commit eed2258a663c0aa46c12b31c717a9c8f01613182
Author: Pavel Sanda <[email protected]>
Date: Tue Jun 16 16:43:40 2026 +0200
Hardening case 00k - file truncation via paperwidth/paperheight
\paperwidth and \paperheight flow raw into the DVI converter/viewer command;
redirection is extracted there. That can lead to truncation of arbitrary
file.
Fires on DVI export/view.
Tier 00 fix: reject invalid lengths at parse time (fail -> class default).
Assisted-by: Claude Opus 4.7
---
src/BufferParams.cpp | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/src/BufferParams.cpp b/src/BufferParams.cpp
index 05f5f149d0..d32262054d 100644
--- a/src/BufferParams.cpp
+++ b/src/BufferParams.cpp
@@ -1362,10 +1362,20 @@ string BufferParams::readToken(Lexer & lex, string
const & token,
}
if (token == "\\paperwidth") {
lex >> paperwidth;
+ if (!paperwidth.empty() && !isValidLength(paperwidth)) {
+ lyxerr << "Rejecting non-Length \\paperwidth
value: "
+ << paperwidth << endl;
+ paperwidth.clear();
+ }
break;
}
if (token == "\\paperheight") {
lex >> paperheight;
+ if (!paperheight.empty() &&
!isValidLength(paperheight)) {
+ lyxerr << "Rejecting non-Length \\paperheight
value: "
+ << paperheight << endl;
+ paperheight.clear();
+ }
break;
}
if (token == "\\leftmargin") {
--
lyx-cvs mailing list
[email protected]
https://lists.lyx.org/mailman/listinfo/lyx-cvs
