diff --git a/spa/plugins/filter-graph/filter-graph.c b/spa/plugins/filter-graph/filter-graph.c
index 1b0936459..9aab79a05 100644
--- a/spa/plugins/filter-graph/filter-graph.c
+++ b/spa/plugins/filter-graph/filter-graph.c
@@ -1806,6 +1806,7 @@ static int setup_graph(struct graph *graph)
 	struct graph_port *gp;
 	struct graph_hndl *gh;
 	uint32_t i, j, n, n_input, n_output, n_hndl = 0, n_out_hndl;
+	size_t input_count, output_count;
 	int res;
 	struct descriptor *desc;
 	const struct spa_fga_descriptor *d;
@@ -1879,9 +1880,11 @@ static int setup_graph(struct graph *graph)
 	spa_log_info(impl->log, "using %d instances %d %d", n_hndl, n_input, n_output);
 
 	graph->n_input = 0;
-	graph->input = calloc(n_input * 16 * n_hndl, sizeof(struct graph_port));
+	input_count = n_input * 16 * n_hndl;
+	graph->input = calloc(input_count, sizeof(struct graph_port));
 	graph->n_output = 0;
-	graph->output = calloc(n_output * n_hndl, sizeof(struct graph_port));
+	output_count = n_output * n_hndl;
+	graph->output = calloc(output_count, sizeof(struct graph_port));
 
 	/* now collect all input and output ports for all the handles. */
 	for (i = 0; i < n_hndl; i++) {
@@ -1889,6 +1892,10 @@ static int setup_graph(struct graph *graph)
 			desc = first->desc;
 			d = desc->desc;
 			for (j = 0; j < desc->n_input; j++) {
+				if (graph->n_input >= input_count) {
+					res = -ENOSPC;
+					goto error;
+				}
 				gp = &graph->input[graph->n_input++];
 				spa_log_info(impl->log, "input port %s[%d]:%s",
 						first->name, i, d->ports[desc->input[j]].name);
@@ -1901,6 +1908,10 @@ static int setup_graph(struct graph *graph)
 			for (n = 0; n < graph->n_input_names; n++) {
 				pname = graph->input_names[n];
 				if (spa_streq(pname, "null")) {
+					if (graph->n_input >= input_count) {
+						res = -ENOSPC;
+						goto error;
+					}
 					gp = &graph->input[graph->n_input++];
 					gp->desc = NULL;
 					spa_log_info(impl->log, "ignore input port %d", graph->n_input);
@@ -1936,6 +1947,10 @@ static int setup_graph(struct graph *graph)
 							spa_list_for_each(link, &p->link_list, output_link) {
 								struct port *peer = link->input;
 
+								if (graph->n_input >= input_count) {
+									res = -ENOSPC;
+									goto error;
+								}
 								spa_log_info(impl->log, "copy input port %s[%d]:%s",
 									port->node->name, i,
 									d->ports[port->p].name);
@@ -1954,6 +1969,10 @@ static int setup_graph(struct graph *graph)
 						port->node->disabled = disabled;
 					}
 					if (!disabled) {
+						if (graph->n_input >= input_count) {
+							res = -ENOSPC;
+							goto error;
+						}
 						spa_log_info(impl->log, "input port %s[%d]:%s",
 							port->node->name, i, d->ports[port->p].name);
 						port->external = graph->n_input;
@@ -1971,6 +1990,10 @@ static int setup_graph(struct graph *graph)
 			desc = last->desc;
 			d = desc->desc;
 			for (j = 0; j < desc->n_output; j++) {
+				if (graph->n_output >= output_count) {
+					res = -ENOSPC;
+					goto error;
+				}
 				gp = &graph->output[graph->n_output++];
 				spa_log_info(impl->log, "output port %s[%d]:%s",
 						last->name, i, d->ports[desc->output[j]].name);
@@ -1982,6 +2005,10 @@ static int setup_graph(struct graph *graph)
 		} else {
 			for (n = 0; n < graph->n_output_names; n++) {
 				pname = graph->output_names[n];
+				if (graph->n_output >= output_count) {
+					res = -ENOSPC;
+					goto error;
+				}
 				gp = &graph->output[graph->n_output];
 				if (spa_streq(pname, "null")) {
 					gp->desc = NULL;