Integer Overflow Vulnerability in FileLoader::read() Leading to Memory Corruption

[Asuk4]

Dear Alibaba MNN Team,

During our security audit of the MNN project, we have identified a potential integer overflow vulnerability in the FileLoader::read() method that could lead to memory corruption. This vulnerability exists in the file handling code path and could be triggered when processing untrusted input files.

Vulnerability Details

The vulnerability stems from insufficient validation of the size parameter in FileLoader::read() method, which is used to determine the amount of data to read from a file. This parameter originates from untrusted input and is used directly in memory operations without proper bounds checking.

Mechanism of Vulnerability

1. The vulnerability is triggered in the following call chain:

   load -> ReadQuanData_c -> ReadBlobDim -> read
   

2. In FileLoader::read(), the size parameter is used directly in fread() without validation:

   bool FileLoader::read(char* buffer, int64_t size) {
       _init();
       if (nullptr == mFile) {
           return false;
       }
       return fread(buffer, 1, size, mFile) == size;
   }
   

3. The size parameter originates from untrusted input in the following path:

   // In load():
   buffer = IDSTDecoder::ReadQuanData_c(external_file.get(), &weightLength, result.get(), quan, forceInt8, forceFloat, weightPtr);
   

4. The value propagates through ReadQuanData_c and ReadBlobDim without proper validation:

   // In ReadBlobDim():
   myfile->read((char*)shape, sizeof(unsigned int) * copyLength);
   

Impact

This vulnerability could lead to:

1. Integer overflow when calculating buffer sizes
2. Memory corruption through buffer overflows
3. Potential remote code execution if an attacker can control the input file
4. Denial of service through excessive memory allocation

Suggested Fix

Add bounds checking for the size parameter in FileLoader::read():

bool FileLoader::read(char* buffer, int64_t size) {
    if (size <= 0 || size > MAX_SAFE_SIZE) {
        return false;
    }
    _init();
    if (nullptr == mFile) {
        return false;
    }
    return fread(buffer, 1, size, mFile) == size;
}

[jxt1234]

Ok, we will fix it later

[github-actions[bot]]

Marking as stale. No activity in 60 days.