diff --git a/sys/kern/kern_checkpoint.c b/sys/kern/kern_checkpoint.c
--- a/sys/kern/kern_checkpoint.c
+++ b/sys/kern/kern_checkpoint.c
@@ -596,6 +596,11 @@
 	if ((error = read_check(fp, &filehdr, sizeof(filehdr))) != 0)
 		goto done;
 	filecount = filehdr.cfh_nfiles;
+	if (filecount < 0 || filecount > 1024 ||
+	    (size_t)filecount > SIZE_MAX / sizeof(struct ckpt_fileinfo)) {
+		error = EINVAL;
+		goto done;
+	}
 	cfi_base = kmalloc(filecount*sizeof(struct ckpt_fileinfo), M_TEMP, M_WAITOK);
 	error = read_check(fp, cfi_base, filecount*sizeof(struct ckpt_fileinfo));
 	if (error)