fix out of boundary vector per class in SVM

[xadupre]

Description

vector_per_class dimension was not verified, it could lead to illegal memory access

Motivation and Context

security issue

[xadupre]

@copilot can you fix the build?

[Copilot]

@copilot can you fix the build?

Fixed in commit 2a1d2c6. The build errors were caused by type mismatches after changing *_count_ members to size_t:

1. narrow<ptrdiff_t> → narrow<size_t> when accumulating vector_count_ (was adding signed to unsigned)
2. Added explicit narrow<size_t> cast for class_j_support_count (implicit int64_t → size_t conversion)
3. SafeInt<int32_t> → SafeInt<size_t> for the final_scores_per_batch subspan offset (consistent with other subspan calls)

[Copilot]

Pull request overview

This PR hardens the CPU ML SVMClassifier implementation against malformed models by adding validation around vectors_per_class sizing (to prevent potential out-of-bounds access), and adds a regression test to ensure the new validation triggers as expected.

Changes:

• Add a negative test ensuring undersized vectors_per_class fails with a clear error.
• Tighten SVMClassifier constructor validation and adjust internal indexing types to size_t.
• Minor refactoring of classifier scoring loops to use size_t indexing.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
onnxruntime/test/providers/cpu/ml/svmclassifier_test.cc	Adds regression coverage for undersized vectors_per_class.
onnxruntime/core/providers/cpu/ml/svmclassifier.h	Switches internal count/index member types to size_t.
onnxruntime/core/providers/cpu/ml/svmclassifier.cc	Adds dimension validation and updates indexing/types in constructor and compute path.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tianleiwu]

Review Summary

Solid security hardening for the SVM classifier. The key fix — validating vectors_per_class_.size() == class_count_ in SVC mode — correctly closes the out-of-bounds access from crafted models. The type migration from ptrdiff_t/int64_t to size_t for count/index members is appropriate and removes many redundant narrow<> casts.

Remaining issues are cosmetic. I agree with the open threads from the Copilot reviewer (duplicate proba_ check, grammar in error message, test naming). Those are all minor and can be addressed in a follow-up if desired.

LGTM.

[xadupre]

@copilot resolve the merge conflicts in this pull request

[xadupre]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Done in commit 93c09e3. Resolved two conflicts:

• svmclassifier.cc: Used main's SafeMultiply approach for num_classifiers (overflow-safe)
• svmclassifier_test.cc: Kept both tests — main's SVMClassifierDifferentSizeKernelParameters (kernel_params size) and our SVMClassifierSVCLinearUndersizedVectorPerClass (vectors_per_class size)

[tianleiwu]

Review Summary

Solid security hardening for the CPU ML SVMClassifier kernel. The key fix — validating vectors_per_class_.size() == class_count_ in SVC mode — directly closes the out-of-bounds access from crafted models. The type migration from ptrdiff_t to size_t is correct and simplifies downstream casts.

Minor notes (not in diff range):

• Nitpick: The ORT_ENFORCE(proba_.size() == probb_.size()); at line 42 is now duplicated — line 67 adds the same check with a better error message ("proba and probb must have the same size."). Consider removing the earlier version to keep a single source of truth.

Core fix is correct and well-targeted.

Verdict: APPROVE