Fix arbitrary memory read

Merged
AP
4mo ago
+117-0

This pull request strengthens security around loading ONNX models by adding a defense-in-depth check that rejects Constant nodes with dense tensor attributes referencing internal ORT in-memory address markers. It also introduces a regression test to ensure this attack vector is blocked.

Security hardening:

  • Added an explicit check in ConstantNodeProtoToTensorProto to reject Constant node tensor attributes with ORT in-memory address markers, preventing crafted models from propagating unsafe pointers.

Testing:

  • Added a regression test RejectInMemoryMarkerOnConstantNodeTensorAttribute to verify that models containing Constant nodes with such in-memory markers are rejected during model load.