diff --git a/include/iscsi.h b/include/iscsi.h
index 4582ffd..6064f8c 100644
--- a/include/iscsi.h
+++ b/include/iscsi.h
@@ -195,7 +195,8 @@ enum iscsi_header_digest {
 	ISCSI_HEADER_DIGEST_NONE        = 0,
 	ISCSI_HEADER_DIGEST_NONE_CRC32C = 1,
 	ISCSI_HEADER_DIGEST_CRC32C_NONE = 2,
-	ISCSI_HEADER_DIGEST_CRC32C      = 3
+	ISCSI_HEADER_DIGEST_CRC32C      = 3,
+	ISCSI_HEADER_DIGEST_LAST        = ISCSI_HEADER_DIGEST_CRC32C
 };
 
 /*
diff --git a/lib/init.c b/lib/init.c
index 826e04f..705e4c5 100644
--- a/lib/init.c
+++ b/lib/init.c
@@ -282,6 +282,10 @@ iscsi_set_header_digest(struct iscsi_context *iscsi,
 				"logged in");
 		return -1;
 	}
+	if ((unsigned)header_digest > ISCSI_HEADER_DIGEST_LAST) {
+		iscsi_set_error(iscsi, "invalid header digest value");
+		return -1;
+	}
 
 	iscsi->want_header_digest = header_digest;
 
diff --git a/lib/login.c b/lib/login.c
index 0d4d7e9..24348e8 100644
--- a/lib/login.c
+++ b/lib/login.c
@@ -188,6 +188,9 @@ iscsi_login_add_headerdigest(struct iscsi_context *iscsi, struct iscsi_pdu *pdu)
 	case ISCSI_HEADER_DIGEST_CRC32C:
 		str = (char *)"HeaderDigest=CRC32C";
 		break;
+	default:
+		iscsi_set_error(iscsi, "invalid header digest value");
+		return -1;
 	}
 
 	if (iscsi_pdu_add_data(iscsi, pdu, (unsigned char *)str, strlen(str)+1)