amdgpu UvdMsg Overflow

Vulnerability analysis

The video decoder message handler accepts decode messages with width and height values without an upper bound check. Extremely large dimensions cause integer overflow in downstream buffer size calculations, resulting in undersized allocations and subsequent out-of-bounds writes during video decode operations. The fix rejects any message with width or height exceeding 4096 pixels, preventing the overflow. This is reachable from a local process with access to the AMD GPU render node, requiring no special privileges beyond ordinary GPU access.