diff --git a/src/engine/engine_io.c b/src/engine/engine_io.c
index 255adfa2..883d21b6 100644
--- a/src/engine/engine_io.c
+++ b/src/engine/engine_io.c
@@ -15,6 +15,7 @@
 
 #include "engine/engine_io.h"
 
+#include <limits.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -361,6 +362,9 @@ static void mj_setPtrModel(mjModel* m) {
 // *nbuffer += SKIP(*offset) + type_size*nr*nc;
 // *offset += SKIP(*offset) + type_size*nr*nc;
 static int safeAddToBufferSize(intptr_t* offset, int* nbuffer, size_t type_size, int nr, int nc) {
+  if (type_size < 0 || nr < 0 || nc < 0) {
+    return 0;
+  }
 #if (__has_builtin(__builtin_add_overflow) && __has_builtin(__builtin_mul_overflow)) \
     || (defined(__GNUC__) && __GNUC__ >= 5)
   // supported by GCC and Clang
@@ -469,6 +473,13 @@ mjModel* mj_makeModel(int nq, int nv, int nu, int na, int nbody, int njnt,
     return 0;
   }
 
+  // nmocap is going to get multiplied by 4, and shouldn't overflow
+  if (m->nmocap >= INT_MAX / 4) {
+    mju_warning("Invalid model: nmocap too large");
+    mj_deleteModel(m);
+    return 0;
+  }
+
   // compute buffer size
   m->nbuffer = 0;
 #define X(type, name, nr, nc)                                                \