Verify in-memory references when loading a model

[yuslepukhin]

Description

When loading the model verify that in-memory references point to an existing and valid OrtValue as if created my ModelEditor.

Motivation and Context

This prevents reading from arbitrary memory location when loading the model.

[Copilot]

Pull request overview

This PR adds a critical security fix to prevent arbitrary memory access when loading ONNX models with malicious in-memory external data references. The fix validates that any in-memory references (identified by the special tag */_ORT_MEM_ADDR_/*) point to valid OrtValue objects created through ModelEditor, rather than allowing arbitrary memory addresses to be dereferenced.

Key changes:

• Added validation logic in Graph::ConvertInitializersIntoOrtValues() to verify in-memory external data references match existing OrtValue initializers
• Added validation in Graph::AddInitializedOrtValue() to ensure data pointer consistency between tensor proto and OrtValue
• Created test artifacts to demonstrate the vulnerability and verify the fix

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.

File	Description
onnxruntime/test/testdata/test_evil_weights.py	Python script that generates a malicious ONNX model with arbitrary in-memory external data references for testing the security fix
onnxruntime/test/testdata/test_evil_weights.onnx	Binary ONNX model file generated by the Python script containing malicious external data references
onnxruntime/test/shared_lib/test_inference.cc	C++ test case that verifies models with malicious external data references fail to load with appropriate error messages
onnxruntime/core/graph/graph.cc	Core security fix that validates in-memory references during model loading and prevents arbitrary memory access

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.