Index: /trunk/src/VBox/Devices/Graphics/DevVGA_VDMA.cpp
===================================================================
--- /trunk/src/VBox/Devices/Graphics/DevVGA_VDMA.cpp	(revision 71587)
+++ /trunk/src/VBox/Devices/Graphics/DevVGA_VDMA.cpp	(revision 71588)
@@ -2559,5 +2559,5 @@
         {
             if (   cbDstLine <= cbVRamSize
-                && (uintptr_t)pbSrcStart - (uintptr_t)pbRam <= cbVRamSize - cbDstLine
+                && (uintptr_t)pbDstStart - (uintptr_t)pbRam <= cbVRamSize - cbDstLine
                 && (uintptr_t)pbSrcStart - (uintptr_t)pbRam <= cbVRamSize - cbDstLine)
                 memcpy(pbDstStart, pbSrcStart, cbDstLine);
@@ -2715,4 +2715,23 @@
     uint32_t    cbTransfered = 0;
     int         rc           = VINF_SUCCESS;
+
+    if (pTransfer->fFlags & VBOXVDMACMD_DMA_BPB_TRANSFER_F_SRC_VRAMOFFSET)
+    {
+        if (RT_LIKELY(   pTransfer->cbTransferSize <= pVGAState->vram_size
+                      && pTransfer->Src.offVramBuf <= pVGAState->vram_size - pTransfer->cbTransferSize))
+        { /* likely */ }
+        else
+            return VERR_INVALID_PARAMETER;
+    }
+
+    if (pTransfer->fFlags & VBOXVDMACMD_DMA_BPB_TRANSFER_F_DST_VRAMOFFSET)
+    {
+        if (RT_LIKELY(   pTransfer->cbTransferSize <= pVGAState->vram_size
+                      && pTransfer->Dst.offVramBuf <= pVGAState->vram_size - pTransfer->cbTransferSize))
+        { /* likely */ }
+        else
+            return VERR_INVALID_PARAMETER;
+    }
+
     do
     {