Add tensor size validation for MatMulBnb4 to prevent OOB read via K/N attribute mismatch

[vraspar]

Description

Validates that b_quant and absmax tensor sizes are consistent with K/N/block_size attributes before dequantization in the MatMulBnb4 operator.

Fixes https://portal.microsofticm.com/imp/v5/incidents/details/31000000559964/summary

Changes

• Constructor: Validate K > 0, N > 0, block_size > 0
• Compute(): Validate b_quant size >= (KN+1)/2 and absmax size >= ceil(KN/block_size)
• Tests: Two regression tests for undersized b_quant and absmax tensors

Motivation and Context

MSRC case 109215: A crafted model can set K/N attributes larger than actual tensor sizes, causing OOB reads from b_quant_data and absmax_data during dequantization.

[Copilot]

Pull request overview

This PR hardens the MatMulBnb4 contrib operator against crafted models by validating that the b_quant and absmax tensors are large enough for the K/N/block_size attributes before dequantization, preventing potential out-of-bounds reads.

Changes:

• Add basic attribute validation for K, N, and block_size in the CPU kernel constructor.
• Add runtime size checks in Compute() for b_quant and absmax before dequantization.
• Add two regression tests that expect failure on undersized b_quant / absmax inputs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
onnxruntime/contrib_ops/cpu/quantization/matmul_bnb4.cc	Adds size/attribute validation intended to prevent OOB reads during BNB4 dequantization on CPU.
onnxruntime/test/contrib_ops/matmul_bnb4_test.cc	Adds negative/regression tests that expect failures when b_quant/absmax are undersized vs K/N/block_size.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.