diff --git a/sys/netgraph/socket/ng_socket.c b/sys/netgraph/socket/ng_socket.c
index 0000000..1111111 100644
--- a/sys/netgraph/socket/ng_socket.c
+++ b/sys/netgraph/socket/ng_socket.c
@@ -253,6 +253,20 @@
 	xmsg = kmalloc(len + 1, M_NETGRAPH, M_WAITOK);
 	m_copydata(m, 0, len, xmsg);
 
+	/* Sanity check the user-supplied ng_mesg header: the datagram must be
+	 * large enough to hold a full struct ng_mesg header, and the embedded
+	 * header.arglen must not claim more payload than was actually supplied.
+	 * Otherwise ship_msg() (reached via the loopback "." node path) trusts
+	 * arglen and copies sizeof(ng_mesg)+arglen bytes out of the undersized
+	 * xmsg buffer -> kernel heap OOB read / info leak. (CVE-2008-5736) */
+	if (len < sizeof(struct ng_mesg) ||
+	    ((struct ng_mesg *)(void *)xmsg)->header.arglen >
+		len - sizeof(struct ng_mesg)) {
+		error = EINVAL;
+		kfree(xmsg, M_NETGRAPH);
+		goto release;
+	}
+
 	/* The callee will free the xmsg when done. The addr is our business. */
 	error = ng_send_msg(pcbp->sockdata->node,
 			    (struct ng_mesg *) xmsg, path, &resp);