diff --git a/sys/netpfil/ipfilter/netinet/fil.c b/sys/netpfil/ipfilter/netinet/fil.c
--- a/sys/netpfil/ipfilter/netinet/fil.c
+++ b/sys/netpfil/ipfilter/netinet/fil.c
@@ -9951,3 +9951,34 @@
 	ASSERT(mtab->imt6_max >= 0);
 }
 #endif
+
+/* ------------------------------------------------------------------------ */
+/* Function:    ipf_check_names_string                                      */
+/* Returns:     int       -  0 == success                                   */
+/*                        -  1 == negative offset                           */
+/*                        -  2 == offset exceds namelen                     */
+/*                        -  3 == string exceeds the names string           */
+/* Parameters:  names   - pointer to names string                           */
+/*              namelen - total length of names string                      */
+/*              offset  - offset into names string                          */
+/*                                                                          */
+/* Validate the names string (fr_names for ipfilter, in_names for ipnat).   */
+/* ------------------------------------------------------------------------ */
+int
+ipf_check_names_string(char *names, int namelen, int offset)
+{
+	const char *name;
+	size_t len;
+
+	if (offset == -1)
+		return (0);
+	if (offset < 0)
+		return (1);
+	if (offset > namelen)
+		return (2);
+	name = &names[offset];
+	len = strnlen(name, namelen - offset);
+	if (len == namelen - offset)
+		return (3);
+	return (0);
+}
diff --git a/sys/netpfil/ipfilter/netinet/ip_fil.h b/sys/netpfil/ipfilter/netinet/ip_fil.h
--- a/sys/netpfil/ipfilter/netinet/ip_fil.h
+++ b/sys/netpfil/ipfilter/netinet/ip_fil.h
@@ -1859,5 +1859,6 @@
 extern	void	ipf_rb_ht_flush(host_track_t *);
 extern	void	ipf_rb_ht_freenode(host_node_t *, void *);
 extern	void	ipf_rb_ht_init(host_track_t *);
+extern	int	ipf_check_names_string(char *, int, int);
 
 #endif	/* __IP_FIL_H__ */