Fix heap OOB write in Attention PrepareMask via negative mask_index values
Merged
VR
7mo ago+69+69+01234567890123456789-4-4-0123456789
Description
Fixes a heap out-of-bounds write (underflow) in the Attention contrib operator's PrepareMask function. Negative values in the 1D mask_index tensor were used directly as loop start indices without bounds checking, allowing writes at negative offsets before the p_mask buffer.
In PrepareMask() (attention_helper.h), end_position is read from mask_index[b_i] and used as the starting index in a write loop with no lower-bound validation. When end_position is negative, the loop writes mask_filter_value at negative offsets — a heap buffer underflow. In contrast, start_position had partial clamping via std::min() but lacked a lower bound as well.