Index: /trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_pixel.c
===================================================================
--- /trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_pixel.c	(revision 70600)
+++ /trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_pixel.c	(revision 70601)
@@ -312,9 +312,15 @@
 void STATE_APIENTRY crStatePixelMapuiv (GLenum map, GLint mapsize, const GLuint * values)
 {
-    GLfloat fvalues[CR_MAX_PIXEL_MAP_TABLE];
-    GLint i;
+    if (mapsize < 0 || mapsize > CR_MAX_PIXEL_MAP_TABLE)
+    {
+        crError("crStatePixelMapuiv: parameter 'mapsize' is out of range");
+        return;
+    }
 
     if (!crStateIsBufferBound(GL_PIXEL_UNPACK_BUFFER_ARB))
     {
+        GLfloat fvalues[CR_MAX_PIXEL_MAP_TABLE];
+        GLint i;
+
         if (map==GL_PIXEL_MAP_I_TO_I || map==GL_PIXEL_MAP_S_TO_S) {
            for (i=0;i<mapsize;i++) {
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_glsl.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_glsl.c	(revision 70600)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_glsl.c	(revision 70601)
@@ -179,6 +179,15 @@
 void SERVER_DISPATCH_APIENTRY crServerDispatchDeleteProgramsARB(GLsizei n, const GLuint * programs)
 {
-    GLuint *pLocalProgs = (GLuint *) crAlloc(n * sizeof(GLuint));
+    GLuint *pLocalProgs;
     GLint i;
+
+    if (n >= UINT32_MAX / sizeof(GLuint))
+    {
+        crError("crServerDispatchDeleteProgramsARB: parameter 'n' is out of range");
+        return;
+    }
+
+    pLocalProgs = (GLuint *)crAlloc(n * sizeof(GLuint));
+
     if (!pLocalProgs) {
         crError("crServerDispatchDeleteProgramsARB: out of memory");
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_lists.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_lists.c	(revision 70600)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_lists.c	(revision 70601)
@@ -230,4 +230,10 @@
 crServerDispatchCallLists( GLsizei n, GLenum type, const GLvoid *lists )
 {
+    if (n >= UINT32_MAX / sizeof(GLuint))
+    {
+        crError("crServerDispatchCallLists: parameter 'n' is out of range");
+        return;
+    }
+
 #ifndef VBOX_WITH_CR_DISPLAY_LISTS
     if (!cr_server.sharedDisplayLists) {
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_texture.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_texture.c	(revision 70600)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_texture.c	(revision 70601)
@@ -200,6 +200,14 @@
 void SERVER_DISPATCH_APIENTRY crServerDispatchDeleteTextures( GLsizei n, const GLuint *textures)
 {
-    GLuint *newTextures = (GLuint *) crAlloc(n * sizeof(GLuint));
+    GLuint *newTextures;
     GLint i;
+
+    if (n >= UINT32_MAX / sizeof(GLuint))
+    {
+        crError("crServerDispatchDeleteTextures: parameter 'n' is out of range");
+        return;
+    }
+
+    newTextures = (GLuint *)crAlloc(n * sizeof(GLuint));
 
     if (!newTextures)
Index: /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_stipple.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_stipple.c	(revision 70600)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_stipple.c	(revision 70601)
@@ -10,16 +10,18 @@
 {
     int nodata = READ_DATA(0, int);
-    GLubyte *mask;
 
     if (nodata)
-        mask = (void*) (uintptr_t) READ_DATA(4, GLint);
+    {
+        crError("crUnpackPolygonStipple: GL_PIXEL_UNPACK_BUFFER is not supported");
+        INCR_DATA_PTR(8);
+    }
     else
-        mask = DATA_POINTER( 4, GLubyte );
+    {
+        GLubyte *mask;
 
-    cr_unpackDispatch.PolygonStipple(mask);
-
-    if (nodata)
-        INCR_DATA_PTR(8);
-    else
-        INCR_DATA_PTR(4 + 32*32/8);
+        mask = DATA_POINTER(4, GLubyte);
+        cr_unpackDispatch.PolygonStipple(mask);
+        // Stipple mask consists of 32 * 32 bits
+        INCR_DATA_PTR(4 + 32 * 32 / 8);
+    }
 }
Index: /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_texture.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_texture.c	(revision 70600)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_texture.c	(revision 70601)
@@ -290,7 +290,11 @@
     unsigned int n_param = READ_DATA( 0, int ) - ( sizeof(int) + 8 );
 
-    if ( n_param > sizeof(params) )
-        crError( "crUnpackTexGendv: n_param=%d, expected <= %d\n", n_param,
-                 (unsigned int)sizeof(params) );
+    if (n_param > sizeof(params))
+    {
+        crError("crUnpackTexGendv: n_param=%d, expected <= %d\n", n_param,
+            (unsigned int)sizeof(params));
+        return;
+    }
+
     crMemcpy( params, DATA_POINTER( sizeof( int ) + 8, GLdouble ), n_param );