>From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Pavel Sanda <sanda () lyx org>
Date: Tue, 16 Jun 2026 16:43:40 +0200
Subject: [PATCH] Hardening case 00k - file truncation via paperwidth/paperheight

\paperwidth and \paperheight flow raw into the DVI converter/viewer command;
redirection is extracted there. That can lead to truncation of arbitrary file.

Fires on DVI export/view.

Tier 00 fix: reject invalid lengths at parse time (fail -> class default).

Assisted-by: Claude Opus 4.7
---
 src/BufferParams.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/BufferParams.cpp b/src/BufferParams.cpp
--- a/src/BufferParams.cpp
+++ b/src/BufferParams.cpp
@@ -1362,10 +1362,20 @@ void BufferParams::readToken(Lexer & lex, string const & token,
 		}
 		if (token == "\\paperwidth") {
 			lex >> paperwidth;
+			if (!paperwidth.empty() && !isValidLength(paperwidth)) {
+				lyxerr << "Rejecting non-Length \\paperwidth value: "
+				       << paperwidth << endl;
+				paperwidth.clear();
+			}
 			break;
 		}
 		if (token == "\\paperheight") {
 			lex >> paperheight;
+			if (!paperheight.empty() && !isValidLength(paperheight)) {
+				lyxerr << "Rejecting non-Length \\paperheight value: "
+				       << paperheight << endl;
+				paperheight.clear();
+			}
 			break;
 		}
 		if (token == "\\leftmargin") {