commit 1aaf97e5a80834d1f77ec1d1418d3fbea413288b
Author: Pavel Sanda <[email protected]>
Date: Sun Nov 1 01:28:29 2026 +0100
Fix crash on a truncated quoted token in the lexer
The code assumes closing quote always exists in .lyx, which might not be
case
for malformed input. The trigger for the crash is a quoted token that ends
with an empty buffer at EOF. DoS only, no code execution.
Fix: guard the resize of buff so it is a no-op on an empty buffer. This is
a no-op on every well-formed input. The same unguarded pattern exists in
eatLine(), guarded there as well, although not currently reachable.
Tier 03 DoS / lexer: guard quoted-token resize against an empty buffer
https://www.mail-archive.com/[email protected]/msg227159.html
Assisted-by: Claude Opus 4.8
---
src/support/Lexer.cpp | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/support/Lexer.cpp b/src/support/Lexer.cpp
index 3b46e0bffb..50a0e289b3 100644
--- a/src/support/Lexer.cpp
+++ b/src/support/Lexer.cpp
@@ -352,7 +352,8 @@ bool Lexer::Pimpl::next(bool esc /* = false */)
++lineno;
}
- buff.resize(buff.size() - 1);
+ if (!buff.empty())
+ buff.resize(buff.size() - 1);
status = LEX_DATA;
break;
}
@@ -444,7 +445,8 @@ bool Lexer::Pimpl::eatLine()
if (c == '\n') {
++lineno;
- buff.resize(buff.size() - 1);
+ if (!buff.empty())
+ buff.resize(buff.size() - 1);
status = LEX_DATA;
return true;
} else if (buff.length() > 0) { // last line
--
lyx-cvs mailing list
[email protected]
https://lists.lyx.org/mailman/listinfo/lyx-cvs
