amdgpu UvdMsg Overflow

Vulnerability analysis

When the AMD GPU UVD driver processes an H.265 video decode command, it derives a buffer count from a user-supplied message field without checking that the value is within the H.265 specification limit. An excessively large count causes an integer overflow when multiplied by the frame image size, producing a deceptively small minimum buffer size that passes the driver's validation. The subsequent decode operation can then write beyond the allocated GPU buffer, corrupting memory. The fix adds a bounds check that rejects any reference count exceeding the specification maximum before the size calculation is performed. This path is reachable locally by any user with access to the AMD GPU DRM device node, which on many systems is available to non-root users through render device permissions.