[LyX/2.5.x] Hardening case 00k - file truncation via paperwidth/paperheight

commit eed2258a663c0aa46c12b31c717a9c8f01613182
Author: Pavel Sanda <[email protected]>
Date:   Tue Jun 16 16:43:40 2026 +0200

    Hardening case 00k - file truncation via paperwidth/paperheight
    
    \paperwidth and \paperheight flow raw into the DVI converter/viewer command;
    redirection is extracted there. That can lead to truncation of arbitrary file.
    
    Fires on DVI export/view.
    
    Tier 00 fix: reject invalid lengths at parse time (fail -> class default).
    
    Assisted-by: Claude Opus 4.7
---
 src/BufferParams.cpp | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/BufferParams.cpp b/src/BufferParams.cpp
index 05f5f149d0..d32262054d 100644
--- a/src/BufferParams.cpp
+++ b/src/BufferParams.cpp
@@ -1362,10 +1362,20 @@ string BufferParams::readToken(Lexer & lex, string const & token,
 		}
 		if (token == "\\paperwidth") {
 			lex >> paperwidth;
+			if (!paperwidth.empty() && !isValidLength(paperwidth)) {
+				lyxerr << "Rejecting non-Length \\paperwidth value: "
+				       << paperwidth << endl;
+				paperwidth.clear();
+			}
 			break;
 		}
 		if (token == "\\paperheight") {
 			lex >> paperheight;
+			if (!paperheight.empty() && !isValidLength(paperheight)) {
+				lyxerr << "Rejecting non-Length \\paperheight value: "
+				       << paperheight << endl;
+				paperheight.clear();
+			}
 			break;
 		}
 		if (token == "\\leftmargin") {
-- 
lyx-cvs mailing list
[email protected]
https://lists.lyx.org/mailman/listinfo/lyx-cvs