onnxruntime

abc74dc0 - Validate per-element split sizes on the input-tensor path to prevent OOB read (#29461)

Validate per-element split sizes on the input-tensor path to prevent OOB read (#29461) ### Description The  Split  operator's split-as-attribute path validates that each split size is non-negative (in the constructor), but the split-as-input-tensor path skips that check and only validates the aggregate (sum == axis dim, count == num_outputs). A crafted negative split size like  [6, -2]  on an axis of size 4 passes the aggregate check ( 6 + (-2) = 4 ) and causes the kernel to copy 6 rows from a 4-row input — an out-of-bounds read. Changes: •  split.h  ( PrepareForCompute ): Per-element  >= 0  validation. Covers CPU, WebGPU, shared-provider paths. •  cuda/tensor/split.cc  ( PrepareForComputeLocal ): Same fix in the CUDA copy. •  split_op_test.cc :  NegativeSplitSizeInputTensor  test with  split = [6, -2]  expecting failure. ### Motivation and Context <!-- - Why is this change required? What problem does it solve? - If it fixes an open issue, please link to the issue here. --> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1d814472-441f-441d-bd46-931956efc1cd