Index: /trunk/src/VBox/GuestHost/OpenGL/include/cr_unpack.h
===================================================================
--- /trunk/src/VBox/GuestHost/OpenGL/include/cr_unpack.h	(revision 76786)
+++ /trunk/src/VBox/GuestHost/OpenGL/include/cr_unpack.h	(revision 76787)
@@ -70,5 +70,5 @@
 
 #define DATA_POINTER_CHECK( offset ) \
-    ( (offset) >= 0 && (cr_unpackDataEnd >= cr_unpackData) && (size_t)(cr_unpackDataEnd - cr_unpackData) > (size_t)(offset) )
+    ( (cr_unpackDataEnd >= cr_unpackData) && (size_t)(cr_unpackDataEnd - cr_unpackData) >= (size_t)(offset) )
 
 #define INCR_DATA_PTR( delta ) \
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserver/crservice.cpp
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserver/crservice.cpp	(revision 76786)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserver/crservice.cpp	(revision 76787)
@@ -367,5 +367,6 @@
         if (pBuffer)
         {
-            pBuffer->pData = RTMemAlloc(cbBufferSize);
+            /* Filling host buffer with zeroes to prevent possible host->guest memory disclosure */
+            pBuffer->pData = RTMemAllocZ(cbBufferSize);
             if (!pBuffer->pData)
             {
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_bufferobject.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_bufferobject.c	(revision 76786)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_bufferobject.c	(revision 76787)
@@ -29,5 +29,5 @@
     (void) buffers;
 
-    if (n >= INT32_MAX / sizeof(GLuint))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
     {
         crError("crServerDispatchGenBuffersARB: parameter 'n' is out of range");
@@ -68,5 +68,12 @@
     void *b;
 
+    if (size <= 0 || size >= INT32_MAX / 2)
+    {
+        crError("crServerDispatchGetBufferSubDataARB: size is out of range");
+        return;
+    }
+
     b = crCalloc(size);
+
     if (b) {
         cr_server.head_spu->dispatch_table.GetBufferSubDataARB( target, offset, size, b );
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_framebuffer.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_framebuffer.c	(revision 76786)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_framebuffer.c	(revision 76787)
@@ -29,5 +29,5 @@
     (void) framebuffers;
 
-    if (n >= INT32_MAX / sizeof(GLuint))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
     {
         crError("crServerDispatchGenFramebuffersEXT: parameter 'n' is out of range");
@@ -49,5 +49,5 @@
     (void) renderbuffers;
 
-    if (n >= INT32_MAX / sizeof(GLuint))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
     {
         crError("crServerDispatchGenRenderbuffersEXT: parameter 'n' is out of range");
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_gentextures.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_gentextures.c	(revision 76786)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_gentextures.c	(revision 76787)
@@ -17,5 +17,5 @@
     (void) textures;
 
-    if (n >= INT32_MAX / sizeof(GLuint))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
     {
         crError("crServerDispatchGenTextures: parameter 'n' is out of range");
@@ -42,5 +42,5 @@
     (void) ids;
 
-    if (n >= INT32_MAX / sizeof(GLuint))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
     {
         crError("crServerDispatchGenProgramsNV: parameter 'n' is out of range");
@@ -67,5 +67,5 @@
     (void) ids;
 
-    if (n >= INT32_MAX / sizeof(GLuint))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
     {
         crError("crServerDispatchGenFencesNV: parameter 'n' is out of range");
@@ -88,9 +88,9 @@
 void SERVER_DISPATCH_APIENTRY crServerDispatchGenProgramsARB( GLsizei n, GLuint * ids )
 {
-    GLuint *local_progs = (GLuint *) crAlloc( n*sizeof( *local_progs) );
+    GLuint *local_progs;
     GLsizei i;
     (void) ids;
 
-    if (n >= INT32_MAX / sizeof(GLuint))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
     {
         crError("crServerDispatchGenProgramsARB: parameter 'n' is out of range");
@@ -102,5 +102,5 @@
     if (!local_progs)
     {
-        crError("crServerDispatchGenProgramsARB: out of memory");
+        crError("crServerDispatchGenProgramsARB: out of money");
         return;
     }
@@ -120,5 +120,5 @@
     }
 
-    crServerReturnValue( local_progs, n*sizeof( *local_progs ) );
+    crServerReturnValue( local_progs, n * sizeof( *local_progs ) );
     crFree( local_progs );
 }
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_getshaders.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_getshaders.c	(revision 76786)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_getshaders.c	(revision 76787)
@@ -39,5 +39,5 @@
     crGetActive_t *pLocal = NULL;
 
-    if (bufSize < INT32_MAX / 2)
+    if (bufSize > 0 && bufSize < INT32_MAX / 2)
         pLocal = (crGetActive_t*)crCalloc(bufSize + sizeof(crGetActive_t));
 
@@ -59,5 +59,5 @@
     crGetActive_t *pLocal = NULL;
 
-    if (bufSize < INT32_MAX / 2)
+    if (bufSize > 0 && bufSize < INT32_MAX / 2)
         pLocal = (crGetActive_t*) crCalloc(bufSize + sizeof(crGetActive_t));
 
@@ -79,5 +79,5 @@
     GLsizei *pLocal = NULL;
 
-    if (maxCount < INT32_MAX / sizeof(GLuint) / 2)
+    if (maxCount > 0 && maxCount < INT32_MAX / sizeof(GLuint) / 2)
         pLocal = (GLsizei*) crCalloc(maxCount * sizeof(GLuint) + sizeof(GLsizei));
 
@@ -108,5 +108,5 @@
     GLsizei *pLocal = NULL;
 
-    if (maxCount < INT32_MAX / sizeof(VBoxGLhandleARB) / 2)
+    if (maxCount > 0 && maxCount < INT32_MAX / sizeof(VBoxGLhandleARB) / 2)
         pLocal = (GLsizei*) crCalloc(maxCount * sizeof(VBoxGLhandleARB) + sizeof(GLsizei));
 
@@ -140,5 +140,5 @@
     GLuint hwid;
 
-    if (maxLength < INT32_MAX / 2)
+    if (maxLength > 0 && maxLength < INT32_MAX / 2)
         pLocal = (GLsizei*) crCalloc(maxLength + sizeof(GLsizei));
 
@@ -164,5 +164,5 @@
     GLsizei *pLocal = NULL;
 
-    if (bufSize < INT32_MAX / 2)
+    if (bufSize > 0 && bufSize < INT32_MAX / 2)
         pLocal = (GLsizei*) crCalloc(bufSize + sizeof(GLsizei));
 
@@ -184,5 +184,5 @@
     GLsizei *pLocal = NULL;
 
-    if (bufSize < INT32_MAX / 2)
+    if (bufSize > 0 && bufSize < INT32_MAX / 2)
         pLocal = (GLsizei*) crCalloc(bufSize + sizeof(GLsizei));
 
@@ -205,5 +205,5 @@
     GLsizei *pLocal = NULL;
 
-    if (bufSize < INT32_MAX / 2)
+    if (bufSize > 0 && bufSize < INT32_MAX / 2)
         pLocal = (GLsizei*) crCalloc(bufSize + sizeof(GLsizei));
 
@@ -230,5 +230,5 @@
     (void) pData;
 
-    if (maxcbData < INT32_MAX / 2)
+    if (maxcbData > 0 && maxcbData < INT32_MAX / 2)
         pLocal = (GLsizei*) crCalloc(maxcbData + sizeof(GLsizei));
 
@@ -256,5 +256,5 @@
     (void) pData;
 
-    if (maxcbData < INT32_MAX / 2)
+    if (maxcbData > 0 && maxcbData < INT32_MAX / 2)
         pLocal = (GLsizei*) crCalloc(maxcbData + sizeof(GLsizei));
 
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_glsl.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_glsl.c	(revision 76786)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_glsl.c	(revision 76787)
@@ -182,5 +182,5 @@
     GLint i;
 
-    if (n >= INT32_MAX / sizeof(GLuint))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
     {
         crError("crServerDispatchDeleteProgramsARB: parameter 'n' is out of range");
@@ -223,5 +223,5 @@
     (void) residences;
 
-    if (n >= INT32_MAX / sizeof(GLuint))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
     {
         crError("crServerDispatchAreProgramsResidentNV: parameter 'n' is out of range");
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_lists.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_lists.c	(revision 76786)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_lists.c	(revision 76787)
@@ -230,5 +230,5 @@
 crServerDispatchCallLists( GLsizei n, GLenum type, const GLvoid *lists )
 {
-    if (n >= INT32_MAX / sizeof(GLuint))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
     {
         crError("crServerDispatchCallLists: parameter 'n' is out of range");
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_occlude.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_occlude.c	(revision 76786)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_occlude.c	(revision 76787)
@@ -17,5 +17,5 @@
     (void) queries;
 
-    if (n >= INT32_MAX / sizeof(GLuint))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
     {
         crError("crServerDispatchGenQueriesARB: parameter 'n' is out of range");
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_readpixels.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_readpixels.c	(revision 76786)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_readpixels.c	(revision 76787)
@@ -49,5 +49,5 @@
         uint32_t msg_len;
 
-        if (bytes_per_row < 0 || bytes_per_row > UINT32_MAX / 8 || height > UINT32_MAX / 8)
+        if (bytes_per_row <= 0 || height <= 0 || bytes_per_row > INT32_MAX / height)
         {
             crError("crServerDispatchReadPixels: parameters out of range");
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_texture.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_texture.c	(revision 76786)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_texture.c	(revision 76787)
@@ -169,5 +169,5 @@
 void SERVER_DISPATCH_APIENTRY crServerDispatchGetTexEnvfv( GLenum target, GLenum pname, GLfloat * params )
 {
-    GLfloat local_params[4];
+    GLfloat local_params[4] = {0};
     (void) params;
     if (GL_POINT_SPRITE != target && pname != GL_COORD_REPLACE)
@@ -181,5 +181,5 @@
 void SERVER_DISPATCH_APIENTRY crServerDispatchGetTexEnviv( GLenum target, GLenum pname, GLint * params )
 {
-    GLint local_params[4];
+    GLint local_params[4] = {0};
     (void) params;
     if (GL_POINT_SPRITE != target && pname != GL_COORD_REPLACE)
@@ -203,5 +203,5 @@
     GLint i;
 
-    if (n >= UINT32_MAX / sizeof(GLuint))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
     {
         crError("crServerDispatchDeleteTextures: parameter 'n' is out of range");
@@ -239,5 +239,5 @@
     GLint i;
 
-    if (n >= INT32_MAX / sizeof(GLuint))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
     {
         crError("crServerDispatchPrioritizeTextures: parameter 'n' is out of range");
@@ -285,5 +285,5 @@
     (void) residences;
 
-    if (n >= INT32_MAX / sizeof(GLuint))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
     {
         crError("crServerDispatchAreTexturesResident: parameter 'n' is out of range");
Index: /trunk/src/VBox/HostServices/SharedOpenGL/dlm/dlm_lists.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/dlm/dlm_lists.c	(revision 76786)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/dlm/dlm_lists.c	(revision 76787)
@@ -354,5 +354,5 @@
     crDebug("DLM: CallLists(%d, %u, %p).", n, type, lists);
 
-    if (n >= INT32_MAX / sizeof(GLuint))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint))
     {
         crError("crDLMCallLists: parameter 'n' is out of range");
Index: /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_map.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_map.c	(revision 76786)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_map.c	(revision 76787)
@@ -35,5 +35,5 @@
 
     cbMax = (ustride * uorder + vstride * vorder) * sizeof(double);
-    if (!DATA_POINTER_CHECK(cbMax - 1))
+    if (!DATA_POINTER_CHECK(cbMax))
     {
         crError("crUnpackMap2d: parameters out of range");
@@ -70,5 +70,5 @@
 
     cbMax = (ustride * uorder + vstride * vorder) * sizeof(float);
-    if (!DATA_POINTER_CHECK(cbMax - 1))
+    if (!DATA_POINTER_CHECK(cbMax))
     {
         crError("crUnpackMap2f: parameters out of range");
@@ -99,5 +99,5 @@
 
     cbMax = stride * order * sizeof(double);
-    if (!DATA_POINTER_CHECK(cbMax - 1))
+    if (!DATA_POINTER_CHECK(cbMax))
     {
         crError("crUnpackMap1d: parameters out of range");
@@ -128,5 +128,5 @@
 
     cbMax = stride * order * sizeof(float);
-    if (!DATA_POINTER_CHECK(cbMax - 1))
+    if (!DATA_POINTER_CHECK(cbMax))
     {
         crError("crUnpackMap1f: parameters out of range");
Index: /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_program.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_program.c	(revision 76786)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_program.c	(revision 76787)
@@ -45,5 +45,5 @@
     GLdouble *params;
 
-    if (num >= UINT32_MAX / (4 * sizeof(GLdouble)))
+    if (num <= 0 || num >= INT32_MAX / (4 * sizeof(GLdouble)))
     {
         crError("crUnpackExtendProgramParameters4dvNV: parameter 'num' is out of range");
@@ -71,5 +71,5 @@
     GLfloat *params;
 
-    if (num >= UINT32_MAX / (4 * sizeof(GLfloat)))
+    if (num <= 0 || num >= INT32_MAX / (4 * sizeof(GLfloat)))
     {
         crError("crUnpackExtendProgramParameters4fvNV: parameter 'num' is out of range");
@@ -95,5 +95,5 @@
     const GLuint *programs = DATA_POINTER(12, const GLuint);
 
-    if (n > UINT32_MAX / sizeof(GLuint) / 4 || !DATA_POINTER_CHECK(20 + n * sizeof(GLuint)))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint) / 4 || !DATA_POINTER_CHECK(20 + n * sizeof(GLuint)))
     {
         crError("crUnpackExtendAreProgramsResidentNV: %d is out of range", n);
@@ -226,5 +226,5 @@
     const GLubyte *name = DATA_POINTER(16, GLubyte);
 
-    if (len > UINT32_MAX / 4 || !DATA_POINTER_CHECK(16 + len + 8))
+    if (len <= 0 || len >= INT32_MAX / 4 || !DATA_POINTER_CHECK(16 + len + 8))
     {
         crError("crUnpackExtendGetProgramNamedParameterdvNV: len %d is out of range", len);
@@ -243,5 +243,5 @@
     const GLubyte *name = DATA_POINTER(16, GLubyte);
 
-    if (len > UINT32_MAX / 4 || !DATA_POINTER_CHECK(16 + len + 8))
+    if (len <= 0 || len >= INT32_MAX / 4 || !DATA_POINTER_CHECK(16 + len + 8))
     {
         crError("crUnpackExtendGetProgramNamedParameterfvNV: len %d is out of range", len);
Index: /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_shaders.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_shaders.c	(revision 76786)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_shaders.c	(revision 76787)
@@ -43,5 +43,5 @@
     int pos, pos_check;
 
-    if (count >= UINT32_MAX / sizeof(char *) / 4)
+    if (count <= 0 || count >= INT32_MAX / sizeof(char *) / 4)
     {
         crError("crUnpackExtendShaderSource: count %u is out of range", count);
@@ -339,4 +339,11 @@
     GLuint program = READ_DATA(8, GLuint);
     const char *name = DATA_POINTER(12, const char);
+
+    if (!DATA_POINTER_CHECK(packet_length))
+    {
+        crError("crUnpackExtendGetAttribLocation: packet_length is out of range");
+        return;
+    }
+
     SET_RETURN_PTR(packet_length-16);
     SET_WRITEBACK_PTR(packet_length-8);
@@ -349,4 +356,11 @@
     GLuint program = READ_DATA(8, GLuint);
     const char *name = DATA_POINTER(12, const char);
+
+    if (!DATA_POINTER_CHECK(packet_length))
+    {
+        crError("crUnpackExtendGetUniformLocation: packet_length is out of range");
+        return;
+    }
+
     SET_RETURN_PTR(packet_length-16);
     SET_WRITEBACK_PTR(packet_length-8);
Index: /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_texture.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_texture.c	(revision 76786)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_texture.c	(revision 76787)
@@ -328,5 +328,5 @@
     const GLuint *textures = DATA_POINTER( 12, const GLuint );
 
-    if (n > UINT32_MAX / sizeof(GLuint) / 4 || !DATA_POINTER_CHECK(20 + n * sizeof(GLuint)))
+    if (n <= 0 || n >= INT32_MAX / sizeof(GLuint) / 4 || !DATA_POINTER_CHECK(20 + n * sizeof(GLuint)))
     {
         crError("crUnpackExtendAreTexturesResident: %d is out of range", n);
Index: /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_visibleregion.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_visibleregion.c	(revision 76786)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_visibleregion.c	(revision 76787)
@@ -26,5 +26,12 @@
     GLint window = READ_DATA( 8, GLint );
     GLint cRects = READ_DATA( 12, GLint );
-    GLvoid *pRects = DATA_POINTER( 16, GLvoid );;
+    GLvoid *pRects = DATA_POINTER( 16, GLvoid );
+
+    if (cRects <= 0 || cRects >= INT32_MAX / sizeof(GLint) / 8 || !DATA_POINTER_CHECK(16 + 4 * cRects * sizeof(GLint)))
+    {
+        crError("crUnpackExtendWindowVisibleRegion: parameter 'cRects' is out of range");
+        return;
+    }
+
     cr_unpackDispatch.WindowVisibleRegion( window, cRects, pRects );
 }
