onnxruntime

cbbcb33f - Validate K dimension for 1D vector inputs in MatMul to prevent OOB read

Validate K dimension for 1D vector inputs in MatMul to prevent OOB read MatMulComputeHelper::Compute skipped K-dimension validation when both inputs were 1D vectors (the vector x vector dot-product case). This allowed mismatched shapes like A=[5] and B=[1] to reach the MLAS GEMM backend, which assumed B had K elements and read past its allocation. Add the missing ORT_RETURN_IF_NOT check in the num_output_dims==0 branch to reject mismatched K dimensions before dispatch. This closes the heap-buffer-overflow (CVE-class) in MlasGemmQuantCopyPackB triggered via MatMulInteger with malformed 1D quantized inputs. Files changed: - onnxruntime/core/providers/cpu/math/matmul_helper.h - onnxruntime/test/providers/cpu/math/matmul_integer_test.cc Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>