Fix TreeEnsemble target id validation

Merged
ED
4mo ago
+111-27

Fix TreeEnsemble target id validation

Problem

TreeEnsemble opset 5 normalizes leaf_targetids into the internal v3-shaped attributes without going through the v3 attribute constructor. Invalid target ids could therefore reach the N-output aggregators, where Min/Max indexed the predictions vector without a bounds check.

Fix

  • Centralize target/class id validation in TreeEnsembleCommon::Init() so all normalized entry paths are covered.
  • Reject non-positive target/class counts, negative target/class ids, and ids greater than or equal to the target/class count.
  • Add defense-in-depth target index checks in Sum/Min/Max N-output aggregators before indexing predictions.
  • Add v5 negative tests and update affected v3 regressor negative test expectations.

Testing

  • lintrunner on changed files
  • rebuilt onnxruntime_provider_test
  • targeted provider tests:
    • MLOpTest.TreeEnsembleFloat
    • MLOpTest.TreeEnsembleDouble
    • MLOpTest.TreeEnsembleSetMembership
    • MLOpTest.TreeEnsembleLeafOnly
    • MLOpTest.TreeEnsembleMinLeafTargetIdsOutsideBoundary
    • MLOpTest.TreeEnsembleMaxLeafTargetIdsOutsideBoundary
    • MLOpTest.TreeEnsembleNegativeLeafTargetIds
    • MLOpTest.TreeEnsembleZeroTargets
    • MLOpTest.TreeEnsembleLeafLike
    • MLOpTest.TreeEnsembleBigSet
    • MLOpTest.TreeEnsembleIssue25400
    • MLOpTest.TreeRegressorNegativeTargetIds
    • MLOpTest.TreeRegressorOutsideBoundaryTargetIds
    • MLOpTest.TreeEnsembleRegressorTargetIdsOutsideBoundary