Skip to content

[Fix] Illegal memory access in GetOutputIndex with optional outputs - #27301

Closed
qti-mattsinc wants to merge 3 commits into
microsoft:mainfrom
CodeLinaro:dev/mattsinc/fix-output-index-support-optional
Closed

[Fix] Illegal memory access in GetOutputIndex with optional outputs#27301
qti-mattsinc wants to merge 3 commits into
microsoft:mainfrom
CodeLinaro:dev/mattsinc/fix-output-index-support-optional

Conversation

@qti-mattsinc

@qti-mattsinc qti-mattsinc commented Feb 10, 2026

Copy link
Copy Markdown
Contributor

Description

  • Fix an access violation in GetOutputIndex.
  • Add related EpGraphTest UT.

Motivation and Context

  • When a non-trailing output is optional, its ValueInfo in GetOutputIndex may be null. The current implementation attempts to dereference the nullptr due to a missing check.
  • This bug is exposed if an EP calls ValueInfo_GetValueProducer on a value info whose producer has non-trailing optional outputs.
  • [Fix] illegal memory access in GetInputIndices with optional inputs #25881 previously fixed the analogous issue for GetInputIndices but not for GetOutputIndex

Comment thread onnxruntime/core/graph/ep_api_types.cc Outdated
edgchen1
edgchen1 previously approved these changes Feb 13, 2026
Comment thread onnxruntime/test/testdata/skip_simplified_layer_normalization.py Fixed
edgchen1
edgchen1 previously approved these changes Feb 19, 2026
@edgchen1

Copy link
Copy Markdown
Contributor

/azp run Linux QNN CI Pipeline,Win_TRT_Minimal_CUDA_Test_CI,Windows ARM64 QNN CI Pipeline,Windows GPU Doc Gen CI Pipeline

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines successfully started running 4 pipeline(s).

@edgchen1
edgchen1 enabled auto-merge (squash) February 19, 2026 18:46
auto-merge was automatically disabled February 19, 2026 19:22

Head branch was pushed to by a user without write access

* When a non-trailing output is optional, its ValueInfo may be nullptr.
  The current implementation attempts to dereference the nullptr
  due to a missing check.
* This bug is exposed if an EP calls `ValueInfo_GetValueProducer` on
  a value info whose producer has non-trailing optional outputs.
* This commit adds the required check and a unit test.
@qti-mattsinc

Copy link
Copy Markdown
Contributor Author

Force pushing to fix author/committer metadata

@qti-mattsinc
qti-mattsinc force-pushed the dev/mattsinc/fix-output-index-support-optional branch from 74c3694 to fadb146 Compare February 19, 2026 19:29
@edgchen1

Copy link
Copy Markdown
Contributor

/azp run Linux QNN CI Pipeline,Win_TRT_Minimal_CUDA_Test_CI,Windows ARM64 QNN CI Pipeline,Windows GPU Doc Gen CI Pipeline

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines successfully started running 4 pipeline(s).

@qti-mattsinc

qti-mattsinc commented Mar 18, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this was fixed with #27644.

@edgchen1

Copy link
Copy Markdown
Contributor

sorry, I lost track of this PR. thanks anyway for contributing the fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants