diff --git a/src/msg.c b/src/msg.c
index cdd0fd5..a040b71 100644
--- a/src/msg.c
+++ b/src/msg.c
@@ -114,6 +114,11 @@ static int do_mroute(struct ipc_msg *msg)
 		group  = msg->argv[1];
 	}
 
+	if (msg->count - pos > MAX_MC_VIFS) {
+		errno = EINVAL;
+		return 1;
+	}
+
 	while (pos < msg->count)
 		out[num++] = msg->argv[pos++];