onnxruntime

f4aa2b44 - Validate initializer data length and guard element-count computation in contrib Range shape inference (#29265)

Validate initializer data length and guard element-count computation in contrib Range shape inference (#29265) ### Summary The `com.microsoft` Range operator's shape-inference helper read a fixed number of bytes from an initializer's `raw_data` without first checking the buffer length, and the element-count computation could pass non-finite or out-of-range values to an `int64` cast. This change adds the missing validations and aligns the shape-inference and CPU kernel paths. ### Changes - `GetFirstElement` now checks `raw_data` length is at least the element size before reading, and reads via `std::memcpy` into an aligned local. - `CalcRangeDim` and the CPU kernel `ComputeRange` now reject non-finite computed counts, handle non-positive counts before the `int64` cast, and reject counts that are not representable as `int64` (`>= 2^63`). Both paths use identical messages and semantics. - The output dimension for empty/backward ranges is clamped to 0 in shape inference to match the kernel. ### Tests Added contrib Range model-load regression tests in `range_test.cc` covering: - truncated `raw_data` for `start`, `limit`, and `delta` (double, plus float and int64 element types), - zero delta, - a finite-but-too-large element count, - an exact-size success boundary, - backward-range zero-dimension inference. Tests assert on `Status` (safe for no-exception builds) and are guarded by `#ifndef DISABLE_CONTRIB_OPS` (throwing cases additionally by `!defined(ORT_NO_EXCEPTIONS)`). 21/21 `RangeTest` cases pass locally. ### Follow-up `int16` inputs are currently supported only via `raw_data` (there is no `get_data<int16_t>` specialization for the non-raw-data path); this is left as a separate follow-up. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>