Skip to content

Remove redundant ORT FlatBuffer table offset validation#29068

Merged
tianleiwu merged 1 commit into
microsoft:mainfrom
tianleiwu:tlwu/flatbuffer_reduce_check
Jun 16, 2026
Merged

Remove redundant ORT FlatBuffer table offset validation#29068
tianleiwu merged 1 commit into
microsoft:mainfrom
tianleiwu:tlwu/flatbuffer_reduce_check

Conversation

@tianleiwu

Copy link
Copy Markdown
Contributor

Description

Follow-up to #28186 ("Harden ORT FlatBuffer model loader against malformed buffers"). That PR added a manual ValidateRequiredTableOffsets helper that walked the raw offset array of required FlatBuffer vectors and rejected any null/zero entry while loading ORT-format models. The ORT loader already runs the generated flatbuffers::Verifier (fbs::VerifyInferenceSessionBuffer) before any deserialization in InferenceSession::LoadOrtModelWithLoader, and that verifier performs the same required-offset validation. The manual helper was therefore redundant, so this PR removes it and its call sites while keeping the existing per-entry null checks that guard the deserialization loops.

Summary of Changes

Remove redundant validation helper

File Change
onnxruntime/core/flatbuffers/flatbuffers_utils.h Remove the ValidateRequiredTableOffsets template helper.
onnxruntime/core/flatbuffers/flatbuffers_utils.cc Drop the call in LoadOpsetImportOrtFormat.
onnxruntime/core/graph/graph.cc Drop the 5 calls (initializers, sparse initializers, node args, nodes, node edges) in Graph::LoadFromOrtFormat.
onnxruntime/core/graph/model.cc Drop the metadata-properties call in Model::LoadFromOrtFormat.

The per-entry ORT_RETURN_IF(nullptr == ..., ...) null checks inside the deserialization loops, the adversarial node-index/slot-count hardening, and the edge-bounds checks added in #28186 are all retained.

Tests

  • Remove RejectsNullNodeArgTableEntry, which only exercised the deleted helper (this case is now covered by the FlatBuffers verifier).
  • Strengthen RejectsInitializerRawDataSizeMismatch to load through the zero-copy initializer path (kOrtSessionOptionsConfigUseORTModelBytesDirectly + kOrtSessionOptionsConfigUseORTModelBytesForInitializers). The raw-data exact-size check in LoadInitializerOrtFormat is still required for that path because it bypasses the embedded TensorProto validation, and the test now covers it directly (dims{32} vs. sizeof(float) * 33 raw bytes).

Testing

make -C build/Linux/Debug -j"$(nproc)" onnxruntime_test_all
./build/Linux/Debug/onnxruntime_test_all --gtest_filter='OrtModelTest.RejectsInitializerRawDataSizeMismatch:OrtModelTest.RejectsDanglingNodeEdge:OrtModelTest.RejectsAdversarialLargeNodeIndex:OrtModelTest.RejectsInvalidEdgeEndNodeIndex:OrtModelTest.RejectsEdgeEndReferencingNullNodeSlot:OrtModelTest.RejectsGraphInputWithUnknownNodeArg'

All six focused tests pass. Behavior is unchanged for valid models; malformed buffers with null required-table offsets are still rejected, now by the FlatBuffers verifier rather than the removed helper.

Motivation and Context

Removes duplicate validation introduced in #28186 now that it is known to overlap with the FlatBuffers verifier already run on every ORT-format load. No public API or on-disk format changes.

@tianleiwu
tianleiwu merged commit 964cf4d into microsoft:main Jun 16, 2026
91 of 92 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants