Security context

Highlights

Integer Overflow: 3 prior fixes. Scrutinize any change in this area.

src/fastertransformer/kernels: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Integer Overflow: Large sequence lengths and batch sizes can cause 32-bit index calculations to overflow during softmax operations, resulting in out-of-bounds writes or reads on the GPU. This occurs within attention-mask and query-key score calculations.

Integer Overflow: Using 32-bit signed integers to compute element counts for GPU memory transfers (like cudaMemcpy) can lead to wrapping/truncation, causing buffer overflows or incorrect memory copies.

Integer Overflow: Type constraints on loop counters and index variables for soft prompt embeddings allow overflows when processing models with large hidden dimensions, leading to invalid memory indexing.