diff --git a/sys/net/ipfw/ip_fw2.c b/sys/net/ipfw/ip_fw2.c
--- a/sys/net/ipfw/ip_fw2.c
+++ b/sys/net/ipfw/ip_fw2.c
@@ -5327,6 +5327,12 @@
 		return EINVAL;
 	}
 
+	/* Check that act_ofs points within the command array */
+	if (rule->act_ofs > rule->cmd_len) {
+		kprintf("ipfw: act_ofs out of bounds\n");
+		return EINVAL;
+	}
+
 	/* Check rule number */
 	if (rule->rulenum == IPFW_DEFAULT_RULE) {
 		kprintf("ipfw: invalid rule number\n");