diff --git a/sys/net/if.c b/sys/net/if.c
--- a/sys/net/if.c
+++ b/sys/net/if.c
@@ -2700,6 +2700,9 @@
 	}
 
 	ifma = kmalloc(sizeof *ifma, M_IFMADDR, M_INTWAIT);
+	if (sa->sa_len < offsetof(struct sockaddr, sa_data) ||
+	    sa->sa_len > sizeof(struct sockaddr_storage))
+		return (EINVAL);
 	dupsa = kmalloc(sa->sa_len, M_IFMADDR, M_INTWAIT);
 	bcopy(sa, dupsa, sa->sa_len);