diff --git a/systemtap-translate-fix.diff b/systemtap-translate-fix.diff
new file mode 100644
index 0000000..1b5f2d6
--- /dev/null
+++ b/systemtap-translate-fix.diff
@@ -0,0 +1,94 @@
+diff -uNar systemtap-0708-ioblockpatch.orig/translate.cxx systemtap-0708-ioblockpatch/translate.cxx
+--- systemtap-0708-ioblockpatch.orig/translate.cxx	2007-02-23 15:24:23.000000000 -0800
++++ systemtap-0708-ioblockpatch/translate.cxx	2007-02-23 15:26:38.000000000 -0800
+@@ -348,29 +348,39 @@
+         else
+           return qname() + " = 0;";
+       case pe_stats:
+-	switch (sd.type)
+-	  {
+-	  case statistic_decl::none:
+-	    return (qname() 
+-		    + " = _stp_stat_init (HIST_NONE);");
+-	    break;
+-	    
+-	  case statistic_decl::linear:
+-	    return (qname() 
+-		    + " = _stp_stat_init (HIST_LINEAR"
+-		    + ", " + stringify(sd.linear_low) 
+-		    + ", " + stringify(sd.linear_high) 
+-		    + ", " + stringify(sd.linear_step)
+-		    + ");");
+-	    break;
+-
+-	  case statistic_decl::logarithmic:
+-	    return (qname() 
+-		    + " = _stp_stat_init (HIST_LOG"
+-		    + ", " + stringify(sd.logarithmic_buckets) 
+-		    + ");");
+-	    break;
+-	  }
++        {
++          // See also mapvar::init().
++          
++          string prefix = qname() + " = _stp_stat_init (";
++          // Check for errors during allocation.
++          string suffix = "if (" + qname () + " == NULL) rc = -ENOMEM;";
++          
++          switch (sd.type)
++            {
++            case statistic_decl::none:
++              prefix += "HIST_NONE";
++              break;
++              
++            case statistic_decl::linear:
++              prefix += string("HIST_LINEAR")
++                + ", " + stringify(sd.linear_low) 
++                + ", " + stringify(sd.linear_high) 
++                + ", " + stringify(sd.linear_step);
++              break;
++              
++            case statistic_decl::logarithmic:
++              prefix += string("HIST_LOG")
++                + ", " + stringify(sd.logarithmic_buckets);
++              break;
++              
++            default:
++              throw semantic_error("unsupported stats type for " + qname());
++            }
++          
++          prefix = prefix + "); ";
++          return string (prefix + suffix);
++        }
++        
+       default:
+ 	throw semantic_error("unsupported initializer for " + qname());
+       }
+@@ -602,6 +612,8 @@
+     string prefix = qname() + " = _stp_" + mtype + "_new_" + keysym() + " (" + 
+       (maxsize > 0 ? stringify(maxsize) : "MAXMAPENTRIES") ;
+ 
++    // See also var::init().
++
+     // Check for errors during allocation.
+     string suffix = "if (" + qname () + " == NULL) rc = -ENOMEM;";
+ 
+@@ -1094,6 +1106,8 @@
+       if (basest_names.find(nm) == basest_names.end())
+         {
+           o->newline() << "time_" << nm << " = _stp_stat_init (HIST_NONE);";
++          // NB: we don't check for null return here, but instead at
++          // passage to probe handlers and at final printing.
+           basest_names.insert (nm);
+         }
+     }
+@@ -1207,7 +1221,8 @@
+         if (basest_names.find(nm) == basest_names.end())
+           {
+             basest_names.insert (nm);
+-            o->newline() << "{";
++            // NB: check for null stat object
++            o->newline() << "if (likely (time_" << p->name << ")) {";
+             o->newline(1) << "const char *probe_point = " 
+                          << lex_cast_qstring (* p->locations[0])
+                          << (p->locations.size() > 1 ? "\"+\"" : "")
diff --git a/systemtap.changes b/systemtap.changes
index 108db8e..67bbcb6 100644
--- a/systemtap.changes
+++ b/systemtap.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Mon Feb 26 12:42:41 CET 2007 - tiwai@suse.de
+
+- fix crash with large H value in hist_linear() (#248430)
+
 -------------------------------------------------------------------
 Fri Feb 23 16:43:53 CET 2007 - tiwai@suse.de
 
diff --git a/systemtap.spec b/systemtap.spec
index c8fc8ea..35afb56 100644
--- a/systemtap.spec
+++ b/systemtap.spec
@@ -16,7 +16,7 @@ BuildRequires:  gcc-c++
 %define elfutils_version 0.125
 License:        GNU General Public License (GPL)
 Version:        0.5.8
-Release:        32
+Release:        33
 Summary:        Instrumentation System
 Group:          Development/Tools/Debuggers
 URL:            http://sourceware.org/systemtap/
@@ -30,6 +30,7 @@ Patch2:         elfutils-0.125-build-fix.diff
 Patch3:         systemtap-s390x-probe-at-function-entry.diff
 Patch4:         systemtap-s390x-store_deref-fix.diff
 Patch5:         systemtap-s390x-mmap-tapset.diff
+Patch6:         systemtap-translate-fix.diff
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 
 %description
@@ -53,6 +54,7 @@ Authors:
 %patch3
 %patch4 -p1
 %patch5 -p2
+%patch6 -p1
 autoreconf -fi
 cd elfutils-%{elfutils_version}
 %patch1 -p1
@@ -81,6 +83,8 @@ rm -rf ${RPM_BUILD_ROOT}
 %dir %attr(0755,root,root) /var/cache/systemtap
 
 %changelog
+* Mon Feb 26 2007 - tiwai@suse.de
+- fix crash with large H value in hist_linear() (#248430)
 * Fri Feb 23 2007 - tiwai@suse.de
 - fix mmap syscall on s390x (#248110)
 * Thu Feb 15 2007 - tiwai@suse.de