amdgpu UvdDecode OOB

Vulnerability analysis

The UVD decode command parser computes the minimum image buffer size using the image width instead of the pitch, and does not reject pitch values exceeding 4096. A local attacker with access to the AMD GPU device can submit a video decode command stream with a large pitch, causing the computed buffer size to overflow and the kernel to write beyond the allocated decode buffer. The fix changes the size calculation to use pitch times height and rejects pitch values over 4096, preventing the overflow. The vulnerable path is reachable from a local process with access to the amdgpu DRM device.