1 files changed, 8 insertions, 2 deletions
diff --git a/extern/draco/draco/src/draco/metadata/metadata_decoder.cc b/extern/draco/draco/src/draco/metadata/metadata_decoder.cc
index e664e4fa524..a8e66f854cf 100644
--- a/extern/draco/draco/src/draco/metadata/metadata_decoder.cc
+++ b/extern/draco/draco/src/draco/metadata/metadata_decoder.cc
@@ -78,8 +78,10 @@ bool MetadataDecoder::DecodeMetadata(Metadata *metadata) {
       std::unique_ptr<Metadata> sub_metadata =
           std::unique_ptr<Metadata>(new Metadata());
       metadata = sub_metadata.get();
-      mp.parent_metadata->AddSubMetadata(sub_metadata_name,
-                                         std::move(sub_metadata));
+      if (!mp.parent_metadata->AddSubMetadata(sub_metadata_name,
+                                              std::move(sub_metadata))) {
+        return false;
+      }
     }
     if (metadata == nullptr) {
       return false;
@@ -98,6 +100,10 @@ bool MetadataDecoder::DecodeMetadata(Metadata *metadata) {
     if (!DecodeVarint(&num_sub_metadata, buffer_)) {
       return false;
     }
+    if (num_sub_metadata > buffer_->remaining_size()) {
+      // The decoded number of metadata items is unreasonably high.
+      return false;
+    }
     for (uint32_t i = 0; i < num_sub_metadata; ++i) {
       metadata_stack.push_back({metadata, nullptr});
     }