Address Pad Reflect vulnerability

Merged
YU
8mo ago
+218-8

This pull request addresses a critical validation gap in the "reflect" mode of the Pad operator for both CPU and CUDA backends, ensuring compliance with the ONNX specification and preventing out-of-bounds memory access. The main change is the addition of checks that prevent the pad size from exceeding the maximum allowed value (extent - 1) for each axis, and the introduction of comprehensive regression tests to verify the new behavior.

Validation fixes for reflect-mode padding:

  • Added explicit checks in onnxruntime/core/providers/cpu/tensor/pad.cc and onnxruntime/core/providers/cuda/tensor/pad.cc to ensure that, for reflect mode, both pre-pad and post-pad values do not exceed extent - 1 for each axis, as required by the ONNX spec. This prevents heap out-of-bounds errors and aligns with numpy behavior. [1] [2] [3] [4]

Testing and regression coverage:

  • Added a suite of regression tests in onnxruntime/test/providers/cpu/tensor/pad_test.cc to verify that invalid pad sizes in reflect mode are correctly rejected, including edge cases for 1D and 2D inputs, boundary conditions, and scenarios with slicing. These tests ensure that the operator fails gracefully when pad sizes exceed the allowed limit and succeeds when within bounds.

Other changes:

  • Minor file encoding update in onnxruntime/test/providers/cpu/tensor/pad_test.cc.