[Security] Reject non-finite temperature and repetition_penalty values

[jperezdealgaba]

Summary

• Add math.isfinite() validation for temperature and repetition_penalty in SamplingParams._verify_args().
• NaN and Infinity bypass Python's comparison operators (<, >) due to IEEE 754 float semantics, allowing them to propagate to GPU sampling kernels where they cause undefined behavior or CUDA crashes.
• Addresses advisory GHSA-7h4p-rffg-7823.

Test plan

• Added tests/samplers/test_non_finite_params.py with 12 parametrized tests covering NaN, +Inf, -Inf rejection and valid value acceptance for both parameters.
• pytest tests/samplers/test_non_finite_params.py -v — all 12 tests pass.
• pre-commit run --files vllm/sampling_params.py tests/samplers/test_non_finite_params.py — all hooks pass.

[hmellor]

Would it be faster to use <= float('inf')? These checks are going to run a lot so we should try to use the fastest method

[jperezdealgaba]

@hmellor The problem using float is that <= float('inf') would still let temperature=Infinity through to the GPU kernels, which is the vulnerability I am trying to fix here.

That's the reason why. Do you think of a better solution for it? I don't really know it

[hmellor]

Oh yeah of course, I should have suggested < not <=.

Anyway, a micro benchmark suggests that comparison is only faster if we write inf to a variable for reuse (not what I originally suggested)

Approach	ns/call
x < inf (prebound)	~10
math.isfinite(x)	~15
-inf < x < inf	~25
x < float('inf') (inline)	~50

Let's stick with what you have