Limit nested model graph depth

[Akshay Sonawane (apsonawane)]

This pull request introduces a validation step to limit the maximum allowed subgraph nesting depth in ONNX models to 32. This prevents excessively deep or recursive subgraph structures that could cause stack overflows or performance issues. The change is enforced during model loading and is covered by new unit tests.

Model validation enhancements:

• Added a new function ValidateModelSubgraphDepth that checks the nesting depth of subgraphs in a model and returns an error if the depth exceeds kMaxModelSubgraphDepth (32). [1] [2]
• Integrated ValidateModelSubgraphDepth into the Model constructor to enforce subgraph depth checks during model loading. [1] [2]

Testing improvements:

• Added unit tests to verify that models with excessive subgraph depth are correctly rejected, and that the depth limit is enforced for both regular subgraphs and those in local functions. [1] [2]
• Included necessary header for model_helpers.h in test files to support new validation logic.

API and constant definition:

• Introduced the constant kMaxModelSubgraphDepth in model_helpers.h to define the supported subgraph depth limit.
• Declared the new validation function in the header for use across the codebase. [1] [2]

[Copilot]

Pull request overview

Adds a 32-level nesting limit to protect ONNX model loading from deeply nested subgraphs.

Changes:

• Adds iterative subgraph-depth validation.
• Enforces validation in model constructors.
• Adds main-graph and local-function tests.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
onnxruntime/core/graph/model_helpers.h	Declares the limit and validator.
onnxruntime/core/graph/model_helpers.cc	Implements depth traversal.
onnxruntime/core/graph/model.cc	Enforces validation during construction.
onnxruntime/test/ir/graph_test.cc	Tests excessive main-graph depth.
onnxruntime/test/framework/function_test.cc	Tests local-function graph depth.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Xavier Dupré (xadupre)]

protobuf is already checking that. So this limit only applies when is not going through protobuf or when it is modified. However, could we use the same limit?

[Tianlei Wu (tianleiwu)]

Requesting changes for one additional ordering gap: validation currently runs after recursive protobuf copying on the const-reference model construction path, so it cannot protect that entry point. I also rechecked the existing open thread about graph-valued FunctionProto::attribute_proto() defaults; it still applies to this head, so I did not duplicate it.

[Tianlei Wu (tianleiwu)]

Re-reviewed the current head. The graph-valued local-function default attributes are now included in the iterative depth traversal, and const-reference model protos are validated before recursive protobuf copying. The added boundary and regression tests cover both fixes. No remaining actionable findings.