlg->toroute<main_rt.entries
+			&& main_rt.rlist[dlg->toroute]!=NULL)
 	{
 		dlg_set_ctx_dialog(dlg);
 		fmsg = faked_msg_next();