| タイトル | Tencent ncnn master 3b7bdba Integer Overflow |
|---|
| 説明 | Integer overflow leading to out-of-bounds read and write in Tencent ncnn (src/mat_pixel.cpp and src/mat_pixel_drawing.cpp).
The public pixel-format conversion API yuv420sp2rgb computes the UV-plane pointer as vuptr = yuv420sp + w*h (mat_pixel.cpp:1953) with signed 32-bit int arithmetic and no w/h or buffer-size validation. For w=40000, h=60000 (product 2.4e9 > INT_MAX) the multiplication wraps to -1,894,967,296, placing the pointer about 1.9 GB before the input buffer; the conversion loop then reads out of bounds (mat_pixel.cpp:2101). The faulting offset is exactly w*h - 2^32, confirming the defect is in the w*h computation. The drawing family (draw_rectangle/circle/line_yuv420sp) uses the same offset for writes. A caller needs only a small buffer plus large w/h; no ~2.4 GB allocation is required.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H (Base 7.1, High)
Confirmed via ASAN on x86_64 Linux (gcc 15.2):
==38210==ERROR: AddressSanitizer: SEGV on unknown address 0x70c8de1c1840
The signal is caused by a READ memory access.
#0 ncnn::yuv420sp2rgb (mat_pixel.cpp:2101)
#1 main (poc.cpp)
#2 __libc_start_call_main (libc_start_call_main.h:59)
#3 __libc_start_main_impl (libc-start.c:360)
#4 _start (poc)
Verified: a legitimate-use baseline (8x8 with complete w*h*3/2 buffer) runs clean; an out-of-bounds read also occurs with a shortfall buffer even without the integer wrap (stack-buffer-overflow).
The functions are NCNN_EXPORT public API reachable with attacker-controlled width/height; no model file or authentication required. Consequences: deterministic crash (denial of service), out-of-bounds read that can leak adjacent heap/mapped data when the wrapped offset lands in a mapped region, and an out-of-bounds write in the drawing variants (the drawing family is code-level confirmed but not separately runtime-verified). No RCE developed.
No upstream fix as of 2026-10-01. The layer-param hardening PR #7003 does not cover mat_pixel (public API, no param concept).
|
|---|
| ソース | ⚠️ https://github.com/Tencent/ncnn/issues/7035 |
|---|
| ユーザー | JerryGW (UID 99144) |
|---|
| 送信 | 2026年10月01日 11:36 (18 日 ago) |
|---|
| モデレーション | 2026年10月18日 15:41 (17 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 421753 [Tencent ncnn 迄 44b02dabdcf97499281a4692ebd65bad73dcf8b6 Conversion API src/mat_pixel.cpp ncnn::yuv420sp2rgb メモリ破損] |
|---|
| ポイント | 20 |
|---|