--- a/sys/netinet/tcp_usrreq.c
+++ b/sys/netinet/tcp_usrreq.c
@@ -309,6 +309,11 @@
 
 	COMMON_START(so, inp, 0);
 
+	if (nam->sa_len < sizeof(struct sockaddr_in)) {
+		error = EINVAL;
+		goto out;
+	}
+
 	/*
 	 * Must check for multicast addresses and disallow binding
 	 * to them.
@@ -399,6 +404,11 @@
 
 	COMMON_START(so, inp, 0);
 
+	if (nam->sa_len < sizeof(struct sockaddr_in6)) {
+		error = EINVAL;
+		goto out;
+	}
+
 	/*
 	 * Must check for multicast addresses and disallow binding
 	 * to them.
@@ -591,6 +601,11 @@
 
 	COMMON_START(so, inp, 0);
 
+	if (nam->sa_len < sizeof(struct sockaddr_in)) {
+		error = EINVAL;
+		goto out;
+	}
+
 	/*
 	 * Must disallow TCP ``connections'' to multicast addresses.
 	 */
@@ -634,6 +649,11 @@
 
 	COMMON_START(so, inp, 0);
 
+	if (nam->sa_len < sizeof(struct sockaddr_in6)) {
+		error = EINVAL;
+		goto out;
+	}
+
 	/*
 	 * Must disallow TCP ``connections'' to multicast addresses.
 	 */
@@ -962,6 +982,9 @@
 {
 	const struct sockaddr_in *sinp;
 
+	if (nam->sa_len < sizeof(struct sockaddr_in))
+		return EINVAL;
+
 	sinp = (const struct sockaddr_in *)nam;
 	if (sinp->sin_family == AF_INET &&
 	    IN_MULTICAST(ntohl(sinp->sin_addr.s_addr)))