Skip to content

fix out of boundary vector per class in SVM#27952

Open
xadupre wants to merge 3 commits intomainfrom
xadupre/si-svm-111801
Open

fix out of boundary vector per class in SVM#27952
xadupre wants to merge 3 commits intomainfrom
xadupre/si-svm-111801

Conversation

@xadupre
Copy link
Copy Markdown
Member

@xadupre xadupre commented Apr 2, 2026

Description

vector_per_class dimension was not verified, it could lead to illegal memory access

Motivation and Context

security issue

if (vector_count_ > 0) {
feature_count_ = support_vectors_.size() / vector_count_; // length of each support vector
mode_ = SVM_TYPE::SVM_SVC;
ORT_ENFORCE(static_cast<int64_t>(vectors_per_class_.size()) == class_count_, "Mismatch between class_labels and vector_per_class dimensions.");
Copy link
Copy Markdown
Contributor

@tianleiwu tianleiwu Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggest to change *_count_ type to size_t so we need not cast here.

ptrdiff_t feature_count_;
ptrdiff_t class_count_;
ptrdiff_t vector_count_;

That could avoid other casts like:

auto cur_votes = votes_span.subspan(n * SafeInt<size_t>(class_count_), onnxruntime::narrow<size_t>(class_count_));

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants