Reject nodes that feed inputs to a zero-input operator schema

[shiyi (shiyi9801)]

Description

Add an explicit validation in Node::UpdateInputArgCount() to reject a node that supplies actual inputs while its bound operator/function schema declares no formal input parameters.

Motivation and Context

When op.inputs() is empty but the node has ≥1 input, the arg-count adjustment loop was skipped yet the trailing input_arg_count.push_back(arg_count_left) still ran unconditionally, producing InputArgCount().size() == 1 against op.inputs().size() == 0. This size-invariant violation later caused an out-of-bounds read at op.inputs()[i] in InferAndVerifyTypeMatch during Graph::Resolve().

This is reachable only via a model-local function in a custom domain: for registered ops, OpSchema::Verify in the ONNX checker rejects the extra inputs first, but for custom-domain function calls the checker performs no arity validation.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

The new validation path needs a regression test covering the previously crashing model-local function scenario.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds validation to prevent out-of-bounds access when a model-local function declares no inputs but receives inputs.

Changes:

• Rejects mismatched zero-input schemas with a clear error.
• Simplifies input-count adjustment after handling the empty-schema case.

File summaries

File	Description
onnxruntime/core/graph/graph.cc	Validates zero-input operator/function nodes during graph resolution.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[shiyi (shiyi9801)]

Hi, Dmitri Smirnov (@yuslepukhin), could you please take a look? This PR is for security hardening.

[shiyi (shiyi9801)]

FYI, test result without the fix:

Note: Google Test filter = FunctionTest.RejectsZeroInputFunctionCalledWithInput
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from FunctionTest
[ RUN ] FunctionTest.RejectsZeroInputFunctionCalledWithInput
unknown file: error: SEH exception with code 0xc0000005 thrown in the test body.
Stack trace:
00007FF7F0004CF7: testing::internal::HandleSehExceptionsInMethodIfSupported<testing::TestSuite,void>'::1'::filt$0
00007FFF0BF7A9C0: _C_specific_handler
00007FFF2B3C54FF: _chkstk
00007FFF2B32BD25: RtlWow64GetCurrentMachine
00007FFF2B3C4E3E: KiUserExceptionDispatcher
00007FF7EE9572C4: std::basic_string<char,std::char_traits,std::allocator >::basic_string<char,std::char_traits,std::allocator >
00007FF7EFACCD2F: onnxruntime::Graph::InferAndVerifyTypeMatch
00007FF7EFAE9496: onnxruntime::Graph::VerifyNodeAndOpMatch
00007FF7EFADCA33: onnxruntime::Graph::PerformTypeAndShapeInferencing
00007FF7EFADF883: onnxruntime::Graph::Resolve
00007FF7EFAF3957: onnxruntime::Model::Load
00007FF7EF7D0307: onnxruntime::InferenceSession::Load'::2'::<lambda_1>::operator()
00007FF7EF7F4892: std::_Func_impl_no_alloc<onnxruntime::InferenceSession::Load'::2'::<lambda_1>,onnxruntime::common::Status,std::shared_ptronnxruntime::Model &>::_Do_call
00007FF7EF7E2CD3: onnxruntime::InferenceSession::LoadWithLoader
00007FF7EF7DF53D: onnxruntime::InferenceSession::Load
00007FF7EEFAA177: onnxruntime::test::FunctionTest_RejectsZeroInputFunctionCalledWithInput_Test::TestBody
00007FF7EFCE83FB: testing::internal::HandleSehExceptionsInMethodIfSupportedtesting::Test,void
00007FF7EFCE82E6: testing::internal::HandleExceptionsInMethodIfSupportedtesting::Test,void
00007FF7EFD0D664: testing::Test::Run
00007FF7EFD0D77D: testing::TestInfo::Run
... Google Test internal frames ...