Skip to content

Add validity check on MaxUnpool indicies.#27432

Merged
skottmckay merged 3 commits intomainfrom
skottmckay/MaxUnpool_AddIndexValidityCheck
Feb 25, 2026
Merged

Add validity check on MaxUnpool indicies.#27432
skottmckay merged 3 commits intomainfrom
skottmckay/MaxUnpool_AddIndexValidityCheck

Conversation

@skottmckay
Copy link
Copy Markdown
Contributor

Description

Check indices values are valid.

Motivation and Context

Fix invalid write.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request adds input validation for MaxUnpool indices to prevent invalid memory writes. The operator now checks that each index is within the valid range [0, output_size) before using it to write to the output tensor, fixing a potential out-of-bounds write vulnerability.

Changes:

  • Added bounds checking for indices in MaxUnpool operator to validate they are non-negative and within the output tensor size
  • Added test case to verify the operator correctly rejects out-of-bounds indices with a clear error message

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
onnxruntime/core/providers/cpu/nn/Unpool.cc Added validation to check indices are within bounds [0, output_size) before writing to output tensor, preventing invalid writes
onnxruntime/test/providers/cpu/nn/unpool_op_test.cc Added test case MaxUnpoolInvalidIndices to verify proper error handling for out-of-bounds indices

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants