darknet rnn generatetactic: empty stdin causes NULL dereference of out in test_tactic_rnn

Author: trustqqCreated Sep 11, 2026Updated Sep 11, 2026

Summary

With ./darknet rnn generatetactic cfg/rnn.cfg < /dev/null (empty stdin), the only assignment to the out pointer in test_tactic_rnn() (examples/rnn.c:367 out = network_predict(net, input);) is inside the while((c = getc(stdin)) != EOF) loop (rnn.c:365-369); with empty stdin the loop iterates zero times, and out keeps its initial NULL (rnn.c:363 float *out = 0;). The subsequent generation loop then executes if (out[j] < .0001) out[j] = 0; at rnn.c:372, dereferencing NULL on its very first iteration → SIGSEGV. load_network(cfgfile, NULL, 0) completes normally before the crash, so no weights file is needed.

Reproduction

bash

# Build (in the darknet-master/ directory; CPU-only build, zero external dependencies):
#   make -j$(nproc) DEBUG=1     # DEBUG=1 adds -O0 -g; the default DEBUG=0 build crashes the same way
#
# Run:
./darknet rnn generatetactic cfg/rnn.cfg < /dev/null

Note: -len defaults to 1000 (rnn.c:527), but the crash occurs on the first iteration (i=0), regardless of the value of num.

Source

/* examples/rnn.c:363-369 — out starts as NULL; the only assignment is inside the stdin loop */
    float *out = 0;                      /* line 363 */
    while((c = getc(stdin)) != EOF){     /* line 365: empty stdin → zero iterations */
        input[c] = 1;
        out = network_predict(net, input);  /* line 367: never executed */
        input[c] = 0;
    }

/* examples/rnn.c:370-372 — sink */
    for(i = 0; i < num; ++i){
        for(j = 0; j < inputs; ++j){
            if (out[j] < .0001) out[j] = 0;   /* line 372: crashes when out==NULL */
        }
        ...
    }

Result

Source: pjreddie/darknet

View original on GitHub View discussion on GitHub