diff --git a/sys/kern/kern_checkpoint.c b/sys/kern/kern_checkpoint.c
--- a/sys/kern/kern_checkpoint.c
+++ b/sys/kern/kern_checkpoint.c
@@ -560,6 +560,11 @@
 	p->p_vmspace->vm_tsize = ctob(vminfo.cvm_tsize);	/* in bytes */
 	if ((error = read_check(fp, &vpcount, sizeof(int))) != 0)
 		goto done;
+	if (vpcount < 0 || vpcount > 1024 ||
+	    (size_t)vpcount > SIZE_MAX / sizeof(struct vn_hdr)) {
+		error = EINVAL;
+		goto done;
+	}
 	vnh = kmalloc(sizeof(struct vn_hdr) * vpcount, M_TEMP, M_WAITOK);
 	if ((error = read_check(fp, vnh, sizeof(struct vn_hdr)*vpcount)) != 0)
 		goto done;