--- a/sys/kern/subr_disklabel32.c
+++ b/sys/kern/subr_disklabel32.c
@@ -262,8 +262,9 @@
 	 * Check it is actually a disklabel we are looking at.
 	 */
 	if (nlp->d_magic != DISKMAGIC32 || nlp->d_magic2 != DISKMAGIC32 ||
-	    dkcksum32(nlp) != 0)
+	    nlp->d_npartitions > MAXPARTITIONS32 || dkcksum32(nlp) != 0)
 		return (EINVAL);
+	/* NOTE: d_npartitions must be checked before running dkcksum32() */
 
 	/*
 	 * For each partition that we think is open, check the new disklabel
@@ -308,8 +309,9 @@
 	if (olp->d_secperunit > sp->ds_size)
 		return (ENOSPC);
 	for (part = 0; part < olp->d_npartitions; ++part) {
-		if (olp->d_partitions[part].p_size > sp->ds_size)
-			return(ENOSPC);
+		if ((u_int64_t)olp->d_partitions[part].p_offset +
+		    olp->d_partitions[part].p_size > sp->ds_size)
+			return (ENOSPC);
 	}
 	return (0);
 }