onnxruntime

9cacffa6 - Harden ORT FlatBuffer model loader against malformed buffers (#28186)

Harden ORT FlatBuffer model loader against malformed buffers (#28186) ### Description Harden the `.ort` FlatBuffer model loader to reject malformed buffers early instead of dereferencing null pointers, allocating attacker-controlled sizes, or accessing out-of-bounds memory. ### Changes **Null table offset validation** (`flatbuffers_utils.h`/`.cc`) - Add `ValidateRequiredTableOffsets<T>()` template that scans a FlatBuffer vector of table offsets and rejects any null (zero) entries before the caller dereferences them. - Apply to opset imports, initializers, sparse initializers, node args, nodes, node edges, and metadata properties. **Initializer raw_data size validation** (`graph_flatbuffers_utils.cc`) - After reading shape and type, compute expected byte count and compare against actual `raw_data` size. Reject mismatches with a descriptive error. **Node index hardening** (`graph.cc`) - Compute `required_node_slot_count` by scanning actual node/edge indices instead of trusting the serialized `max_node_index` field, which could be attacker-controlled and cause oversized allocation. - Reject duplicate node indices, dangling `NodeEdge` references to missing nodes, duplicate `NodeArg` names, and unknown `NodeArg` references in graph inputs/outputs. **Regression tests** (`ort_model_only_test.cc`) - `RejectsInitializerRawDataSizeMismatch`: crafted buffer with wrong raw_data size - `RejectsNullNodeArgTableEntry`: buffer with zeroed-out node arg offset - `RejectsDanglingNodeEdge`: buffer with a NodeEdge pointing to a non-existent node ### Motivation These checks defend against crafted `.ort` files that could cause null-pointer dereferences, excessive memory allocation, or out-of-bounds access during model loading. ### Testing - `git diff --check` passes (no whitespace issues) - Incremental build of touched core objects succeeds - New regression tests exercise each validation path --------- Co-authored-by: tlwu <tlwu@example.com>