Index: /trunk/src/VBox/Frontends/VBoxHeadless/VBoxHeadless.cpp
===================================================================
--- /trunk/src/VBox/Frontends/VBoxHeadless/VBoxHeadless.cpp	(revision 29517)
+++ /trunk/src/VBox/Frontends/VBoxHeadless/VBoxHeadless.cpp	(revision 29518)
@@ -305,5 +305,5 @@
 
     STDMETHOD(OnMousePointerShapeChange)(BOOL visible, BOOL alpha, ULONG xHot, ULONG yHot,
-                                         ULONG width, ULONG height, BYTE *shape)
+                                         ULONG width, ULONG height, ComSafeArrayIn(BYTE,shape))
     {
         return VBOX_E_DONT_CALL_AGAIN;
@@ -1243,3 +1243,2 @@
 }
 #endif /* !VBOX_WITH_HARDENING */
-
Index: /trunk/src/VBox/Frontends/VBoxSDL/VBoxSDL.cpp
===================================================================
--- /trunk/src/VBox/Frontends/VBoxSDL/VBoxSDL.cpp	(revision 29517)
+++ /trunk/src/VBox/Frontends/VBoxSDL/VBoxSDL.cpp	(revision 29518)
@@ -100,21 +100,17 @@
 {
     PointerShapeChangeData(BOOL aVisible, BOOL aAlpha, ULONG aXHot, ULONG aYHot,
-                           ULONG aWidth, ULONG aHeight, const uint8_t *aShape)
+                           ULONG aWidth, ULONG aHeight, ComSafeArrayIn(BYTE,pShape))
         : visible(aVisible), alpha(aAlpha), xHot(aXHot), yHot(aYHot),
-          width(aWidth), height(aHeight), shape(NULL)
+          width(aWidth), height(aHeight)
     {
         // make a copy of the shape
-        if (aShape)
-        {
-            uint32_t shapeSize = ((((aWidth + 7) / 8) * aHeight + 3) & ~3) + aWidth * 4 * aHeight;
-            shape = new uint8_t [shapeSize];
-            if (shape)
-                memcpy((void *)shape, (void *)aShape, shapeSize);
-        }
+        com::SafeArray <BYTE> aShape(ComSafeArrayInArg (pShape));
+        size_t cbShapeSize = aShape.size();
+        shape.resize(cbShapeSize);
+        ::memcpy(shape.raw(), aShape.raw(), cbShapeSize);
     }
 
     ~PointerShapeChangeData()
     {
-        if (shape) delete[] shape;
     }
 
@@ -125,5 +121,5 @@
     const ULONG width;
     const ULONG height;
-    const uint8_t *shape;
+    com::SafeArray<BYTE> shape;
 };
 
@@ -401,9 +397,9 @@
 
     STDMETHOD(OnMousePointerShapeChange)(BOOL visible, BOOL alpha, ULONG xHot, ULONG yHot,
-                                         ULONG width, ULONG height, BYTE *shape)
+                                         ULONG width, ULONG height, ComSafeArrayIn(BYTE, shape))
     {
         PointerShapeChangeData *data;
         data = new PointerShapeChangeData(visible, alpha, xHot, yHot, width, height,
-                                          shape);
+                                          ComSafeArrayInArg(shape));
         Assert(data);
         if (!data)
@@ -4430,5 +4426,5 @@
         return;
 
-    if (data->shape)
+    if (data->shape.size() > 0)
     {
         bool ok = false;
@@ -4437,6 +4433,7 @@
         uint32_t srcShapePtrScan = data->width * 4;
 
-        const uint8_t *srcAndMaskPtr = data->shape;
-        const uint8_t *srcShapePtr = data->shape + ((andMaskSize + 3) & ~3);
+        const uint8_t* shape = data->shape.raw();
+        const uint8_t *srcAndMaskPtr = shape;
+        const uint8_t *srcShapePtr = shape + ((andMaskSize + 3) & ~3);
 
 #if 0
Index: /trunk/src/VBox/Frontends/VirtualBox/src/VBoxConsoleView.cpp
===================================================================
--- /trunk/src/VBox/Frontends/VirtualBox/src/VBoxConsoleView.cpp	(revision 29517)
+++ /trunk/src/VBox/Frontends/VirtualBox/src/VBoxConsoleView.cpp	(revision 29518)
@@ -30,4 +30,5 @@
 #include "VBoxGlobal.h"
 #include "VBoxProblemReporter.h"
+#include "VBox/com/array.h"
 
 #ifdef Q_WS_PM
@@ -209,20 +210,15 @@
     MousePointerChangeEvent (bool visible, bool alpha, uint xhot, uint yhot,
                              uint width, uint height,
-                             const uchar *shape) :
+                             ComSafeArrayIn(BYTE,pShape)) :
         QEvent ((QEvent::Type) VBoxDefs::MousePointerChangeEventType),
-        vis (visible), alph (alpha), xh (xhot), yh (yhot), w (width), h (height),
-        data (NULL)
-    {
-        // make a copy of shape
-        uint dataSize = ((((width + 7) / 8 * height) + 3) & ~3) + width * 4 * height;
-
-        if (shape) {
-            data = new uchar [dataSize];
-            memcpy ((void *) data, (void *) shape, dataSize);
-        }
+        vis (visible), alph (alpha), xh (xhot), yh (yhot), w (width), h (height)
+    {
+        com::SafeArray <BYTE> aShape(ComSafeArrayInArg (pShape));
+        size_t cbShapeSize = aShape.size();
+        shape.resize(cbShapeSize);
+        ::memcpy(shape.raw(), aShape.raw(), cbShapeSize);
     }
     ~MousePointerChangeEvent()
     {
-        if (data) delete[] data;
     }
     bool isVisible() const { return vis; }
@@ -232,9 +228,9 @@
     uint width() const { return w; }
     uint height() const { return h; }
-    const uchar *shapeData() const { return data; }
+    const uchar *shapeData() const { return shape.raw(); }
 private:
     bool vis, alph;
     uint xh, yh, w, h;
-    const uchar *data;
+    com::SafeArray <uint8_t> shape;
 };
 
@@ -423,10 +419,10 @@
                                           ULONG xhot, ULONG yhot,
                                           ULONG width, ULONG height,
-                                          BYTE *shape)
+                                          ComSafeArrayIn(BYTE,shape))
     {
         QApplication::postEvent (mView,
                                  new MousePointerChangeEvent (visible, alpha,
                                                               xhot, yhot,
-                                                              width, height, shape));
+                                                              width, height, ComSafeArrayInArg(shape)));
         return S_OK;
     }
Index: /trunk/src/VBox/Frontends/VirtualBox/src/runtime/UISession.cpp
===================================================================
--- /trunk/src/VBox/Frontends/VirtualBox/src/runtime/UISession.cpp	(revision 29517)
+++ /trunk/src/VBox/Frontends/VirtualBox/src/runtime/UISession.cpp	(revision 29518)
@@ -55,19 +55,16 @@
 public:
 
-    UIMousePointerShapeChangeEvent(bool bIsVisible, bool bIsAlpha, uint uXHot, uint uYHot, uint uWidth, uint uHeight, const uchar *pShape)
+    UIMousePointerShapeChangeEvent(bool bIsVisible, bool bIsAlpha, uint uXHot, uint uYHot, uint uWidth, uint uHeight, ComSafeArrayIn(BYTE,pShape))
         : QEvent((QEvent::Type)UIConsoleEventType_MousePointerShapeChange)
-        , m_bIsVisible(bIsVisible), m_bIsAlpha(bIsAlpha), m_uXHot(uXHot), m_uYHot(uYHot), m_uWidth(uWidth), m_uHeight(uHeight), m_pData(0)
-    {
-        uint dataSize = ((((m_uWidth + 7) / 8 * m_uHeight) + 3) & ~3) + m_uWidth * 4 * m_uHeight;
-        if (pShape)
-        {
-            m_pData = new uchar[dataSize];
-            memcpy((void*)m_pData, (void*)pShape, dataSize);
-        }
+        , m_bIsVisible(bIsVisible), m_bIsAlpha(bIsAlpha), m_uXHot(uXHot), m_uYHot(uYHot), m_uWidth(uWidth), m_uHeight(uHeight)
+    {
+        com::SafeArray <BYTE> aShape(ComSafeArrayInArg (pShape));
+        size_t cbShapeSize = aShape.size();
+        m_shape.resize(cbShapeSize);
+        ::memcpy(m_shape.raw(), aShape.raw(), cbShapeSize);
     }
 
     virtual ~UIMousePointerShapeChangeEvent()
     {
-        if (m_pData) delete[] m_pData;
     }
 
@@ -78,5 +75,5 @@
     uint width() const { return m_uWidth; }
     uint height() const { return m_uHeight; }
-    const uchar *shapeData() const { return m_pData; }
+    const uchar *shapeData() const { return m_shape.raw(); }
 
 private:
@@ -84,5 +81,5 @@
     bool m_bIsVisible, m_bIsAlpha;
     uint m_uXHot, m_uYHot, m_uWidth, m_uHeight;
-    const uchar *m_pData;
+    com::SafeArray <uint8_t> m_shape;
 };
 
@@ -386,7 +383,7 @@
     VBOX_SCRIPTABLE_DISPATCH_IMPL(IConsoleCallback)
 
-    STDMETHOD(OnMousePointerShapeChange)(BOOL bIsVisible, BOOL bAlpha, ULONG uXHot, ULONG uYHot, ULONG uWidth, ULONG uHeight, BYTE *pShape)
-    {
-        QApplication::postEvent(m_pEventHandler, new UIMousePointerShapeChangeEvent(bIsVisible, bAlpha, uXHot, uYHot, uWidth, uHeight, pShape));
+    STDMETHOD(OnMousePointerShapeChange)(BOOL bIsVisible, BOOL bAlpha, ULONG uXHot, ULONG uYHot, ULONG uWidth, ULONG uHeight, ComSafeArrayIn(BYTE,pShape))
+    {
+        QApplication::postEvent(m_pEventHandler, new UIMousePointerShapeChangeEvent(bIsVisible, bAlpha, uXHot, uYHot, uWidth, uHeight, ComSafeArrayInArg(pShape)));
         return S_OK;
     }
Index: /trunk/src/VBox/Main/ConsoleImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/ConsoleImpl.cpp	(revision 29517)
+++ /trunk/src/VBox/Main/ConsoleImpl.cpp	(revision 29518)
@@ -618,5 +618,5 @@
     /* dynamically allocated members of mCallbackData are uninitialized
      * at the end of powerDown() */
-    Assert(!mCallbackData.mpsc.valid && mCallbackData.mpsc.shape == NULL);
+    Assert(!mCallbackData.mpsc.valid && mCallbackData.mpsc.shape.isNull());
     Assert(!mCallbackData.mcc.valid);
     Assert(!mCallbackData.klc.valid);
@@ -3026,5 +3026,5 @@
                                              mCallbackData.mpsc.width,
                                              mCallbackData.mpsc.height,
-                                             mCallbackData.mpsc.shape);
+                                             ComSafeArrayAsInParam(mCallbackData.mpsc.shape));
     if (mCallbackData.mcc.valid)
         aCallback->OnMouseCapabilityChange(mCallbackData.mcc.supportsAbsolute,
@@ -4642,5 +4642,5 @@
                                         uint32_t xHot, uint32_t yHot,
                                         uint32_t width, uint32_t height,
-                                        void *pShape)
+                                        ComSafeArrayIn(BYTE,pShape))
 {
 #if 0
@@ -4668,36 +4668,15 @@
     mCallbackData.mpsc.valid = false;
 
-    if (pShape != NULL)
-    {
-        size_t cb = (width + 7) / 8 * height; /* size of the AND mask */
-        cb = ((cb + 3) & ~3) + width * 4 * height; /* + gap + size of the XOR mask */
-        /* try to reuse the old shape buffer if the size is the same */
-        if (!wasValid)
-            mCallbackData.mpsc.shape = NULL;
-        else
-        if (mCallbackData.mpsc.shape != NULL && mCallbackData.mpsc.shapeSize != cb)
-        {
-            RTMemFree(mCallbackData.mpsc.shape);
-            mCallbackData.mpsc.shape = NULL;
-        }
-        if (mCallbackData.mpsc.shape == NULL)
-        {
-            mCallbackData.mpsc.shape = (BYTE *) RTMemAllocZ(cb);
-            AssertReturnVoid(mCallbackData.mpsc.shape);
-        }
-        mCallbackData.mpsc.shapeSize = cb;
-        memcpy(mCallbackData.mpsc.shape, pShape, cb);
+    com::SafeArray <BYTE> aShape(ComSafeArrayInArg (pShape));
+    if (aShape.size() != 0)
+    {
+        mCallbackData.mpsc.shape.resize(aShape.size());
+        ::memcpy( mCallbackData.mpsc.shape.raw(), aShape.raw(), aShape.size());
     }
     else
-    {
-        if (wasValid && mCallbackData.mpsc.shape != NULL)
-            RTMemFree(mCallbackData.mpsc.shape);
-        mCallbackData.mpsc.shape = NULL;
-        mCallbackData.mpsc.shapeSize = 0;
-    }
-
+        mCallbackData.mpsc.shape.setNull();
     mCallbackData.mpsc.valid = true;
 
-    CONSOLE_DO_CALLBACKS(OnMousePointerShapeChange,(fVisible, fAlpha, xHot, yHot, width, height, (BYTE *) pShape));
+    CONSOLE_DO_CALLBACKS(OnMousePointerShapeChange,(fVisible, fAlpha, xHot, yHot, width, height, ComSafeArrayInArg(pShape)));
 
 #if 0
@@ -5666,8 +5645,5 @@
         /* uninit dynamically allocated members of mCallbackData */
         if (mCallbackData.mpsc.valid)
-        {
-            if (mCallbackData.mpsc.shape != NULL)
-                RTMemFree(mCallbackData.mpsc.shape);
-        }
+            mCallbackData.mpsc.shape.setNull();
         memset(&mCallbackData, 0, sizeof(mCallbackData));
     }
Index: /trunk/src/VBox/Main/ConsoleVRDPServer.cpp
===================================================================
--- /trunk/src/VBox/Main/ConsoleVRDPServer.cpp	(revision 29517)
+++ /trunk/src/VBox/Main/ConsoleVRDPServer.cpp	(revision 29518)
@@ -82,5 +82,5 @@
 
     STDMETHOD(OnMousePointerShapeChange)(BOOL visible, BOOL alpha, ULONG xHot, ULONG yHot,
-                                         ULONG width, ULONG height, BYTE *shape);
+                                         ULONG width, ULONG height, ComSafeArrayIn(BYTE,shape));
 
     STDMETHOD(OnMouseCapabilityChange)(BOOL supportsAbsolute, BOOL supportsRelative, BOOL needsHostCursor)
@@ -431,5 +431,5 @@
                                                             ULONG width,
                                                             ULONG height,
-                                                            BYTE *shape)
+                                                            ComSafeArrayIn(BYTE,inShape))
 {
     LogSunlover(("VRDPConsoleCallback::OnMousePointerShapeChange: %d, %d, %lux%lu, @%lu,%lu\n", visible, alpha, width, height, xHot, yHot));
@@ -437,5 +437,6 @@
     if (m_server)
     {
-        if (!shape)
+        com::SafeArray <BYTE> aShape(ComSafeArrayInArg (inShape));
+        if (aShape.size() == 0)
         {
             if (!visible)
@@ -462,4 +463,5 @@
              * because most pointers are 32x32.
              */
+            uint8_t* shape = aShape.raw();
 
             dumpPointer(shape, width, height, true);
Index: /trunk/src/VBox/Main/DisplayImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/DisplayImpl.cpp	(revision 29517)
+++ /trunk/src/VBox/Main/DisplayImpl.cpp	(revision 29518)
@@ -3829,7 +3829,12 @@
     Display *pThis = pDrv->pDisplay;
 
+    size_t cbShapeSize = (cx + 7) / 8 * cy; /* size of the AND mask */
+    cbShapeSize = ((cbShapeSize + 3) & ~3) + cx * 4 * cy; /* + gap + size of the XOR mask */
+    com::SafeArray<BYTE> shapeData(cbShapeSize);
+    ::memcpy(shapeData.raw(), pvShape, cbShapeSize);
+
     /* Tell the console about it */
     pDrv->pDisplay->mParent->onMousePointerShapeChange(fVisible, fAlpha,
-                                                       xHot, yHot, cx, cy, (void *)pvShape);
+                                                       xHot, yHot, cx, cy, ComSafeArrayAsInParam(shapeData));
 
     return VINF_SUCCESS;
Index: /trunk/src/VBox/Main/VMMDevInterface.cpp
===================================================================
--- /trunk/src/VBox/Main/VMMDevInterface.cpp	(revision 29517)
+++ /trunk/src/VBox/Main/VMMDevInterface.cpp	(revision 29518)
@@ -284,6 +284,10 @@
 
     /* tell the console about it */
+    size_t cbShapeSize = (width + 7) / 8 * height; /* size of the AND mask */
+    cbShapeSize = ((cbShapeSize + 3) & ~3) + width * 4 * height; /* + gap + size of the XOR mask */
+    com::SafeArray<BYTE> shapeData(cbShapeSize);
+    ::memcpy(shapeData.raw(), pShape, cbShapeSize);
     pDrv->pVMMDev->getParent()->onMousePointerShapeChange(fVisible, fAlpha,
-                                                          xHot, yHot, width, height, pShape);
+                                                          xHot, yHot, width, height, ComSafeArrayAsInParam(shapeData));
 }
 
Index: /trunk/src/VBox/Main/VirtualBoxCallbackImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/VirtualBoxCallbackImpl.cpp	(revision 29517)
+++ /trunk/src/VBox/Main/VirtualBoxCallbackImpl.cpp	(revision 29518)
@@ -162,19 +162,10 @@
 /////////////////////////////////////////////////////////////////////////////
 STDMETHODIMP CallbackWrapper::OnMousePointerShapeChange(BOOL visible, BOOL alpha, ULONG xHot, ULONG yHot,
-                                                        ULONG width, ULONG height, BYTE *shape)
-{
-    if (mConsoleCallback.isNull())
-        return S_OK;
-
-#if defined(RT_OS_WINDOWS) && defined(RT_ARCH_AMD64)
-    /* Letting this thru crashes in VariantInit, probably because the last
-       parameter is a BYTE pointer.  For now, don't let it thru to python or
-       what other users this class might have. */
-    /** @todo Figure if this applies to 32-bit hosts as well. */
-    /** @todo Find better solution? */
-    return VBOX_E_DONT_CALL_AGAIN;
-#else
-    return mConsoleCallback->OnMousePointerShapeChange(visible, alpha, xHot, yHot, width, height, shape);
-#endif
+                                                        ULONG width, ULONG height, ComSafeArrayIn(BYTE, shape))
+{
+    if (mConsoleCallback.isNull())
+        return S_OK;
+
+    return mConsoleCallback->OnMousePointerShapeChange(visible, alpha, xHot, yHot, width, height, ComSafeArrayInArg(shape));
 }
 
Index: /trunk/src/VBox/Main/idl/VirtualBox.xidl
===================================================================
--- /trunk/src/VBox/Main/idl/VirtualBox.xidl	(revision 29517)
+++ /trunk/src/VBox/Main/idl/VirtualBox.xidl	(revision 29518)
@@ -6172,7 +6172,7 @@
         </desc>
       </param>
-      <param name="shape" type="octet" mod="ptr" dir="in">
-        <desc>
-          Address of the shape buffer.
+      <param name="shape" type="octet" safearray="yes" dir="in">
+        <desc>
+          Shape buffer arrays.
 
           The @a shape buffer contains a 1-bpp (bits per pixel) AND mask
Index: /trunk/src/VBox/Main/include/ConsoleImpl.h
===================================================================
--- /trunk/src/VBox/Main/include/ConsoleImpl.h	(revision 29517)
+++ /trunk/src/VBox/Main/include/ConsoleImpl.h	(revision 29518)
@@ -21,4 +21,5 @@
 #include "VirtualBoxBase.h"
 #include "SchemaDefs.h"
+#include "VBox/com/array.h"
 
 class Guest;
@@ -206,5 +207,5 @@
                                    uint32_t xHot, uint32_t yHot,
                                    uint32_t width, uint32_t height,
-                                   void *pShape);
+                                   ComSafeArrayIn(uint8_t, aShape));
     void onMouseCapabilityChange(BOOL supportsAbsolute, BOOL supportsRelative, BOOL needsHostCursor);
     void onStateChange(MachineState_T aMachineState);
@@ -675,6 +676,5 @@
             uint32_t width;
             uint32_t height;
-            BYTE *shape;
-            size_t shapeSize;
+            com::SafeArray<BYTE> shape;
         }
         mpsc;
Index: /trunk/src/VBox/Main/include/DisplayImpl.h
===================================================================
--- /trunk/src/VBox/Main/include/DisplayImpl.h	(revision 29517)
+++ /trunk/src/VBox/Main/include/DisplayImpl.h	(revision 29518)
@@ -150,5 +150,5 @@
     // IConsoleCallback methods
     STDMETHOD(OnMousePointerShapeChange)(BOOL visible, BOOL alpha, ULONG xHot, ULONG yHot,
-                                         ULONG width, ULONG height, BYTE *shape)
+                                         ULONG width, ULONG height, ComSafeArrayIn(BYTE,shape))
     {
         return S_OK;
