diff --git a/numactl-1.0.2-cpumask.patch b/numactl-1.0.2-cpumask.patch
new file mode 100644
index 0000000..1395558
--- /dev/null
+++ b/numactl-1.0.2-cpumask.patch
@@ -0,0 +1,63 @@
+diff -up numactl-1.0.2/numactl.c.orig numactl-1.0.2/numactl.c
+--- numactl-1.0.2/numactl.c.orig	2007-09-21 06:23:51.000000000 -0400
++++ numactl-1.0.2/numactl.c	2008-04-25 09:10:05.000000000 -0400
+@@ -355,14 +355,14 @@ int main(int ac, char **av)
+ 			break;
+ 		case 'C': /* --physcpubind */
+ 		{
+-			int ncpus;
++			int bufsz;
+ 			unsigned long *cpubuf;
+ 			dontshm("-C/--physcpubind");
+-			cpubuf = cpumask(optarg, &ncpus);
++			cpubuf = cpumask(optarg, &bufsz);
+ 			errno = 0;
+ 			check_cpubind(do_shm);
+ 			did_cpubind = 1;
+-			numa_sched_setaffinity(0, CPU_BYTES(ncpus), cpubuf);
++			numa_sched_setaffinity(0, bufsz, cpubuf);
+ 			checkerror("sched_setaffinity");
+ 			free(cpubuf);
+ 			break;
+diff -up numactl-1.0.2/util.h.orig numactl-1.0.2/util.h
+--- numactl-1.0.2/util.h.orig	2007-08-16 10:36:23.000000000 -0400
++++ numactl-1.0.2/util.h	2008-04-25 09:10:05.000000000 -0400
+@@ -1,7 +1,7 @@
+ extern void printmask(char *name, nodemask_t *mask);
+ extern void printcpumask(char *name, unsigned long *mask, int len);
+ extern nodemask_t nodemask(char *s);
+-extern unsigned long *cpumask(char *s, int *ncpus);
++extern unsigned long *cpumask(char *s, int *bufsz);
+ extern int read_sysctl(char *name);
+ extern void complain(char *fmt, ...);
+ extern void nerror(char *fmt, ...);
+diff -up numactl-1.0.2/util.c.orig numactl-1.0.2/util.c
+--- numactl-1.0.2/util.c.orig	2007-08-16 10:36:23.000000000 -0400
++++ numactl-1.0.2/util.c	2008-04-25 09:10:45.000000000 -0400
+@@ -52,7 +52,7 @@ void printmask(char *name, nodemask_t *m
+ int numcpus; 
+ 
+ /* caller must free buffer */
+-unsigned long *cpumask(char *s, int *ncpus) 
++unsigned long *cpumask(char *s, int *bufsz) 
+ {
+ 	int invert = 0;
+ 	char *end; 
+@@ -92,7 +92,7 @@ unsigned long *cpumask(char *s, int *ncp
+ 			unsigned long arg2 = strtoul(++s, &end2, 0); 
+ 			if (end2 == s)
+ 				complain("missing cpu argument %s\n", s);
+-			if (arg > numcpus)
++			if (arg >= numcpus)
+ 				complain("cpu argument %d out of range\n", arg);
+ 			while (++arg <= arg2)
+ 				set_bit(arg, cpubuf);
+@@ -110,7 +110,7 @@ unsigned long *cpumask(char *s, int *ncp
+ 				set_bit(i, cpubuf);
+ 		}
+ 	} 
+-	*ncpus = cpubufsize;
++	*bufsz = cpubufsize;
+ 	return cpubuf;	
+ }
+ 
diff --git a/numactl.spec b/numactl.spec
index 767a421..2aa5998 100644
--- a/numactl.spec
+++ b/numactl.spec
@@ -1,7 +1,7 @@
 Name:		numactl
 Summary:	Library for tuning for Non Uniform Memory Access machines
 Version:	1.0.2
-Release:	5%{dist} 
+Release:	6%{dist} 
 License:	LGPLv2/GPLv2
 Group: 		System Environment/Base
 URL: 		ftp://ftp.suse.com/pub/people/ak/numa/
@@ -11,6 +11,7 @@ Buildroot:	%{_tmppath}/%{name}-buildroot
 ExcludeArch: s390 s390x
 Patch0: numactl-1.0.2-get_mempolicy-const.patch
 Patch1: numactl-1.0.2-alpha-syscall.patch
+Patch2: numactl-1.0.2-cpumask.patch
 
 %description
 Simple NUMA policy support. It consists of a numactl program to run
@@ -29,6 +30,7 @@ Provides development headers for numa library calls
 %setup -q 
 %patch0 -p1
 %patch1 -p1
+%patch2 -p1
 
 %build
 make CFLAGS="$RPM_OPT_FLAGS -I. -fPIC"
@@ -70,6 +72,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man3/*.3*
 
 %changelog
+* Fri Apr 25 2008 Neil Horman <nhorman@redhat.com> - 1.0.2-6
+- Fix buffer size passing and arg sanity check for physcpubind (bz 442521)
+
 * Fri Mar 14 2008 Neil Horman <nhorman@redhat.com> - 1.0.2-5
 - Fixing spec file to actually apply alpha patch :)