Index: /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_calllists.cpp
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_calllists.cpp	(revision 78211)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_calllists.cpp	(revision 78212)
@@ -9,5 +9,5 @@
 void crUnpackCallLists(PCrUnpackerState pState)
 {
-    CHECK_BUFFER_SIZE_STATIC_LAST(pState, 4, GLenum);
+    CHECK_BUFFER_SIZE_STATIC_LAST(pState, sizeof( int ) + 4, GLenum);
 
     GLint n = READ_DATA(pState, sizeof( int ) + 0, GLint );
Index: /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_pixelmap.cpp
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_pixelmap.cpp	(revision 78211)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/unpacker/unpack_pixelmap.cpp	(revision 78212)
@@ -23,8 +23,11 @@
     {
         /* This is valid, see glPixelMap description for GL_PIXEL_UNPACK_BUFFER values is treated as a byte offset. */
+        CHECK_BUFFER_SIZE_STATIC_UPDATE_LAST(pState, sizeof( int ) + 12, GLfloat);
         values = (GLfloat*) (uintptr_t) READ_DATA(pState,sizeof(int) + 12, GLint);
     }
     else
     {
+        CHECK_BUFFER_SIZE_STATIC_UPDATE_LAST(pState, sizeof( int ) + 16, GLfloat);
+
         values = DATA_POINTER(pState, sizeof( int ) + 16, GLfloat );
         CHECK_ARRAY_SIZE_FROM_PTR_UPDATE_LAST(pState, values, mapsize, GLfloat);
@@ -50,8 +53,11 @@
     {
         /* This is valid, see glPixelMap description for GL_PIXEL_UNPACK_BUFFER values is treated as a byte offset. */
+        CHECK_BUFFER_SIZE_STATIC_UPDATE_LAST(pState, sizeof( int ) + 12, GLfloat);
         values = (GLuint*) (uintptr_t) READ_DATA(pState,sizeof(int) + 12, GLint);
     }
     else
     {
+        CHECK_BUFFER_SIZE_STATIC_UPDATE_LAST(pState, sizeof( int ) + 16, GLfloat);
+
         values = DATA_POINTER(pState, sizeof( int ) + 16, GLuint );
         CHECK_ARRAY_SIZE_FROM_PTR_UPDATE_LAST(pState, values, mapsize, GLuint);
@@ -77,8 +83,11 @@
     {
         /* This is valid, see glPixelMap description for GL_PIXEL_UNPACK_BUFFER values is treated as a byte offset. */
+        CHECK_BUFFER_SIZE_STATIC_UPDATE_LAST(pState, sizeof( int ) + 12, GLfloat);
         values = (GLushort*) (uintptr_t) READ_DATA(pState, sizeof(int) + 12, GLint);
     }
     else
     {
+        CHECK_BUFFER_SIZE_STATIC_UPDATE_LAST(pState, sizeof( int ) + 16, GLfloat);
+
         values = DATA_POINTER(pState, sizeof( int ) + 16, GLushort );
         CHECK_ARRAY_SIZE_FROM_PTR_UPDATE_LAST(pState, values, mapsize, GLushort);