Fix out-of-bounds read when a Loop/Scan body input is also an initializer

[Wei Wang (wangw-1991)]

Problem

OuterScopeNodeArgLocationAccumulator (session_state.cc) maps a Loop/Scan node's explicit inputs onto the subgraph's inputs using GraphViewer::GetInputs(), which excludes initializer-backed inputs. When a body declares an input that is also a
body initializer, GetInputs() is shorter than the parent node's input list, so indexing subgraph_inputs[arg_idx] reads past the end of the vector and dereferences an invalid NodeArg pointer during session initialization. This causes a crash / heap out-of-bounds read (observable under ASan) when loading a malformed model containing such a Loop/Scan.

Fix

In the Loop/Scan≥9 branch of OuterScopeNodeArgLocationAccumulator:

• Select the subgraph input vector whose size matches the parent node's input count (prefer GetInputsIncludingInitializers(), fall back to GetInputs()), mirroring the logic already used in Graph::InferAndVerifySubgraphTypes. If neither matches return INVALID_GRAPH instead of indexing.
• Add a defensive bounds check before indexing.
• Add Loop.BodyInputAlsoInitializer_RejectedWithoutOutOfBoundsRead test: a Loop whose body input is also a body initializer is now rejected cleanly instead of crashing.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

The regression case still reaches an ORT_ENFORCE that aborts exception-disabled builds instead of returning a clean error.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Prevents out-of-bounds access while mapping Loop/Scan parent inputs to subgraph inputs.

Changes:

• Selects a cardinality-matching subgraph input list and validates bounds.
• Adds a Loop regression test for initializer-backed body inputs.

File summaries

File	Description
onnxruntime/core/framework/session_state.cc	Hardens subgraph input mapping.
onnxruntime/test/providers/cpu/controlflow/loop_test.cc	Adds the regression test.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced (auto)

Note

Copilot is running an experiment and ran this review at Balanced.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Wei Wang (wangw-1991)]

Tianlei Wu (@tianleiwu) Can you help review this PR or help find suitable reviewers? Thanks.