diff -Naur a/src/VBox/Devices/Graphics/DevVGA-SVGA3d.cpp b/src/VBox/Devices/Graphics/DevVGA-SVGA3d.cpp --- a/src/VBox/Devices/Graphics/DevVGA-SVGA3d.cpp 2022-11-17 22:12:55.000000000 +0300 +++ b/src/VBox/Devices/Graphics/DevVGA-SVGA3d.cpp 2022-12-05 16:06:25.417632425 +0300 @@ -1093,6 +1093,8 @@ VMSVGASCREENOBJECT *pScreen = &pSvgaR3State->aScreens[idDstScreen]; + uint32_t const cbScreenPixel = RT_ALIGN(pScreen->cBpp, 8) / 8; + if ( srcRect.right <= srcRect.left || srcRect.bottom <= srcRect.top) return VINF_SUCCESS; /* Empty src rect. */ @@ -1186,6 +1188,8 @@ + ((box.x + pSurface->cxBlock - 1) / pSurface->cxBlock) * pSurface->cxBlock * pSurface->cbBlock + ((box.y + pSurface->cyBlock - 1) / pSurface->cyBlock) * pSurface->cyBlock * srcMap.cbRowPitch; + uint32_t const offDstBox = (dstBox.x + box.x) * cbScreenPixel + (dstBox.y + box.y) * pScreen->cbPitch; + /* The 'box' is actually in the destination coordinates relative to the top-left corner of destRect. * Therefore it is relative to the top-left corner of srcRect as well. */ @@ -1198,11 +1202,11 @@ { AssertContinue(srcDims.cyBlocks > 0); - ASSERT_GUEST_BREAK( srcDims.offBox <= cbDst - && pScreen->cbPitch * (srcDims.cyBlocks - 1) + srcDims.cbRow <= cbDst - srcDims.offBox); + ASSERT_GUEST_BREAK( offDstBox <= cbDst + && pScreen->cbPitch * (srcDims.cyBlocks - 1) + srcDims.cbRow <= cbDst - offDstBox); RT_UNTRUSTED_VALIDATED_FENCE(); - uint8_t *pu8DstBox = pu8Dst + srcDims.offBox; + uint8_t *pu8DstBox = pu8Dst + offDstBox; if ( pSurface->format == SVGA3D_R8G8B8A8_UNORM || pSurface->format == SVGA3D_R8G8B8A8_UNORM_SRGB)