onnxruntime
70546574 - Fix out-of-bounds read in EmbedLayerNormalization shape inference for scalar beta (#32610)

Commit
54 days ago
Fix out-of-bounds read in EmbedLayerNormalization shape inference for scalar beta (#32610) ### Description `EmbedLayerNormalizationShapeInference` validated the `beta` input's rank using the wrong shape: `beta_dims` was aliased to `gamma_shape.dim()` instead of `beta_shape.dim()`. As a result, a rank-1 `gamma` would let the rank check pass even when `beta` is a 0-dim scalar, and execution reached `beta_shape.dim(0).dim_value()` — an unchecked protobuf repeated-field access on an empty `dim` list, causing an out-of-bounds read during session load, before provider/kernel assignment. ### Fix - Alias `beta_dims` to `beta_shape.dim()` so the rank check guards the correct input; a scalar `beta` is now rejected via `fail_shape_inference` instead of reaching the OOB access. This matches the adjacent `gamma` validation. - Correct the `gamma` error message ("2 dimension" → "1 dimension") to reflect the actual check
Author
Parents
Loading