1 files changed, 27 insertions, 2 deletions
diff --git a/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbFlt.cpp b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbFlt.cpp
index afa382a0..645f5982 100644
--- a/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbFlt.cpp
+++ b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbFlt.cpp
@@ -325,7 +325,15 @@ PVBOXUSBFLT_DEVICE vboxUsbFltDevGet(PDEVICE_OBJECT pPdo)
 
     VBOXUSBFLT_LOCK_ACQUIRE();
     pDevice = vboxUsbFltDevGetLocked(pPdo);
-    if (pDevice->enmState > VBOXUSBFLT_DEVSTATE_ADDED)
+    /*
+     * Prevent a host crash when vboxUsbFltDevGetLocked fails to locate the matching PDO
+     * in g_VBoxUsbFltGlobals.DeviceList (see @bugref{6509}).
+     */
+    if (pDevice == NULL)
+    {
+        WARN(("failed to get device for PDO(0x%p)", pPdo));
+    }
+    else if (pDevice->enmState > VBOXUSBFLT_DEVSTATE_ADDED)
     {
         vboxUsbFltDevRetain(pDevice);
         LOG(("found device (0x%p), state(%d) for PDO(0x%p)", pDevice, pDevice->enmState, pPdo));
@@ -1363,7 +1371,15 @@ HVBOXUSBFLTDEV VBoxUsbFltProxyStarted(PDEVICE_OBJECT pPdo)
     PVBOXUSBFLT_DEVICE pDevice;
     VBOXUSBFLT_LOCK_ACQUIRE();
     pDevice = vboxUsbFltDevGetLocked(pPdo);
-    if (pDevice->enmState = VBOXUSBFLT_DEVSTATE_CAPTURING)
+    /*
+     * Prevent a host crash when vboxUsbFltDevGetLocked fails to locate the matching PDO
+     * in g_VBoxUsbFltGlobals.DeviceList (see @bugref{6509}).
+     */
+    if (pDevice == NULL)
+    {
+        WARN(("failed to get device for PDO(0x%p)", pPdo));
+    }
+    else if (pDevice->enmState = VBOXUSBFLT_DEVSTATE_CAPTURING)
     {
         pDevice->enmState = VBOXUSBFLT_DEVSTATE_CAPTURED;
         LOG(("The proxy notified proxy start for the captured device 0x%x", pDevice));
@@ -1382,6 +1398,15 @@ HVBOXUSBFLTDEV VBoxUsbFltProxyStarted(PDEVICE_OBJECT pPdo)
 void VBoxUsbFltProxyStopped(HVBOXUSBFLTDEV hDev)
 {
     PVBOXUSBFLT_DEVICE pDevice = (PVBOXUSBFLT_DEVICE)hDev;
+    /*
+     * Prevent a host crash when VBoxUsbFltProxyStarted fails, returning NULL.
+     * See @bugref{6509}.
+     */
+    if (pDevice == NULL)
+    {
+        WARN(("VBoxUsbFltProxyStopped called with NULL device pointer"));
+        return;
+    }
     VBOXUSBFLT_LOCK_ACQUIRE();
     if (pDevice->enmState == VBOXUSBFLT_DEVSTATE_CAPTURED
             || pDevice->enmState == VBOXUSBFLT_DEVSTATE_USED_BY_GUEST)