Validate eos_token_id against vocab_size to prevent OOB write in ApplyMinLength

[jiafatom]

Summary

Fixes an out-of-bounds write (CWE-787 / CWE-129) reachable from a malicious genai_config.json.

Search_Cpu::ApplyMinLength suppresses EOS tokens while the sequence is shorter than min_length by writing std::numeric_limits<float>::lowest() into the per-beam score row at each configured eos_token_id:

std::span<float> const beam_token_scores = GetScores(i);       // vocab_size elements
for (auto token_id : params_->config.model.eos_token_id)
  beam_token_scores[token_id] = std::numeric_limits<float>::lowest();  // unchecked index

eos_token_id comes straight from config (src/config.cpp) with only a static_cast<int> and is never bounded against vocab_size. A model whose eos_token_id >= vocab_size (or < 0) drives the store past the end of the vocab_size-sized GetScores() subspan — a heap-buffer-overflow write on the first decode step (reached via Generator::GenerateNextToken -> ApplyMinLength). The same pattern exists in the CUDA backend (Search_Cuda::ApplyMinLength).

Changes

• src/generators.cpp: reject any eos_token_id outside [0, vocab_size) in the Generator::Generator validator, mirroring the existing top_k <= vocab_size check (added in Fix security vulnerabilities #2224).
• src/search.cpp and src/cuda/search_cuda.cpp: defense-in-depth — skip out-of-range ids at the sink in both backends.
• test/sampling_tests.cpp: add EosTokenIdExceedsVocabSizeThrowsCpu, which overlays an out-of-range eos_token_id and asserts OgaGenerator::Create throws instead of proceeding to the OOB write.

Testing

New regression test follows the existing SamplingTests overlay pattern (tiny-random-gpt2-fp32 + vocab_size/eos_token_id overlay). Local build isn't available in my environment; relying on CI to build and run the C++ unit tests.

[Copilot]

Pull request overview

This PR addresses a security issue where untrusted eos_token_id values from genai_config.json could be used as unchecked indices into per-token score buffers, leading to out-of-bounds writes during ApplyMinLength (CPU and CUDA).

Changes:

• Add generator-construction validation to reject any eos_token_id outside [0, vocab_size).
• Add defense-in-depth bounds checks at the ApplyMinLength sinks for CPU and CUDA implementations.
• Add a regression test ensuring generator creation fails when eos_token_id >= vocab_size.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/generators.cpp	Validates eos_token_id against vocab_size during generator construction to prevent OOB writes.
src/search.cpp	Adds bounds check before indexing per-beam score rows with eos_token_id (CPU defense-in-depth).
src/cuda/search_cuda.cpp	Adds bounds check before launching CUDA score-masking kernel with eos_token_id (CUDA defense-in-depth).
test/sampling_tests.cpp	Adds regression test covering out-of-range eos_token_id rejection at generator creation.