LaTeX: potentially critical low level TeX coding mistake has gone unnoticed so far

[jfbu]

Describe the bug
There is a low-level bug in sphinx.sty:

sphinx/sphinx/texinputs/sphinx.sty

Lines 746 to 750 in 804e46e

	% box scratch register
	\newdimen\spx@image@box
	\newcommand*{\sphinxsafeincludegraphics}[2][]{%
	% #1 contains possibly width=, height=, but no scale= since 1.8.4
	\setbox\spx@image@box\hbox{\includegraphics[#1,draft]{#2}}%

The \spx@image@box it supposed to stand for a box register, but it is defined as a dimension! (\newdimen).

It does not crash the PDF build, because internally when one uses such low-level TeX primitives, the control sequence \spx@image@box is in fact a number. So when one uses it via \setbox\spx@image@box... one will overwrite the contents of the box register with number the one indicated by \spx@image@box. This was a number assigned by \newdimen it should correspond to an available dimension register. It is here used for a box register.

Clearly this could lead to very strange results, very hard to debug, and perhaps has, because a box register gets used which perhaps is also used for other things. As nobody complained PDF output contained garbage there are two explanations:

• nobody checks PDF output (possibly not far from truth :))
• as many more \dimen registers are allocated than \box registers the used \box had such a high number no problem came out of it.

The bug was introduced at commit 669f9c3 (#5992) with Sphinx 2.0