>From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Pavel Sanda Date: Tue, 16 Jun 2026 16:43:40 +0200 Subject: [PATCH] Hardening case 00k - file truncation via paperwidth/paperheight \paperwidth and \paperheight flow raw into the DVI converter/viewer command; redirection is extracted there. That can lead to truncation of arbitrary file. Fires on DVI export/view. Tier 00 fix: reject invalid lengths at parse time (fail -> class default). Assisted-by: Claude Opus 4.7 --- src/BufferParams.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/BufferParams.cpp b/src/BufferParams.cpp --- a/src/BufferParams.cpp +++ b/src/BufferParams.cpp @@ -1362,10 +1362,20 @@ void BufferParams::readToken(Lexer & lex, string const & token, } if (token == "\\paperwidth") { lex >> paperwidth; + if (!paperwidth.empty() && !isValidLength(paperwidth)) { + lyxerr << "Rejecting non-Length \\paperwidth value: " + << paperwidth << endl; + paperwidth.clear(); + } break; } if (token == "\\paperheight") { lex >> paperheight; + if (!paperheight.empty() && !isValidLength(paperheight)) { + lyxerr << "Rejecting non-Length \\paperheight value: " + << paperheight << endl; + paperheight.clear(); + } break; } if (token == "\\leftmargin") {