drm/amdgpu DecMsg OOB

Vulnerability analysis

The vulnerability exists in the VCN4 decoder message parsing function which failed to validate buffer boundaries when accessing message fields and buffer descriptors. Attackers could craft malformed decoder messages with invalid lengths or buffer counts to read beyond allocated memory. Because the attacker-controlled num_buffers value is unbounded, the out-of-bounds read can span a large region, leaking adjacent slab data before eventually hitting unmapped pages and causing a kernel panic. The fix adds comprehensive bounds checking at multiple points: minimum message size validation, header boundary checks, buffer count validation against message length, and individual buffer boundary verification.