Ticket #21326: patch.txt

diff -Naur a/src/VBox/Devices/Graphics/DevVGA-SVGA3d.cpp b/src/VBox/Devices/Graphics/DevVGA-SVGA3d.cpp
--- a/src/VBox/Devices/Graphics/DevVGA-SVGA3d.cpp       2022-11-17 22:12:55.000000000 +0300
+++ b/src/VBox/Devices/Graphics/DevVGA-SVGA3d.cpp       2022-12-05 16:06:25.417632425 +0300
@@ -1093,6 +1093,8 @@
 
     VMSVGASCREENOBJECT *pScreen = &pSvgaR3State->aScreens[idDstScreen];
 
+    uint32_t const  cbScreenPixel = RT_ALIGN(pScreen->cBpp, 8) / 8;
+
     if (   srcRect.right <= srcRect.left
         || srcRect.bottom <= srcRect.top)
         return VINF_SUCCESS; /* Empty src rect. */
@@ -1186,6 +1188,8 @@
                 + ((box.x + pSurface->cxBlock - 1) / pSurface->cxBlock) * pSurface->cxBlock * pSurface->cbBlock
                 + ((box.y + pSurface->cyBlock - 1) / pSurface->cyBlock) * pSurface->cyBlock * srcMap.cbRowPitch;
 
+            uint32_t const offDstBox = (dstBox.x + box.x) * cbScreenPixel + (dstBox.y + box.y) * pScreen->cbPitch;
+
             /* The 'box' is actually in the destination coordinates relative to the top-left corner of destRect.
              * Therefore it is relative to the top-left corner of srcRect as well.
              */
@@ -1198,11 +1202,11 @@
             {
                 AssertContinue(srcDims.cyBlocks > 0);
 
-                ASSERT_GUEST_BREAK(   srcDims.offBox <= cbDst
-                                   && pScreen->cbPitch * (srcDims.cyBlocks - 1) + srcDims.cbRow <= cbDst - srcDims.offBox);
+                ASSERT_GUEST_BREAK(   offDstBox <= cbDst
+                                   && pScreen->cbPitch * (srcDims.cyBlocks - 1) + srcDims.cbRow <= cbDst - offDstBox);
                 RT_UNTRUSTED_VALIDATED_FENCE();
 
-                uint8_t *pu8DstBox = pu8Dst + srcDims.offBox;
+                uint8_t *pu8DstBox = pu8Dst + offDstBox;
 
                 if (   pSurface->format == SVGA3D_R8G8B8A8_UNORM
                     || pSurface->format == SVGA3D_R8G8B8A8_UNORM_SRGB)