Index: head/sys/security/mac/mac_framework.c
===================================================================
--- head/sys/security/mac/mac_framework.c
+++ head/sys/security/mac/mac_framework.c
@@ -586,7 +586,9 @@
 mac_check_structmac_consistent(struct mac *mac)
 {
 
-	if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
+	/* Require that labels have a non-zero length. */
+	if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN ||
+	    mac->m_buflen <= sizeof(""))
 		return (EINVAL);
 
 	return (0);