Security: Missing bounds checks on batch size can cause memory/CPU exhaustion

[tuanaiseo]

Problem

Multiple handlers derive input_len = len(inputs) (or vision inputs) and allocate response lists directly from that size without limits. Large crafted requests can trigger oversized allocations and excessive compute, causing denial of service.

Severity: medium
File: integration-test/models/dummy-chat/model.py

Solution

Validate and cap maximum batch size before processing (e.g., reject or truncate requests above a configured threshold) and add global request size limits.

Changes

• integration-test/models/dummy-chat/model.py (modified)

Testing

• Existing tests pass
• Manual review completed
• No new warnings/errors introduced

---

Note

Low Risk
Low risk: adds a simple bounds check that rejects oversized chat batches before allocating per-item response structures. Main impact is a new ValueError for requests over the limit, which could affect any callers relying on unbounded batch sizes.

Overview
Adds a maximum batch size guard to integration-test/models/dummy-chat/model.py by introducing MAX_BATCH_SIZE = 128 and rejecting requests where len(inputs) exceeds this limit.

This prevents oversized batch requests from triggering large list allocations and excessive compute; oversized requests now fail fast with a ValueError.

^{Reviewed by Cursor Bugbot for commit a616489. Bugbot is set up for automated code reviews on this repo. Configure here.}