commit 9d4d7da8eff2d46f22d69c58578684db8e6195c3
Author: Pavel Sanda <[email protected]>
Date: Tue Jun 16 16:43:40 2026 +0200
Hardening case 00k - file truncation via paperwidth/paperheight
\paperwidth and \paperheight flow raw into the DVI converter/viewer command;
redirection is extracted there. That can lead to truncation of arbitrary
file.
Fires on DVI export/view.
Tier 00 fix: reject invalid lengths at parse time (fail -> class default).
Assisted-by: Claude Opus 4.7
---
src/BufferParams.cpp | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/src/BufferParams.cpp b/src/BufferParams.cpp
index 74e540811b..8579c520df 100644
--- a/src/BufferParams.cpp
+++ b/src/BufferParams.cpp
@@ -1534,10 +1534,20 @@ string BufferParams::readToken(Lexer & lex, string
const & token,
}
if (token == "\\paperwidth") {
lex >> paperwidth;
+ if (!paperwidth.empty() && !isValidLength(paperwidth)) {
+ lyxerr << "Rejecting non-Length \\paperwidth
value: "
+ << paperwidth << endl;
+ paperwidth.clear();
+ }
break;
}
if (token == "\\paperheight") {
lex >> paperheight;
+ if (!paperheight.empty() &&
!isValidLength(paperheight)) {
+ lyxerr << "Rejecting non-Length \\paperheight
value: "
+ << paperheight << endl;
+ paperheight.clear();
+ }
break;
}
if (token == "\\leftmargin") {
--
lyx-cvs mailing list
[email protected]
https://lists.lyx.org/mailman/listinfo/lyx-cvs
