Index: /trunk/src/VBox/Main/include/ConsoleImpl.h
===================================================================
--- /trunk/src/VBox/Main/include/ConsoleImpl.h	(revision 52933)
+++ /trunk/src/VBox/Main/include/ConsoleImpl.h	(revision 52934)
@@ -235,5 +235,6 @@
                                      uint32_t xHot, uint32_t yHot,
                                      uint32_t width, uint32_t height,
-                                     ComSafeArrayIn(uint8_t, aShape));
+                                     const uint8_t *pu8Shape,
+                                     uint32_t cbShape);
     void i_onMouseCapabilityChange(BOOL supportsAbsolute, BOOL supportsRelative,
                                    BOOL supportsMT, BOOL needsHostCursor);
Index: /trunk/src/VBox/Main/include/MouseImpl.h
===================================================================
--- /trunk/src/VBox/Main/include/MouseImpl.h	(revision 52933)
+++ /trunk/src/VBox/Main/include/MouseImpl.h	(revision 52934)
@@ -108,5 +108,5 @@
     HRESULT i_convertDisplayRes(LONG x, LONG y, int32_t *pxAdj, int32_t *pyAdj,
                                  bool *pfValid);
-    HRESULT i_putEventMultiTouch(LONG aCount, LONG64 *paContacts, ULONG aScanTime);
+    HRESULT i_putEventMultiTouch(LONG aCount, const LONG64 *paContacts, ULONG aScanTime);
 
     void i_getDeviceCaps(bool *pfAbs, bool *pfRel, bool *fMT);
Index: /trunk/src/VBox/Main/include/USBProxyService.h
===================================================================
--- /trunk/src/VBox/Main/include/USBProxyService.h	(revision 52933)
+++ /trunk/src/VBox/Main/include/USBProxyService.h	(revision 52934)
@@ -58,5 +58,5 @@
     /** @name Host Interfaces
      * @{ */
-    HRESULT getDeviceCollection(ComSafeArrayOut(IHostUSBDevice *, aUSBDevices));
+    HRESULT getDeviceCollection(std::vector<ComPtr<IHostUSBDevice> > &aUSBDevices);
     /** @} */
 
Index: /trunk/src/VBox/Main/src-client/ConsoleImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-client/ConsoleImpl.cpp	(revision 52933)
+++ /trunk/src/VBox/Main/src-client/ConsoleImpl.cpp	(revision 52934)
@@ -6336,6 +6336,7 @@
 void Console::i_onMousePointerShapeChange(bool fVisible, bool fAlpha,
                                           uint32_t xHot, uint32_t yHot,
-                                        uint32_t width, uint32_t height,
-                                        ComSafeArrayIn(BYTE,pShape))
+                                          uint32_t width, uint32_t height,
+                                          const uint8_t *pu8Shape,
+                                          uint32_t cbShape)
 {
 #if 0
@@ -6348,10 +6349,12 @@
     AssertComRCReturnVoid(autoCaller.rc());
 
-    com::SafeArray<BYTE> aShape(ComSafeArrayInArg(pShape));
     if (!mMouse.isNull())
        mMouse->updateMousePointerShape(fVisible, fAlpha, xHot, yHot, width, height,
-                                       aShape.raw(), aShape.size());
-
-    fireMousePointerShapeChangedEvent(mEventSource, fVisible, fAlpha, xHot, yHot, width, height, ComSafeArrayInArg(pShape));
+                                       pu8Shape, cbShape);
+
+    com::SafeArray<BYTE> shape(cbShape);
+    if (pu8Shape)
+        memcpy(shape.raw(), pu8Shape, cbShape);
+    fireMousePointerShapeChangedEvent(mEventSource, fVisible, fAlpha, xHot, yHot, width, height, ComSafeArrayAsInParam(shape));
 
 #if 0
Index: /trunk/src/VBox/Main/src-client/DisplayImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-client/DisplayImpl.cpp	(revision 52933)
+++ /trunk/src/VBox/Main/src-client/DisplayImpl.cpp	(revision 52934)
@@ -3798,19 +3798,14 @@
     Display *pThis = pDrv->pDisplay;
 
-    size_t cbShapeSize = 0;
-
+    uint32_t cbShape = 0;
     if (pvShape)
     {
-        cbShapeSize = (cx + 7) / 8 * cy; /* size of the AND mask */
-        cbShapeSize = ((cbShapeSize + 3) & ~3) + cx * 4 * cy; /* + gap + size of the XOR mask */
-    }
-    com::SafeArray<BYTE> shapeData(cbShapeSize);
-
-    if (pvShape)
-        ::memcpy(shapeData.raw(), pvShape, cbShapeSize);
+        cbShape = (cx + 7) / 8 * cy; /* size of the AND mask */
+        cbShape = ((cbShape + 3) & ~3) + cx * 4 * cy; /* + gap + size of the XOR mask */
+    }
 
     /* Tell the console about it */
     pDrv->pDisplay->mParent->i_onMousePointerShapeChange(fVisible, fAlpha,
-                                                         xHot, yHot, cx, cy, ComSafeArrayAsInParam(shapeData));
+                                                         xHot, yHot, cx, cy, (uint8_t *)pvShape, cbShape);
 
     return VINF_SUCCESS;
Index: /trunk/src/VBox/Main/src-client/GuestFileImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-client/GuestFileImpl.cpp	(revision 52933)
+++ /trunk/src/VBox/Main/src-client/GuestFileImpl.cpp	(revision 52934)
@@ -1273,6 +1273,5 @@
         return setError(E_INVALIDARG, tr("The size to read is zero"));
 
-    com::SafeArray<BYTE> data((size_t)aToRead);
-    Assert(data.size() >= aToRead);
+    aData.resize(aToRead);
 
     HRESULT hr = S_OK;
@@ -1280,16 +1279,15 @@
     uint32_t cbRead;
     int vrc = i_readData(aToRead, aTimeoutMS,
-                         data.raw(), aToRead, &cbRead);
-
-    if (RT_SUCCESS(vrc))
-    {
-        if (data.size() != cbRead)
-            data.resize(cbRead);
-        aData.resize(data.size());
-        for(size_t i = 0; i < data.size(); ++i)
-            aData[i] = data[i];
+                         &aData.front(), aToRead, &cbRead);
+
+    if (RT_SUCCESS(vrc))
+    {
+        if (aData.size() != cbRead)
+            aData.resize(cbRead);
     }
     else
     {
+        aData.resize(0);
+
         switch (vrc)
         {
@@ -1315,6 +1313,5 @@
         return setError(E_INVALIDARG, tr("The size to read is zero"));
 
-    com::SafeArray<BYTE> data((size_t)aToRead);
-    Assert(data.size() >= aToRead);
+    aData.resize(aToRead);
 
     HRESULT hr = S_OK;
@@ -1322,15 +1319,14 @@
     size_t cbRead;
     int vrc = i_readDataAt(aOffset, aToRead, aTimeoutMS,
-                           data.raw(), aToRead, &cbRead);
-    if (RT_SUCCESS(vrc))
-    {
-        if (data.size() != cbRead)
-            data.resize(cbRead);
-        aData.resize(data.size());
-        for(size_t i = 0; i < data.size(); ++i)
-            aData[i] = data[i];
+                           &aData.front(), aToRead, &cbRead);
+    if (RT_SUCCESS(vrc))
+    {
+        if (aData.size() != cbRead)
+            aData.resize(cbRead);
     }
     else
     {
+        aData.resize(0);
+
         switch (vrc)
         {
@@ -1410,6 +1406,7 @@
     HRESULT hr = S_OK;
 
-    com::SafeArray<BYTE> data(aData);
-    int vrc = i_writeData(aTimeoutMS, data.raw(), (uint32_t)data.size(),
+    uint32_t cbData = (uint32_t)aData.size();
+    void *pvData = cbData > 0? (void *)&aData.front(): NULL;
+    int vrc = i_writeData(aTimeoutMS, pvData, cbData,
                           (uint32_t*)aWritten);
     if (RT_FAILURE(vrc))
@@ -1420,5 +1417,5 @@
                 hr = setError(VBOX_E_IPRT_ERROR,
                               tr("Writing %zubytes to file \"%s\" failed: %Rrc"),
-                              data.size(), mData.mOpenInfo.mFileName.c_str(), vrc);
+                              aData.size(), mData.mOpenInfo.mFileName.c_str(), vrc);
                 break;
         }
@@ -1440,6 +1437,7 @@
     HRESULT hr = S_OK;
 
-    com::SafeArray<BYTE> data(aData);
-    int vrc = i_writeData(aTimeoutMS, data.raw(), (uint32_t)data.size(),
+    uint32_t cbData = (uint32_t)aData.size();
+    void *pvData = cbData > 0? (void *)&aData.front(): NULL;
+    int vrc = i_writeData(aTimeoutMS, pvData, cbData,
                           (uint32_t*)aWritten);
     if (RT_FAILURE(vrc))
@@ -1450,5 +1448,5 @@
                 hr = setError(VBOX_E_IPRT_ERROR,
                               tr("Writing %zubytes to file \"%s\" (at offset %RU64) failed: %Rrc"),
-                              data.size(), mData.mOpenInfo.mFileName.c_str(), aOffset, vrc);
+                              aData.size(), mData.mOpenInfo.mFileName.c_str(), aOffset, vrc);
                 break;
         }
Index: /trunk/src/VBox/Main/src-client/GuestProcessImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-client/GuestProcessImpl.cpp	(revision 52933)
+++ /trunk/src/VBox/Main/src-client/GuestProcessImpl.cpp	(revision 52934)
@@ -292,12 +292,5 @@
 
     AutoReadLock alock(this COMMA_LOCKVAL_SRC_POS);
-
-    com::SafeArray<BSTR> collection(mData.mProcess.mArguments.size());
-    size_t s = 0;
-    for (ProcessArguments::const_iterator it = mData.mProcess.mArguments.begin();
-         it != mData.mProcess.mArguments.end();
-         it++, s++)
-         aArguments[s] = (*it);
-
+    aArguments = mData.mProcess.mArguments;
     return S_OK;
 #endif /* VBOX_WITH_GUEST_CONTROL */
@@ -312,9 +305,5 @@
 
     AutoReadLock alock(this COMMA_LOCKVAL_SRC_POS);
-
-    com::SafeArray<BSTR> arguments(mData.mProcess.mEnvironment.Size());
-    for (size_t i = 0; i < arguments.size(); i++)
-        aEnvironment[i] = mData.mProcess.mEnvironment.Get(i);
-
+    mData.mProcess.mEnvironment.CopyTo(aEnvironment);
     return S_OK;
 #endif /* VBOX_WITH_GUEST_CONTROL */
@@ -1751,20 +1740,19 @@
         return setError(E_INVALIDARG, tr("The size to read is zero"));
 
-    com::SafeArray<BYTE> data((size_t)aToRead);
-    Assert(data.size() >= aToRead);
+    aData.resize(aToRead);
 
     HRESULT hr = S_OK;
 
     uint32_t cbRead; int guestRc;
-    int vrc = i_readData(aHandle, aToRead, aTimeoutMS, data.raw(), aToRead, &cbRead, &guestRc);
+    int vrc = i_readData(aHandle, aToRead, aTimeoutMS, &aData.front(), aToRead, &cbRead, &guestRc);
     if (RT_SUCCESS(vrc))
     {
-        if (data.size() != cbRead)
-            data.resize(cbRead);
-        for(size_t i = 0; i < data.size(); ++i)
-            aData[i] = data[i];
+        if (aData.size() != cbRead)
+            aData.resize(cbRead);
     }
     else
     {
+        aData.resize(0);
+
         switch (vrc)
         {
@@ -1903,9 +1891,9 @@
 
     HRESULT hr = S_OK;
-    com::SafeArray<BYTE> data;
-    for(size_t i = 0; i < aData.size(); ++i)
-        data[i] = aData[i];
+
     uint32_t cbWritten; int guestRc;
-    int vrc = i_writeData(aHandle, aFlags, data.raw(), data.size(), aTimeoutMS, &cbWritten, &guestRc);
+    uint32_t cbData = (uint32_t)aData.size();
+    void *pvData = cbData > 0? (void *)&aData.front(): NULL;
+    int vrc = i_writeData(aHandle, aFlags, pvData, cbData, aTimeoutMS, &cbWritten, &guestRc);
     if (RT_FAILURE(vrc))
     {
Index: /trunk/src/VBox/Main/src-client/KeyboardImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-client/KeyboardImpl.cpp	(revision 52933)
+++ /trunk/src/VBox/Main/src-client/KeyboardImpl.cpp	(revision 52934)
@@ -175,9 +175,4 @@
                                ULONG *aCodesStored)
 {
-    com::SafeArray<LONG> keys;
-    keys.resize(aScancodes.size());
-    for (size_t i = 0; i < aScancodes.size(); ++i)
-        keys[i] = aScancodes[i];
-
     AutoWriteLock alock(this COMMA_LOCKVAL_SRC_POS);
 
@@ -213,4 +208,8 @@
     if (aCodesStored)
         *aCodesStored = sent;
+
+    com::SafeArray<LONG> keys(aScancodes.size());
+    for (size_t i = 0; i < aScancodes.size(); ++i)
+        keys[i] = aScancodes[i];
 
     VBoxEventDesc evDesc;
Index: /trunk/src/VBox/Main/src-client/MouseImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-client/MouseImpl.cpp	(revision 52933)
+++ /trunk/src/VBox/Main/src-client/MouseImpl.cpp	(revision 52934)
@@ -861,14 +861,12 @@
                                   ULONG aScanTime)
 {
-    com::SafeArray <LONG64> arrayContacts(aContacts);
-
     LogRel3(("%s: aCount %d(actual %d), aScanTime %u\n",
-             __FUNCTION__, aCount, arrayContacts.size(), aScanTime));
+             __FUNCTION__, aCount, aContacts.size(), aScanTime));
 
     HRESULT rc = S_OK;
 
-    if ((LONG)arrayContacts.size() >= aCount)
-    {
-        LONG64* paContacts = arrayContacts.raw();
+    if ((LONG)aContacts.size() >= aCount)
+    {
+        const LONG64 *paContacts = aCount > 0? &aContacts.front(): NULL;
 
         rc = i_putEventMultiTouch(aCount, paContacts, aScanTime);
@@ -907,5 +905,5 @@
 /* Used by PutEventMultiTouch and PutEventMultiTouchString. */
 HRESULT Mouse::i_putEventMultiTouch(LONG aCount,
-                                    LONG64 *paContacts,
+                                    const LONG64 *paContacts,
                                     ULONG aScanTime)
 {
Index: /trunk/src/VBox/Main/src-client/VMMDevInterface.cpp
===================================================================
--- /trunk/src/VBox/Main/src-client/VMMDevInterface.cpp	(revision 52933)
+++ /trunk/src/VBox/Main/src-client/VMMDevInterface.cpp	(revision 52934)
@@ -346,15 +346,11 @@
 
     /* tell the console about it */
-    size_t cbShapeSize = 0;
-
+    uint32_t cbShape = 0;
     if (pShape)
     {
-        cbShapeSize = (width + 7) / 8 * height; /* size of the AND mask */
-        cbShapeSize = ((cbShapeSize + 3) & ~3) + width * 4 * height; /* + gap + size of the XOR mask */
-    }
-    com::SafeArray<BYTE> shapeData(cbShapeSize);
-    if (pShape)
-        ::memcpy(shapeData.raw(), pShape, cbShapeSize);
-    pConsole->i_onMousePointerShapeChange(fVisible, fAlpha, xHot, yHot, width, height, ComSafeArrayAsInParam(shapeData));
+        cbShape = (width + 7) / 8 * height; /* size of the AND mask */
+        cbShape = ((cbShape + 3) & ~3) + width * 4 * height; /* + gap + size of the XOR mask */
+    }
+    pConsole->i_onMousePointerShapeChange(fVisible, fAlpha, xHot, yHot, width, height, (uint8_t *)pShape, cbShape);
 }
 
Index: /trunk/src/VBox/Main/src-server/HostDnsService.cpp
===================================================================
--- /trunk/src/VBox/Main/src-server/HostDnsService.cpp	(revision 52933)
+++ /trunk/src/VBox/Main/src-server/HostDnsService.cpp	(revision 52934)
@@ -5,5 +5,5 @@
 
 /*
- * Copyright (C) 2013 Oracle Corporation
+ * Copyright (C) 2013-2014 Oracle Corporation
  *
  * This file is part of VirtualBox Open Source Edition (OSE), as
@@ -67,16 +67,10 @@
 
 inline static void detachVectorOfWString(const std::vector<std::wstring>& v,
-                                        ComSafeArrayOut(BSTR, aBstrArray))
-{
-    com::SafeArray<BSTR> aBstr(v.size());
-
-    std::vector<std::wstring>::const_iterator it;
-
-    int i = 0;
-    it = v.begin();
-    for (; it != v.end(); ++it, ++i)
-        Utf8Str(it->c_str()).cloneTo(&aBstr[i]);
-
-    aBstr.detachTo(ComSafeArrayOutArg(aBstrArray));
+                                         std::vector<com::Utf8Str> &aArray)
+{
+    aArray.resize(v.size());
+    size_t i = 0;
+    for (std::vector<std::wstring>::const_iterator it = v.begin(); it != v.end(); ++it, ++i)
+        aArray[i] = Utf8Str(it->c_str());
 }
 
@@ -265,5 +259,5 @@
 }
 
-HRESULT HostDnsMonitorProxy::GetNameServers(ComSafeArrayOut(BSTR, aNameServers))
+HRESULT HostDnsMonitorProxy::GetNameServers(std::vector<com::Utf8Str> &aNameServers)
 {
     AssertReturn(m && m->info, E_FAIL);
@@ -276,10 +270,10 @@
     dumpHostDnsStrVector("Name Server", m->info->servers);
 
-    detachVectorOfWString(m->info->servers, ComSafeArrayOutArg(aNameServers));
+    detachVectorOfWString(m->info->servers, aNameServers);
 
     return S_OK;
 }
 
-HRESULT HostDnsMonitorProxy::GetDomainName(BSTR *aDomainName)
+HRESULT HostDnsMonitorProxy::GetDomainName(com::Utf8Str *pDomainName)
 {
     AssertReturn(m && m->info, E_FAIL);
@@ -291,10 +285,10 @@
     LogRel(("HostDnsMonitorProxy::GetDomainName: %s\n", m->info->domain.c_str()));
 
-    Utf8Str(m->info->domain.c_str()).cloneTo(aDomainName);
+    *pDomainName = m->info->domain.c_str();
 
     return S_OK;
 }
 
-HRESULT HostDnsMonitorProxy::GetSearchStrings(ComSafeArrayOut(BSTR, aSearchStrings))
+HRESULT HostDnsMonitorProxy::GetSearchStrings(std::vector<com::Utf8Str> &aSearchStrings)
 {
     AssertReturn(m && m->info, E_FAIL);
@@ -307,5 +301,5 @@
     dumpHostDnsStrVector("Search String", m->info->searchList);
 
-    detachVectorOfWString(m->info->searchList, ComSafeArrayOutArg(aSearchStrings));
+    detachVectorOfWString(m->info->searchList, aSearchStrings);
 
     return S_OK;
Index: /trunk/src/VBox/Main/src-server/HostDnsService.h
===================================================================
--- /trunk/src/VBox/Main/src-server/HostDnsService.h	(revision 52933)
+++ /trunk/src/VBox/Main/src-server/HostDnsService.h	(revision 52934)
@@ -112,7 +112,7 @@
     void notify() const;
 
-    HRESULT GetNameServers(ComSafeArrayOut(BSTR, aNameServers));
-    HRESULT GetDomainName(BSTR *aDomainName);
-    HRESULT GetSearchStrings(ComSafeArrayOut(BSTR, aSearchStrings));
+    HRESULT GetNameServers(std::vector<com::Utf8Str> &aNameServers);
+    HRESULT GetDomainName(com::Utf8Str *pDomainName);
+    HRESULT GetSearchStrings(std::vector<com::Utf8Str> &aSearchStrings);
 
     bool operator==(PCHostDnsMonitorProxy&);
Index: /trunk/src/VBox/Main/src-server/HostImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-server/HostImpl.cpp	(revision 52933)
+++ /trunk/src/VBox/Main/src-server/HostImpl.cpp	(revision 52934)
@@ -776,6 +776,8 @@
 #  endif /* RT_OS_LINUX */
 
-    SafeIfaceArray<IHostNetworkInterface> networkInterfaces(list);
-    networkInterfaces.detachTo(ComSafeArrayOutArg(aNetworkInterfaces));
+    aNetworkInterfaces.resize(list.size());
+    size_t i = 0;
+    for (std::list<ComObjPtr<HostNetworkInterface> >::const_iterator it = list.begin(); it != list.end(); ++it, ++i)
+        aNetworkInterfaces[i] = *it;
 
     return S_OK;
@@ -796,17 +798,5 @@
         return rc;
 
-    SafeIfaceArray<IHostUSBDevice> resultArr;
-    rc = m->pUSBProxyService->getDeviceCollection(ComSafeArrayAsOutParam(resultArr));
-    if (FAILED(rc))
-        return rc;
-
-    aUSBDevices.resize(resultArr.size());
-    for (size_t i = 0; i < resultArr.size(); ++i)
-    {
-         ComPtr<IHostUSBDevice> iHu = resultArr[i];
-         iHu.queryInterfaceTo(aUSBDevices[i].asOutParam());
-    }
-
-    return rc;
+    return m->pUSBProxyService->getDeviceCollection(aUSBDevices);
 #else
     /* Note: The GUI depends on this method returning E_NOTIMPL with no
@@ -827,15 +817,5 @@
 {
     AutoReadLock alock(this COMMA_LOCKVAL_SRC_POS);
-
-    com::SafeArray<BSTR> resultArr;
-    HRESULT rc = m->hostDnsMonitorProxy.GetNameServers(ComSafeArrayAsOutParam(resultArr));
-    if (FAILED(rc))
-        return rc;
-
-    aNameServers.resize(resultArr.size());
-    for (size_t i = 0; i < resultArr.size(); ++i)
-        aNameServers[i] = com::Utf8Str(resultArr[i]);
-
-    return S_OK;
+    return m->hostDnsMonitorProxy.GetNameServers(aNameServers);
 }
 
@@ -848,12 +828,5 @@
     /* XXX: note here should be synchronization with thread polling state
      * changes in name resoving system on host */
-    Bstr tmpName;
-    HRESULT rc = m->hostDnsMonitorProxy.GetDomainName(tmpName.asOutParam());
-    if (FAILED(rc))
-        return rc;
-
-    aDomainName = com::Utf8Str(tmpName);
-
-    return S_OK;
+    return m->hostDnsMonitorProxy.GetDomainName(&aDomainName);
 }
 
@@ -865,15 +838,5 @@
 {
     AutoReadLock alock(this COMMA_LOCKVAL_SRC_POS);
-
-    com::SafeArray<BSTR> resultArr;
-    HRESULT rc = m->hostDnsMonitorProxy.GetSearchStrings(ComSafeArrayAsOutParam(resultArr));
-    if (FAILED(rc))
-        return rc;
-
-    aSearchStrings.resize(resultArr.size());
-    for (size_t i = 0; i < resultArr.size(); ++i)
-        aSearchStrings[i] = com::Utf8Str(resultArr[i]);
-
-    return S_OK;
+    return m->hostDnsMonitorProxy.GetSearchStrings(aSearchStrings);
 }
 
Index: /trunk/src/VBox/Main/src-server/MachineImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-server/MachineImpl.cpp	(revision 52933)
+++ /trunk/src/VBox/Main/src-server/MachineImpl.cpp	(revision 52934)
@@ -1659,15 +1659,14 @@
 HRESULT Machine::setVideoCaptureScreens(const std::vector<BOOL> &aVideoCaptureScreens)
 {
-    SafeArray<BOOL> screens(aVideoCaptureScreens);
-    AssertReturn(screens.size() <= RT_ELEMENTS(mHWData->maVideoCaptureScreens), E_INVALIDARG);
+    AssertReturn(aVideoCaptureScreens.size() <= RT_ELEMENTS(mHWData->maVideoCaptureScreens), E_INVALIDARG);
     bool fChanged = false;
 
     AutoWriteLock alock(this COMMA_LOCKVAL_SRC_POS);
 
-    for (unsigned i = 0; i < screens.size(); ++i)
-    {
-        if (mHWData->maVideoCaptureScreens[i] != RT_BOOL(screens[i]))
-        {
-            mHWData->maVideoCaptureScreens[i] = RT_BOOL(screens[i]);
+    for (unsigned i = 0; i < aVideoCaptureScreens.size(); ++i)
+    {
+        if (mHWData->maVideoCaptureScreens[i] != RT_BOOL(aVideoCaptureScreens[i]))
+        {
+            mHWData->maVideoCaptureScreens[i] = RT_BOOL(aVideoCaptureScreens[i]);
             fChanged = true;
         }
@@ -4823,5 +4822,4 @@
     AutoReadLock alock(this COMMA_LOCKVAL_SRC_POS);
 
-    com::SafeArray<BSTR> saKeys(mData->pMachineConfigFile->mapExtraDataItems.size());
     aKeys.resize(mData->pMachineConfigFile->mapExtraDataItems.size());
     size_t i = 0;
@@ -6331,5 +6329,5 @@
     *aHeight = u32Height;
 
-    com::SafeArray<BYTE> bitmap(cbData);
+    aData.resize(cbData);
     /* Convert pixels to format expected by the API caller. */
     if (aBGR)
@@ -6338,8 +6336,8 @@
         for (unsigned i = 0; i < cbData; i += 4)
         {
-            bitmap[i]     = pu8Data[i];
-            bitmap[i + 1] = pu8Data[i + 1];
-            bitmap[i + 2] = pu8Data[i + 2];
-            bitmap[i + 3] = 0xff;
+            aData[i]     = pu8Data[i];
+            aData[i + 1] = pu8Data[i + 1];
+            aData[i + 2] = pu8Data[i + 2];
+            aData[i + 3] = 0xff;
         }
     }
@@ -6349,13 +6347,10 @@
         for (unsigned i = 0; i < cbData; i += 4)
         {
-            bitmap[i]     = pu8Data[i + 2];
-            bitmap[i + 1] = pu8Data[i + 1];
-            bitmap[i + 2] = pu8Data[i];
-            bitmap[i + 3] = 0xff;
-        }
-    }
-    aData.resize(bitmap.size());
-    for (size_t i = 0; i < bitmap.size(); ++i)
-        aData[i] = bitmap[i];
+            aData[i]     = pu8Data[i + 2];
+            aData[i + 1] = pu8Data[i + 1];
+            aData[i + 2] = pu8Data[i];
+            aData[i + 3] = 0xff;
+        }
+    }
 
     freeSavedDisplayScreenshot(pu8Data);
@@ -6396,11 +6391,9 @@
     if (RT_SUCCESS(vrc))
     {
-        com::SafeArray<BYTE> screenData(cbPNG);
-        screenData.initFrom(pu8PNG, cbPNG);
+        aData.resize(cbPNG);
+        if (cbPNG)
+            memcpy(&aData.front(), pu8PNG, cbPNG);
         if (pu8PNG)
             RTMemFree(pu8PNG);
-        aData.resize(screenData.size());
-        for (size_t i = 0; i < screenData.size(); ++i)
-            aData[i] = screenData[i];
     }
     else
@@ -6468,9 +6461,7 @@
     *aHeight = u32Height;
 
-    com::SafeArray<BYTE> png(cbData);
-    png.initFrom(pu8Data, cbData);
-    aData.resize(png.size());
-    for (size_t i = 0; i < png.size(); ++i)
-        aData[i] = png[i];
+    aData.resize(cbData);
+    if (cbData)
+        memcpy(&aData.front(), pu8Data, cbData);
 
     freeSavedDisplayScreenshot(pu8Data);
@@ -6597,5 +6588,5 @@
      * One byte expands to approx. 25 bytes of breathtaking XML. */
     size_t cbData = (size_t)RT_MIN(aSize, 32768);
-    com::SafeArray<BYTE> logData(cbData);
+    aData.resize(cbData);
 
     RTFILE LogFile;
@@ -6604,7 +6595,7 @@
     if (RT_SUCCESS(vrc))
     {
-        vrc = RTFileReadAt(LogFile, aOffset, logData.raw(), cbData, &cbData);
+        vrc = RTFileReadAt(LogFile, aOffset, cbData? &aData.front(): NULL, cbData, &cbData);
         if (RT_SUCCESS(vrc))
-            logData.resize(cbData);
+            aData.resize(cbData);
         else
             rc = setError(VBOX_E_IPRT_ERROR,
@@ -6619,9 +6610,5 @@
 
     if (FAILED(rc))
-        logData.resize(0);
-
-    aData.resize(logData.size());
-    for (size_t i = 0; i < logData.size(); ++i)
-        aData[i] = logData[i];
+        aData.resize(0);
 
     return rc;
@@ -6982,10 +6969,8 @@
 {
     AutoReadLock alock(this COMMA_LOCKVAL_SRC_POS);
-    com::SafeArray<BYTE> icon(mUserData->mIcon.size());
-    aIcon.resize(mUserData->mIcon.size());
-    memcpy(icon.raw(), &mUserData->mIcon[0], mUserData->mIcon.size());
-    aIcon.resize(icon.size());
-    for (size_t i = 0; i < icon.size(); ++i)
-        aIcon[i] = icon[i];
+    size_t cbIcon = mUserData->mIcon.size();
+    aIcon.resize(cbIcon);
+    if (cbIcon)
+        memcpy(&aIcon.front(), &mUserData->mIcon[0], cbIcon);
     return S_OK;
 }
@@ -6999,7 +6984,8 @@
         i_setModified(IsModified_MachineData);
         mUserData.backup();
-        com::SafeArray<BYTE> icon(aIcon);
-        mUserData->mIcon.resize(aIcon.size());
-        memcpy(&mUserData->mIcon[0], icon.raw(), mUserData->mIcon.size());
+        size_t cbIcon = aIcon.size();
+        mUserData->mIcon.resize(cbIcon);
+        if (cbIcon)
+            memcpy(&mUserData->mIcon[0], &aIcon.front(), cbIcon);
     }
     return hrc;
@@ -7008,5 +6994,4 @@
 HRESULT Machine::getUSBProxyAvailable(BOOL *aUSBProxyAvailable)
 {
-
 #ifdef VBOX_WITH_USB
     *aUSBProxyAvailable = true;
@@ -8424,13 +8409,16 @@
                         cbOut,
                         DECODE_STR_MAX);
-    com::SafeArray<BYTE> iconByte(cbOut);
-    int vrc = RTBase64Decode(pszStr, iconByte.raw(), cbOut, NULL, NULL);
+    mUserData->mIcon.resize(cbOut);
+    int vrc = VINF_SUCCESS;
+    if (cbOut)
+        vrc = RTBase64Decode(pszStr, &mUserData->mIcon.front(), cbOut, NULL, NULL);
     if (RT_FAILURE(vrc))
+    {
+        mUserData->mIcon.resize(0);
         return setError(E_FAIL,
                         tr("Failure to Decode Icon Data. '%s' (%Rrc)"),
                         pszStr,
                         vrc);
-    mUserData->mIcon.resize(iconByte.size());
-    memcpy(&mUserData->mIcon[0], iconByte.raw(), mUserData->mIcon.size());
+    }
 
     // look up the object by Id to check it is valid
@@ -9821,6 +9809,6 @@
 
     // Encode the Icon Override data from Machine and store on config userdata.
-    com::SafeArray<BYTE> iconByte;
-    COMGETTER(Icon)(ComSafeArrayAsOutParam(iconByte));
+    std::vector<BYTE> iconByte;
+    getIcon(iconByte);
     ssize_t cbData = iconByte.size();
     if (cbData > 0)
@@ -9829,5 +9817,5 @@
         Utf8Str strIconData;
         strIconData.reserve(cchOut+1);
-        int vrc = RTBase64Encode(iconByte.raw(), cbData,
+        int vrc = RTBase64Encode(&iconByte.front(), cbData,
                                  strIconData.mutableRaw(), strIconData.capacity(),
                                  NULL);
Index: /trunk/src/VBox/Main/src-server/USBProxyService.cpp
===================================================================
--- /trunk/src/VBox/Main/src-server/USBProxyService.cpp	(revision 52933)
+++ /trunk/src/VBox/Main/src-server/USBProxyService.cpp	(revision 52934)
@@ -133,13 +133,14 @@
  * @remarks The caller must own the write lock of the host object.
  */
-HRESULT USBProxyService::getDeviceCollection(ComSafeArrayOut(IHostUSBDevice *, aUSBDevices))
+HRESULT USBProxyService::getDeviceCollection(std::vector<ComPtr<IHostUSBDevice> > &aUSBDevices)
 {
     AssertReturn(isWriteLockOnCurrentThread(), E_FAIL);
-    CheckComArgOutSafeArrayPointerValid(aUSBDevices);
 
     AutoWriteLock alock(this COMMA_LOCKVAL_SRC_POS);
 
-    SafeIfaceArray<IHostUSBDevice> Collection(mDevices);
-    Collection.detachTo(ComSafeArrayOutArg(aUSBDevices));
+    aUSBDevices.resize(mDevices.size());
+    size_t i = 0;
+    for (HostUSBDeviceList::const_iterator it = mDevices.begin(); it != mDevices.end(); ++it, ++i)
+        aUSBDevices[i] = *it;
 
     return S_OK;
Index: /trunk/src/VBox/Main/src-server/VirtualBoxImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-server/VirtualBoxImpl.cpp	(revision 52933)
+++ /trunk/src/VBox/Main/src-server/VirtualBoxImpl.cpp	(revision 52934)
@@ -3209,5 +3209,5 @@
  * Takes a list of machine groups, and sanitizes/validates it.
  *
- * @param aMachineGroups    Safearray with the machine groups.
+ * @param aMachineGroups    Array with the machine groups.
  * @param pllMachineGroups  Pointer to list of strings for the result.
  *
