Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions onnxruntime/core/mlas/lib/sconv.h
Original file line number Diff line number Diff line change
Expand Up @@ -26,4 +26,20 @@ Module Name:
#define MLAS_CONV_KERNEL_FLAG_RELU_ACTIVATION 0x00000004
#define MLAS_CONV_KERNEL_FLAG_OTHER_ACTIVATION 0x00000008

//
// Helper function to load input vector with bounds checking
//
static inline float32x4_t
LoadInputVectorWithBounds(
const float* ptr,
const float* row_start,
const float* row_end
)
{
if (ptr >= row_start && ptr < row_end) {
Copy link

Copilot AI Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The bounds check only verifies if the first element of the vector (ptr) is within bounds, but MlasLoadFloat32x4 loads 4 consecutive floats. This could lead to an out-of-bounds read if ptr+3 exceeds row_end. The check should be: ptr + 3 < row_end to ensure all 4 elements are within bounds.

Suggested change
if (ptr >= row_start && ptr < row_end) {
if (ptr >= row_start && (ptr + 3) < row_end) {

Copilot uses AI. Check for mistakes.
return MlasLoadFloat32x4(ptr);
}
return MlasBroadcastFloat32x4(0.0f);
}

#endif
Loading
Loading