--- a/sys/dev/raid/vinum/vinumparser.c
+++ b/sys/dev/raid/vinum/vinumparser.c
@@ -160,7 +160,8 @@
  * Take a blank separated list of tokens and turn it into a list of
  * individual nul-delimited strings.  Build a list of pointers at
  * token, which must have enough space for the tokens.  Return the
  * number of tokens, or -1 on error (typically a missing string
- * delimiter).
+ * delimiter), or -1 as well when the line would produce more than
+ * maxtokens tokens.
  */
 int
-tokenize(char *cptr, char *token[])
+tokenize(char *cptr, char *token[], int maxtokens)
 {
     char delim;						/* delimiter for searching for the partner */
     int tokennr;					/* index of this token */
@@ -171,6 +172,9 @@
 	cptr++;					/* skip initial white space */
 	if ((*cptr == '\0') || (*cptr == '\n') || (*cptr == '#')) /* end of line */
 	    return tokennr;				/* return number of tokens found */
+	if (tokennr >= maxtokens)			/* too many tokens for the */
+	    return -1;					/* caller's array: refuse to */
+							/* write past its end */
 	delim = *cptr;
 	token[tokennr] = cptr;				/* point to it */
 	tokennr++;					/* one more */
--- a/sys/dev/raid/vinum/vinumext.h
+++ b/sys/dev/raid/vinum/vinumext.h
@@ -218,7 +218,7 @@
 struct sd *validsd(int sdno, struct _ioctl_reply *);
 struct plex *validplex(int plexno, struct _ioctl_reply *);
 struct volume *validvol(int volno, struct _ioctl_reply *);
-int tokenize(char *, char *[]);
+int tokenize(char *, char *[], int);
 void resetstats(struct vinum_ioctl_msg *msg);
 
 /* Locking */
--- a/sys/dev/raid/vinum/vinumconfig.c
+++ b/sys/dev/raid/vinum/vinumconfig.c
@@ -1624,7 +1624,7 @@ parse_config(char *cptr, struct keywordset *keyset, int update)
 
     status = 0;						    /* until proven otherwise */
-    tokens = tokenize(cptr, token);			    /* chop up into tokens */
+    tokens = tokenize(cptr, token, MAXTOKEN);		    /* chop up into tokens */
 
     if (tokens <= 0)					    /* screwed up or empty line */
 	return tokens;					    /* give up */