diff --git a/src/java.desktop/share/classes/com/sun/media/sound/StandardMidiFileReader.java b/src/java.desktop/share/classes/com/sun/media/sound/StandardMidiFileReader.java
index 6f5a4bbf3c9..85f31acb0d5 100644
--- a/src/java.desktop/share/classes/com/sun/media/sound/StandardMidiFileReader.java
+++ b/src/java.desktop/share/classes/com/sun/media/sound/StandardMidiFileReader.java
@@ -380,6 +380,11 @@ final class SMFParser {
                     case 0xF7:
                         // sys ex
                         int sysexLength = (int) readVarInt();
+                        if (sysexLength < 0 || sysexLength > trackLength - pos) {
+                            throw new InvalidMidiDataException("Message length is out of bounds: "
+                                    + sysexLength);
+                        }
+
                         byte[] sysexData = new byte[sysexLength];
                         read(sysexData);
 
@@ -392,8 +397,8 @@ final class SMFParser {
                         // meta
                         int metaType = readUnsigned();
                         int metaLength = (int) readVarInt();
-                        if (metaLength < 0) {
-                            throw new InvalidMidiDataException("length out of bounds: "
+                        if (metaLength < 0 || metaLength > trackLength - pos) {
+                            throw new InvalidMidiDataException("Message length is out of bounds: "
                                     + metaLength);
                         }
                         final byte[] metaData;