Sentinel: Validate GPU compression output sizes

Added security validation in `src/batch_cuda.rs` to check output sizes returned by the GPU kernel.
This prevents potential buffer overflows or panics (DoS) if the GPU returns corrupted or malicious size values.
Verified that `offset + size <= total_output_bound` and `size <= expected_bound`.

Co-authored-by: 404Setup <[email protected]>

Author: google-labs-jules[bot]

src/batch_cuda.rs

@@ -120,6 +120,17 @@ impl CudaBatchCompressor {
                 let offset = output_offsets[i] as usize;
                 let size = size as usize;
 
+                // Security: Validate GPU output sizes to prevent panics or OOB access
+                if offset.checked_add(size).ok_or("Integer overflow in offset calculation")? > total_output_bound {
+                    return Err("GPU returned invalid compressed size (buffer overflow)".into());
+                }
+
+                // Double check against expected bound
+                let expected_bound = crate::compress::Compressor::deflate_compress_bound(inputs[i].len());
+                if size > expected_bound {
+                    return Err("GPU returned invalid compressed size (exceeds bound)".into());
+                }
+
                 let slice = dev_output.slice(offset..offset + size);
                 let host_data = self.device.dtoh_sync_copy(&slice)?;
                 results.push(host_data);