Index: /trunk/src/VBox/Devices/Network/slirp/libalias/alias_nbt.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/libalias/alias_nbt.c	(revision 83596)
+++ /trunk/src/VBox/Devices/Network/slirp/libalias/alias_nbt.c	(revision 83597)
@@ -437,4 +437,8 @@
     pmax = (char *)uh + ntohs(uh->uh_ulen);
 
+    /* IP header has been verified, cross-check uh_ulen */
+    if (RT_UNLIKELY(pmax != (char *)pip + ntohs(pip->ip_len)))
+        return (-1);
+
     ndh = (NbtDataHeader *)udp_next(uh);
     if ((char *)(ndh + 1) > pmax)
@@ -886,4 +890,8 @@
     pmax = (char *)uh + ntohs(uh->uh_ulen);
 
+    /* IP header has been verified, cross-check uh_ulen */
+    if (RT_UNLIKELY(pmax != (char *)pip + ntohs(pip->ip_len)))
+        return (-1);
+
     if ((char *)(nsh + 1) > pmax)
         return (-1);