onnxruntime

3a3c63e6 - Validate per-element split sizes on the input-tensor path to prevent OOB read

Validate per-element split sizes on the input-tensor path to prevent OOB read The Split operator's split-as-attribute path validates that each split size is non-negative (in the constructor), but the split-as-input-tensor path skips that check and only validates the aggregate (sum == axis dim, count == num_outputs). A negative split size like [6, -2] on a dim of size 4 passes the aggregate check (sum = 4) and causes the kernel to read 6 rows from a 4-row input buffer before the second output's negative-size allocation throws. Add per-element >= 0 validation in PrepareForCompute (CPU/WebGPU/shared- provider) and PrepareForComputeLocal (CUDA) before the aggregate checks. Add a unit test that supplies negative split sizes via an input tensor and expects failure. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>