Validate conv bias shape in WordConvEmbedding to prevent OOB read

Merged
AP
5mo ago
+31-0

Description

Add shape validation for the conv bias input (B) in WordConvEmbedding::Compute() to prevent out-of-bounds heap reads when a crafted model provides a bias tensor shorter than num_filters.

Root Cause

WordConvEmbedding::Compute passes b_conv.Data<float>() directly to ComputeConvMaxPoolWithActivation, which iterates over num_filters (= w_conv.shape[0]) elements of the bias buffer. ValidateInputShape only checks the sequence, conv weight, and char embedding shapes — the bias shape is never validated. A model with b_conv.shape[0] < w_conv.shape[0] causes the inner loop to read past the bias buffer, and the leaked heap bytes propagate through tanh activation and max-pooling into the output tensor.

Fix

Add an inline check after ValidateInputShape that rejects bias tensors whose shape is not [num_filters]:

ORT_RETURN_IF_NOT(b_conv_shape.NumDimensions() == 1 && b_conv_shape[0] == w_conv_shape[0],
                  "WordConvEmbedding: conv bias B must be a 1-D tensor of length ",
                  w_conv_shape[0], ", but got shape ", b_conv_shape);