---
 net/ipv4/fib_frontend.c  |    3 +++
 net/ipv4/fib_semantics.c |    2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

Index: linux-2.6.18/net/ipv4/fib_frontend.c
===================================================================
--- linux-2.6.18.orig/net/ipv4/fib_frontend.c
+++ linux-2.6.18/net/ipv4/fib_frontend.c
@@ -288,6 +288,9 @@ static int inet_check_attr(struct rtmsg 
 {
 	int i;
 
+	if (r->rtm_type > RTN_MAX)
+		return -EINVAL;
+
 	for (i=1; i<=RTA_MAX; i++, rta++) {
 		struct rtattr *attr = *rta;
 		if (attr) {
Index: linux-2.6.18/net/ipv4/fib_semantics.c
===================================================================
--- linux-2.6.18.orig/net/ipv4/fib_semantics.c
+++ linux-2.6.18/net/ipv4/fib_semantics.c
@@ -88,7 +88,7 @@ static const struct 
 {
 	int	error;
 	u8	scope;
-} fib_props[RTA_MAX + 1] = {
+} fib_props[RTN_MAX + 1] = {
         {
 		.error	= 0,
 		.scope	= RT_SCOPE_NOWHERE,