diff --git a/sys/dev/drm/radeon/radeon_vce.c b/sys/dev/drm/radeon/radeon_vce.c
--- a/sys/dev/drm/radeon/radeon_vce.c
+++ b/sys/dev/drm/radeon/radeon_vce.c
@@ -599,9 +599,22 @@
 				goto out;
 			}
 
-			*size = radeon_get_ib_value(p, p->idx + 8) *
+		{
+			uint64_t _sz = (uint64_t)radeon_get_ib_value(p, p->idx + 8) *
 				radeon_get_ib_value(p, p->idx + 10) *
 				8 * 3 / 2;
+			if (_sz > UINT_MAX) {
+				DRM_ERROR("VCE create: dimensions overflow\n");
+				r = -EINVAL;
+				goto out;
+			}
+			*size = (uint32_t)_sz;
+			if (*size == 0) {
+				DRM_ERROR("VCE create: zero size\n");
+				r = -EINVAL;
+				goto out;
+			}
+		}
 			break;
 
 		case 0x04000001: // config extension