fix(frontend): bound stop strings and regex patterns (#37029)

python/sglang/srt/sampling/sampling_params.py

@@ -38,6 +38,9 @@ CustomParamValue = Union[
 
 _SAMPLING_EPS = 1e-6
 TOP_K_ALL = 1 << 30
+MAX_STOP_COUNT = 32
+MAX_STOP_REGEX_LEN = 256
+MAX_STOP_REGEX_COUNT = 32
 
 logger = logging.getLogger(__name__)
 
@@ -222,6 +225,11 @@ class SamplingParams(msgspec.Struct, kw_only=True, array_like=True):
         else:
             if isinstance(self.stop_strs, str):
                 self.stop_strs = [self.stop_strs]
+            if len(self.stop_strs) > MAX_STOP_COUNT:
+                raise ValueError(
+                    f"at most {MAX_STOP_COUNT} stop strings are allowed, "
+                    f"got {len(self.stop_strs)}"
+                )
 
             stop_str_max_len = 0
             for stop_str in self.stop_strs:
@@ -239,9 +247,20 @@ class SamplingParams(msgspec.Struct, kw_only=True, array_like=True):
         else:
             if isinstance(self.stop_regex_strs, str):
                 self.stop_regex_strs = [self.stop_regex_strs]
+            if len(self.stop_regex_strs) > MAX_STOP_REGEX_COUNT:
+                raise ValueError(
+                    f"at most {MAX_STOP_REGEX_COUNT} stop_regex patterns are allowed, "
+                    f"got {len(self.stop_regex_strs)}"
+                )
 
             stop_regex_max_len = 0
             for stop_regex in self.stop_regex_strs:
+                stop_regex_len = len(stop_regex.encode("utf-8"))
+                if stop_regex_len > MAX_STOP_REGEX_LEN:
+                    raise ValueError(
+                        f"stop_regex is {stop_regex_len} bytes, over the "
+                        f"{MAX_STOP_REGEX_LEN}-byte limit"
+                    )
                 stop_regex_max_len = max(
                     stop_regex_max_len, get_max_seq_length(stop_regex)
                 )