Fix heap OOB read in SVMRegressor via attribute size validation#27901
Fix heap OOB read in SVMRegressor via attribute size validation#27901
Conversation
Add ORT_ENFORCE checks in the SVMRegressor constructor to validate that coefficients, support_vectors, and rho attribute array sizes are consistent with the declared n_supports dimension. Without this validation, a crafted model with undersized arrays causes the GEMM inner loop to read past buffer boundaries. This mirrors the existing validation already present in SVMClassifier. - Validate rho is non-empty (accessed as rho_[0] in LINEAR mode, passed to GEMM as bias in SVC mode) - Validate coefficients.size() >= vector_count_ in SVC mode - Validate feature_count_ > 0 after support_vectors division - Add two unit tests for undersized coefficients and support_vectors
There was a problem hiding this comment.
Pull request overview
This PR hardens the CPU ML SVMRegressor operator against crafted models by adding constructor-time attribute size validation to prevent heap out-of-bounds reads during the SVC/GEMM path, mirroring existing defensive checks in SVMClassifier.
Changes:
- Add
ORT_ENFORCEvalidations forrho,coefficients, andsupport_vectorssizing/consistency whenn_supports > 0. - Ensure
feature_count_ > 0in SVC mode to avoid invalid derived dimensions from undersizedsupport_vectors. - Add negative unit tests covering undersized
coefficientsandsupport_vectorsattributes.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| onnxruntime/core/providers/cpu/ml/svmregressor.cc | Adds attribute size/shape validation in SVMRegressor constructor to prevent OOB reads. |
| onnxruntime/test/providers/cpu/ml/svmregressor_test.cc | Adds regression tests that assert failures for undersized model attributes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Address Copilot review: validate support_vectors_.size() % vector_count_ == 0 to catch malformed models where support_vectors is not evenly divisible by n_supports, which would cause a debug-mode assert in batched_kernel_dot.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Add ORT_ENFORCE checks in the SVMRegressor constructor to validate that coefficients, support_vectors, and rho attribute array sizes are consistent with the declared n_supports dimension. Without this validation, a crafted model with undersized arrays causes the GEMM inner loop to read past buffer boundaries.
This mirrors the existing validation already present in SVMClassifier.