diff -Naurp iproute2-2.6.25/include/utils.h iproute2-2.6.25.patched/include/utils.h
--- iproute2-2.6.25/include/utils.h	2008-04-17 10:12:54.000000000 -0700
+++ iproute2-2.6.25.patched/include/utils.h	2008-12-09 12:43:53.000000000 -0800
@@ -46,7 +46,7 @@ typedef struct
 	__u8 bytelen;
 	__s16 bitlen;
 	__u32 flags;
-	__u32 data[4];
+	__u32 data[8];
 } inet_prefix;
 
 #define PREFIXLEN_SPECIFIED 1
diff -Naurp iproute2-2.6.25/ip/ipmaddr.c iproute2-2.6.25.patched/ip/ipmaddr.c
--- iproute2-2.6.25/ip/ipmaddr.c	2008-12-09 12:41:58.000000000 -0800
+++ iproute2-2.6.25.patched/ip/ipmaddr.c	2008-12-09 12:43:53.000000000 -0800
@@ -43,11 +43,11 @@ static void usage(void)
 	exit(-1);
 }
 
-static int parse_hex(char *str, unsigned char *addr)
+static int parse_hex(char *str, unsigned char *addr, size_t size)
 {
 	int len=0;
 
-	while (*str) {
+	while (*str && (len < 2 * size)) {
 		int tmp;
 		if (str[1] == 0)
 			return -1;
@@ -104,7 +104,7 @@ void read_dev_mcast(struct ma_info **res
 
 		m.addr.family = AF_PACKET;
 
-		len = parse_hex(hexa, (unsigned char*)&m.addr.data);
+		len = parse_hex(hexa, (unsigned char*)&m.addr.data, sizeof (m.addr.data));
 		if (len >= 0) {
 			struct ma_info *ma = malloc(sizeof(m));
 
@@ -177,7 +177,7 @@ void read_igmp6(struct ma_info **result_
 
 		m.addr.family = AF_INET6;
 
-		len = parse_hex(hexa, (unsigned char*)&m.addr.data);
+		len = parse_hex(hexa, (unsigned char*)&m.addr.data, sizeof (m.addr.data));
 		if (len >= 0) {
 			struct ma_info *ma = malloc(sizeof(m));