Fix overflow in DmlGraphFusionHelper::ProcessInputData#27815
Merged
Conversation
fdwr
reviewed
Mar 23, 2026
adrastogi
added a commit
that referenced
this pull request
Mar 30, 2026
<!-- Describe your changes. --> This change tries to address a problem in the DML EP where AlignToPow2 rounded up tensorByteSize to a 4-byte boundary before the data was read from the source buffer. This caused CreateCpuResource, CreateResource, WriteToFile, and the inputRawData vector construction to read 1–3 bytes past the end of the original tensor data. CreateResource and CreateCpuResource already independently align the D3D12 resource descriptor size, so they work correctly with the original (unaligned) byte count. The fix is to move the alignment to the location where it's needed. <!-- - Why is this change required? What problem does it solve? - If it fixes an open issue, please link to the issue here. --> This is required because it addresses a crash / incorrect behavior in the DML EP.
adrastogi
added a commit
that referenced
this pull request
Mar 31, 2026
This cherry-picks the following commits for the release: - #26434 [VitisAI]add tensor type bool - #26452 [VitisAI EP] Fix error in graph resolving - #26487 [VitisAI] Enable ort::logger usage in compile_onnx_model_vitisai_ep_v4 - #26519 [VitisAI] Remove unused function body handling in graph fusion - #26627 [VitisAI] Add External EP Loader - #26699 [VitisAI] Add support compiled model compatibility information retrieval and validation - #27295 Remove s_kernel_registry_vitisaiep.reset() in deinitialize_vitisai_ep() - #27356 Add/Update telemetry events - #27626 Add PE version info to onnxruntime_providers_vitisai.dll - #27693 Fix integer division by zero crash in CPU EP Div operator - #27815 Fix overflow in DmlGraphFusionHelper::ProcessInputData - #27823 Fix new-delete mismatch in DML EP's QuantizeLinear operator --------- Co-authored-by: Yueqing Zhang <yuz75@Pitt.edu> Co-authored-by: Yueqing Zhang <yueqingz@amd.com> Co-authored-by: zpye <yezupei92@foxmail.com> Co-authored-by: Chunye Wang@AMD <chunywan@amd.com> Co-authored-by: mingyue <131847423+mingyueliuh@users.noreply.github.com> Co-authored-by: zz002 <zhenzew@amd.com> Co-authored-by: Darshak Bhatti <47045043+dabhattimsft@users.noreply.github.com> Co-authored-by: Darshak Bhatti <dabhatti@micorsoft.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Xiaoxi Han <xiha@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: tianleiwu <30328909+tianleiwu@users.noreply.github.com> Co-authored-by: skottmckay <979079+skottmckay@users.noreply.github.com> Co-authored-by: Tianlei Wu <tlwu@microsoft.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This change tries to address a problem in the DML EP where AlignToPow2 rounded up tensorByteSize to a 4-byte boundary before the data was read from the source buffer. This caused CreateCpuResource, CreateResource, WriteToFile, and the inputRawData vector construction to read 1–3 bytes past the end of the original tensor data.
CreateResource and CreateCpuResource already independently align the D3D12 resource descriptor size, so they work correctly with the original (unaligned) byte count. The fix is to move the alignment to the location where it's needed.
Motivation and Context
This is required because it addresses a crash / incorrect behavior in the DML EP.