diff --git a/src/oem/meta/file_io.c b/src/oem/meta/file_io.c
index 966a262..db9407b 100644
--- a/src/oem/meta/file_io.c
+++ b/src/oem/meta/file_io.c
@@ -55,7 +55,7 @@
 	return pldm_msgbuf_destroy_consumed(buf);
 }
 
-LIBPLDM_ABI_DEPRECATED
+LIBPLDM_ABI_DEPRECATED_UNSAFE
 int decode_oem_meta_file_io_req(const struct pldm_msg *msg,
 				size_t payload_length, uint8_t *file_handle,
 				uint32_t *length, uint8_t *data)
@@ -69,6 +69,10 @@
 		return pldm_xlate_errno(-EINVAL);
 	}
 
+	if (SIZE_MAX - sizeof(*request_msg) < payload_length) {
+		return pldm_xlate_errno(-EOVERFLOW);
+	}
+
 	request_msg_len = sizeof(*request_msg) + payload_length;
 	request_msg = malloc(request_msg_len);