ncnn blob index OOB — heap-buffer-overflow WRITE
Vulnerability
CWE-787: Out-of-bounds Write in ncnn model loading (net.cpp).
In Net::load_param_bin(), blob indices read from the binary .param.bin file
are used directly as vector subscripts without bounds checking:
// net.cpp:1559-1564
int bottom_blob_index;
READ_VALUE(bottom_blob_index) // from file, no validation
Blob& blob = d->blobs[bottom_blob_index]; // OOB if >= blob_count
blob.consumer = i;… See the full description on the dataset page: https://huggingface.co/datasets/Talson/ncnn-blobindex-oob-poc.
