Index: trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_boundsinfo.c
===================================================================
--- trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_boundsinfo.c	(revision 71462)
+++ trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_boundsinfo.c	(revision 71468)
@@ -297,5 +297,5 @@
 						crServerSetOutputBounds( mural, mural->curExtent );
 					}
-					crUnpack( data_ptr, data_ptr-1, num_opcodes, &(cr_server.dispatch) );
+                    crUnpack( data_ptr, NULL, data_ptr-1, num_opcodes, &(cr_server.dispatch) );
 				}
 			}
@@ -320,5 +320,5 @@
 					crServerSetOutputBounds( mural, i );
 				}
-				crUnpack( data_ptr, data_ptr-1, num_opcodes, &(cr_server.dispatch) );
+                crUnpack( data_ptr, NULL, data_ptr-1, num_opcodes, &(cr_server.dispatch) );
 			}
 		}
Index: trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_stream.c
===================================================================
--- trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_stream.c	(revision 71462)
+++ trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_stream.c	(revision 71468)
@@ -559,5 +559,5 @@
         const CRMessageOpcodes *msg_opcodes;
         int opcodeBytes;
-        const char *data_ptr;
+        const char *data_ptr, *data_ptr_end;
 
         RTListNodeRemove(&pIter->Node);
@@ -569,6 +569,8 @@
 
         data_ptr = (const char *) msg_opcodes + sizeof (CRMessageOpcodes) + opcodeBytes;
+        data_ptr_end = (const char *)msg_opcodes + pIter->cbMsg;
 
         crUnpack(data_ptr,                 /* first command's operands */
+                 data_ptr_end,             /* first byte after command's operands*/
                  data_ptr - 1,             /* first command's opcode */
                  msg_opcodes->numOpcodes,  /* how many opcodes */
@@ -590,5 +592,5 @@
     const CRMessageOpcodes *msg_opcodes;
     int opcodeBytes;
-    const char *data_ptr;
+    const char *data_ptr, *data_ptr_end;
 #ifdef VBOX_WITH_CRHGSMI
     PCRVBOXHGSMI_CMDDATA pCmdData = NULL;
@@ -616,4 +618,5 @@
 
     data_ptr = (const char *) msg_opcodes + sizeof(CRMessageOpcodes) + opcodeBytes;
+    data_ptr_end = (const char *)msg_opcodes + cbMsg; // Pointer to the first byte after message data
 
     enmType = crUnpackGetBufferType(data_ptr - 1,             /* first command's opcode */
@@ -677,4 +680,5 @@
     {
         crUnpack(data_ptr,                 /* first command's operands */
+                 data_ptr_end,             /* first byte after command's operands*/
                  data_ptr - 1,             /* first command's opcode */
                  msg_opcodes->numOpcodes,  /* how many opcodes */
Index: trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack.py
===================================================================
--- trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack.py	(revision 71462)
+++ trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack.py	(revision 71468)
@@ -26,4 +26,5 @@
 
 DECLEXPORT(const unsigned char *) cr_unpackData = NULL;
+DECLEXPORT(const unsigned char *) cr_unpackDataEnd = NULL;
 SPUDispatchTable cr_unpackDispatch;
 
@@ -240,5 +241,5 @@
 }
 
-void crUnpack( const void *data, const void *opcodes, 
+void crUnpack( const void *data, const void *data_end, const void *opcodes, 
         unsigned int num_opcodes, SPUDispatchTable *table )
 {
@@ -253,4 +254,5 @@
     unpack_opcodes = (const unsigned char *)opcodes;
     cr_unpackData = (const unsigned char *)data;
+    cr_unpackDataEnd = (const unsigned char *)data;
 
 #if defined(CR_UNPACK_DEBUG_OPCODES) || defined(CR_UNPACK_DEBUG_LAST_OPCODES)
Index: trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_shaders.c
===================================================================
--- trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_shaders.c	(revision 71462)
+++ trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_shaders.c	(revision 71468)
@@ -41,13 +41,7 @@
     char **ppStrings = NULL;
     GLsizei i, j, jUpTo;
-    int pos=20+count*sizeof(*pLocalLength);
-
-    if (hasNonLocalLen>0)
-    {
-        length = DATA_POINTER(pos, GLint);
-        pos += count*sizeof(*length);
-    }
-
-    if (count >= UINT32_MAX / sizeof(char*))
+    int pos, pos_check;
+
+    if (count >= UINT32_MAX / sizeof(char *) / 4)
     {
         crError("crUnpackExtendShaderSource: count %u is out of range", count);
@@ -55,8 +49,35 @@
     }
 
-    ppStrings = crAlloc(count*sizeof(char*));
+    pos = 20 + count * sizeof(*pLocalLength);
+
+    if (hasNonLocalLen > 0)
+    {
+        length = DATA_POINTER(pos, GLint);
+        pos += count * sizeof(*length);
+    }
+
+    pos_check = pos; 
+
+    if (!DATA_POINTER_CHECK(pos_check))
+    {
+        crError("crUnpackExtendShaderSource: pos %d is out of range", pos_check);
+        return;
+    }
+
+    for (i = 0; i < count; ++i)
+    {
+        if (pLocalLength[i] <= 0 || pos_check >= INT32_MAX - pLocalLength[i] || !DATA_POINTER_CHECK(pos_check))
+        {
+            crError("crUnpackExtendShaderSource: pos %d is out of range", pos_check);
+            return;
+        }
+
+        pos_check += pLocalLength[i];
+    }
+
+    ppStrings = crAlloc(count * sizeof(char*));
     if (!ppStrings) return;
 
-    for (i=0; i<count; ++i)
+    for (i = 0; i < count; ++i)
     {
         ppStrings[i] = DATA_POINTER(pos, char);
