[PR] avformat/sierravmd: require a 6bit palette in the probe (PR #24245)

PR #24245 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24245
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24245.patch

vmdvideo_decode_init() loads a 768 byte VGA palette from header offset
28 and scales each entry by 4, so every one of these bytes is 6bit in a
file that carries a video stream. Rejecting a larger value keeps raw
video from being mistaken for VMD: a yuv420p10le file starting with
0x2e 0x03 matches the header size field and then scores the same 50 as
the rawvideo demuxer picked by the .yuv extension, which leaves the
format undetermined and fails the whole conversion.

The 26 files with a video stream on samples.ffmpeg.org/game-formats/
sierra-vmd/ all pass; the 9 audio only ones there hold unrelated data
at offset 28 and are exempted by the width and height test.

Fixes: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/22284



>From ee07580e6ca18ef7a0f4e5c1a96bc35e8280aff8 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Sat, 22 Aug 2026 20:23:41 +0200
Subject: [PATCH] avformat/sierravmd: require a 6bit palette in the probe

vmdvideo_decode_init() loads a 768 byte VGA palette from header offset
28 and scales each entry by 4, so every one of these bytes is 6bit in a
file that carries a video stream. Rejecting a larger value keeps raw
video from being mistaken for VMD: a yuv420p10le file starting with
0x2e 0x03 matches the header size field and then scores the same 50 as
the rawvideo demuxer picked by the .yuv extension, which leaves the
format undetermined and fails the whole conversion.

The 26 files with a video stream on samples.ffmpeg.org/game-formats/
sierra-vmd/ all pass; the 9 audio only ones there hold unrelated data
at offset 28 and are exempted by the width and height test.

Fixes: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/22284
---
 libavformat/sierravmd.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libavformat/sierravmd.c b/libavformat/sierravmd.c
index 2519756533..a86b0a1603 100644
--- a/libavformat/sierravmd.c
+++ b/libavformat/sierravmd.c
@@ -79,6 +79,12 @@ static int vmd_probe(const AVProbeData *p)
     if ((!w || w > 2048 || !h || h > 2048) &&
         sample_rate != 22050)
         return 0;
+    /* the header of a file with a video stream carries the 6bit VGA
+     * palette that vmdvideo_decode_init() loads from offset 28 */
+    if (w && h)
+        for (int i = 28; i < 28 + 3 * 256; i++)
+            if (p->buf[i] > 0x3F)
+                return 0;
 
     /* only return half certainty since this check is a bit sketchy */
     return AVPROBE_SCORE_EXTENSION;
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]