more bounds checking, error handling

CMakeLists.txt

@@ -14,7 +14,7 @@ add_library(antiword
         src/prop2.c src/prop6.c src/prop8.c src/properties.c src/propmod.c src/rowlist.c
         src/sectlist.c src/stylelist.c src/stylesheet.c src/summary.c src/tabstop.c
         src/text.c src/unix.c src/utf8.c src/word2text.c src/worddos.c src/wordlib.c
-        src/wordmac.c src/wordole.c src/wordwin.c src/xmalloc.c src/xml.c
+        src/wordmac.c src/wordole.c src/wordwin.c src/xmalloc.c src/xml.c src/sist2_hotfix.c
 )
 
 target_compile_options(
@@ -22,6 +22,7 @@ target_compile_options(
         PRIVATE
         -Wall
         -pedantic
-        -O2
+        -Ofast
+        -g
         -DNDEBUG
 )

src/antiword.h

@@ -249,6 +249,12 @@
 #define MAPPING_FILE_UTF_8	"UTF-8.txt"
 #endif /* __riscos */
 
+/* sist2 hotfixes */
+
+#define BUF_AUC 1
+extern void setBufferSize(ULONG size);
+extern BOOL isOutOfBounds(ULONG offset);
+
 /* Prototypes */
 
 /* asc85enc.c */
@@ -637,7 +643,7 @@ extern USHORT	usStc2istd(UCHAR);
 extern void	vGet2Stylesheet(FILE *, int, const UCHAR *);
 extern void	vGet6Stylesheet(FILE *, ULONG, const ULONG *, size_t,
 			const UCHAR *);
-extern void	vGet8Stylesheet(FILE *, const pps_info_type *,
+extern BOOL	vGet8Stylesheet(FILE *, const pps_info_type *,
 			const ULONG *, size_t, const ULONG *, size_t,
 			const UCHAR *);
 extern void	vFillStyleFromStylesheet(USHORT, style_block_type *);

src/asc85enc.c

@@ -61,8 +61,8 @@ vOutputByte(ULONG ulChar, FILE *pOutFile)
 void
 vASCII85EncodeByte(FILE *pOutFile, int iByte)
 {
-	static ULONG	ulBuffer[4] = { 0, 0, 0, 0 };
+	static __thread ULONG	ulBuffer[4] = { 0, 0, 0, 0 };
-	static int	iInBuffer = 0;
+	static __thread int	iInBuffer = 0;
 	ULONG	ulValue, ulTmp;
 	int	iIndex;
 

src/depot.c

@@ -51,7 +51,7 @@ bCreateSmallBlockList(ULONG ulStartblock, const ULONG *aulBBD, size_t tBBDLen)
 		if (ulTmp >= (ULONG)tBBDLen) {
 			DBG_DEC(ulTmp);
 			DBG_DEC(tBBDLen);
-			werr(1, "The Big Block Depot is damaged");
+			return FALSE;
 		}
 	}
 	DBG_DEC(tSmallBlockListLen);
@@ -72,7 +72,7 @@ bCreateSmallBlockList(ULONG ulStartblock, const ULONG *aulBBD, size_t tBBDLen)
 		if (ulTmp >= (ULONG)tBBDLen) {
 			DBG_DEC(ulTmp);
 			DBG_DEC(tBBDLen);
-			werr(1, "The Big Block Depot is damaged");
+            return FALSE;
 		}
 		aulSmallBlockList[iIndex] = ulTmp;
 		NO_DBG_DEC(aulSmallBlockList[iIndex]);

src/draw.h

@@ -1,46 +0,0 @@
-/*
- * draw.h
- * Copyright (C) 2001 A.J. van Os; Released under GPL
- *
- * Description:
- * Constants and macros to deal with the Draw format
- */
-
-#if !defined(__draw_h)
-#define __draw_h 1
-
-#include "drawftypes.h"
-
-typedef struct draw_jpegstrhdr_tag {
-	draw_tagtyp	tag;	/* 1 word  */
-	draw_sizetyp	size;	/* 1 word  */
-	draw_bboxtyp	bbox;	/* 4 words */
-	int	width;		/* 1 word  */
-	int	height;		/* 1 word  */
-	int	xdpi;		/* 1 word  */
-	int	ydpi;		/* 1 word  */
-	int	trfm[6];	/* 6 words */
-	int	len;		/* 1 word  */
-} draw_jpegstrhdr;
-
-typedef struct draw_jpegstr_tag {
-	draw_tagtyp	tag;	/* 1 word  */
-	draw_sizetyp	size;	/* 1 word  */
-	draw_bboxtyp	bbox;	/* 4 words */
-	int	width;		/* 1 word  */
-	int	height;		/* 1 word  */
-	int	xdpi;		/* 1 word  */
-	int	ydpi;		/* 1 word  */
-	int	trfm[6];	/* 6 words */
-	int	len;		/* 1 word  */
-	unsigned char	*jpeg;
-} draw_jpegstr;
-
-typedef union draw_imageType_tag {
-	draw_spristr	*sprite;
-	draw_jpegstr	*jpeg;
-	char		*bytep;
-	int		*wordp;
-} draw_imageType;
-
-#endif /* !__draw_h */

src/findtext.c

@@ -50,7 +50,7 @@ bAddTextBlocks(ULONG ulCharPosFirst, ULONG ulTotalLength,
 		if (ulIndex >= (ULONG)tBBDLen) {
 			DBG_DEC(ulIndex);
 			DBG_DEC(tBBDLen);
-			werr(1, "The Big Block Depot is damaged");
+			return FALSE;
 		}
 		if (ulOffset >= BIG_BLOCK_SIZE) {
 			ulOffset -= BIG_BLOCK_SIZE;
@@ -108,6 +108,7 @@ bGet6DocumentText(FILE *pFile, BOOL bUsesUnicode, ULONG ulStartBlock,
 	DBG_DEC(tTextInfoLen);
 
 	aucBuffer = xmalloc(tTextInfoLen);
+	setBufferSize(tTextInfoLen);
 	if (!bReadBuffer(pFile, ulStartBlock,
 			aulBBD, tBBDLen, BIG_BLOCK_SIZE,
 			aucBuffer, ulBeginTextInfo, tTextInfoLen)) {
@@ -218,6 +219,7 @@ bGet8DocumentText(FILE *pFile, const pps_info_type *pPPS,
 		tBlockSize = BIG_BLOCK_SIZE;
 	}
 	aucBuffer = xmalloc(tTextInfoLen);
+	setBufferSize(tTextInfoLen);
 	if (!bReadBuffer(pFile, pPPS->tTable.ulSB,
 			aulBlockDepot, tBlockDepotLen, tBlockSize,
 			aucBuffer, ulBeginTextInfo, tTextInfoLen)) {
@@ -256,6 +258,9 @@ bGet8DocumentText(FILE *pFile, const pps_info_type *pPPS,
 		lPieces = (long)((ulLen - 4) / 12);
 		DBG_DEC(lPieces);
 		for (lIndex = 0; lIndex < lPieces; lIndex++) {
+		    if (lOff + (lPieces + 1) * 4 + lIndex * 8 + 6 > tTextInfoLen) {
+		        return FALSE;
+		    }
 			ulTextOffset = ulGetLong(
 				lOff + (lPieces + 1) * 4 + lIndex * 8 + 2,
 				aucBuffer);

src/icons.c

@@ -1,96 +0,0 @@
-/*
- * icons.c
- * Copyright (C) 1998-2001 A.J. van Os; Released under GPL
- *
- * Description:
- * Update window icons
- */
-
-#include <string.h>
-#include "DeskLib:Error.h"
-#include "DeskLib:WimpSWIs.h"
-#include "antiword.h"
-
-void
-vUpdateIcon(window_handle tWindow, icon_block *pIcon)
-{
-	window_redrawblock	tRedraw;
-	BOOL		bMore;
-
-	tRedraw.window = tWindow;
-	tRedraw.rect = pIcon->workarearect;
-	Error_CheckFatal(Wimp_UpdateWindow(&tRedraw, &bMore));
-	while (bMore) {
-		Error_CheckFatal(Wimp_PlotIcon(pIcon));
-		Error_CheckFatal(Wimp_GetRectangle(&tRedraw, &bMore));
-	}
-} /* end of vUpdateIcon */
-
-void
-vUpdateRadioButton(window_handle tWindow, icon_handle tIconNumber,
-	BOOL bSelected)
-{
-	icon_block	tIcon;
-
-	Error_CheckFatal(Wimp_GetIconState(tWindow, tIconNumber, &tIcon));
-	DBG_DEC(tIconNumber);
-	DBG_HEX(tIcon.flags.data.selected);
-	if (bSelected == (tIcon.flags.data.selected == 1)) {
-		/* No update needed */
-		return;
-	}
-	Error_CheckFatal(Wimp_SetIconState(tWindow, tIconNumber,
-			bSelected ? 0x00200000 : 0, 0x00200000));
-	vUpdateIcon(tWindow, &tIcon);
-} /* end of vUpdateRadioButton */
-
-/*
- * vUpdateWriteable - update a writeable icon with a string
- */
-void
-vUpdateWriteable(window_handle tWindow, icon_handle tIconNumber,
-	const char *szString)
-{
-	icon_block	tIcon;
-	caret_block	tCaret;
-	int		iLen;
-
-	fail(szString == NULL);
-
-	NO_DBG_DEC(tIconNumber);
-	NO_DBG_MSG(szString);
-
-	Error_CheckFatal(Wimp_GetIconState(tWindow, tIconNumber, &tIcon));
-	NO_DBG_HEX(tIcon.flags);
-	if (!tIcon.flags.data.text || !tIcon.flags.data.indirected) {
-		werr(1, "Icon %d must be indirected text", (int)tIconNumber);
-		return;
-	}
-	strncpy(tIcon.data.indirecttext.buffer,
-		szString,
-		tIcon.data.indirecttext.bufflen - 1);
-	/* Ensure the caret is behind the last character of the text */
-	Error_CheckFatal(Wimp_GetCaretPosition(&tCaret));
-	if (tCaret.window == tWindow && tCaret.icon == tIconNumber) {
-		iLen = strlen(tIcon.data.indirecttext.buffer);
-		if (tCaret.index != iLen) {
-			tCaret.index = iLen;
-			Error_CheckFatal(Wimp_SetCaretPosition(&tCaret));
-		}
-	}
-	Error_CheckFatal(Wimp_SetIconState(tWindow, tIconNumber, 0, 0));
-	vUpdateIcon(tWindow, &tIcon);
-} /* end of vUpdateWriteable */
-
-/*
- * vUpdateWriteableNumber - update a writeable icon with a number
- */
-void
-vUpdateWriteableNumber(window_handle tWindow, icon_handle tIconNumber,
-	int iNumber)
-{
-	char	szTmp[1+3*sizeof(int)+1];
-
-	(void)sprintf(szTmp, "%d", iNumber);
-	vUpdateWriteable(tWindow, tIconNumber, szTmp);
-} /* end of vUpdateWriteableNumber */

src/main_ros.c

@@ -1,520 +0,0 @@
-/*
- * main_ros.c
- *
- * Released under GPL
- *
- * Copyright (C) 1998-2005 A.J. van Os
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
- *
- * Description:
- * The main program of !Antiword (RISC OS version)
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include "DeskLib:Dialog2.h"
-#include "DeskLib:Error.h"
-#include "DeskLib:Event.h"
-#include "DeskLib:EventMsg.h"
-#include "DeskLib:Handler.h"
-#include "DeskLib:Menu.h"
-#include "DeskLib:Resource.h"
-#include "DeskLib:Screen.h"
-#include "DeskLib:Template.h"
-#include "DeskLib:Window.h"
-#if defined(__GNUC__)
-#include "flexlib:flex.h"
-#endif /* __GNUC__ */
-#include "version.h"
-#include "antiword.h"
-
-
-/* The name of this program */
-static char	*szTask = "!Antiword";
-
-/* The window handle of the choices window */
-static __thread window_handle	tChoicesWindow = 0;
-
-/* Dummy diagram with the iconbar menu pointer */
-static __thread diagram_type	tDummyDiagram;
-
-/* Program information Box */
-static __thread dialog2_block	*pInfoBox = NULL;
-
-/* Info box fields */
-#define PURPOSE_INFO_FIELD	2
-#define AUTHOR_INFO_FIELD	3
-#define VERSION_INFO_FIELD	4
-#define STATUS_INFO_FIELD	5
-
-/* Iconbar menu fields */
-#define ICONBAR_INFO_FIELD	0
-#define ICONBAR_CHOICES_FIELD	1
-#define ICONBAR_QUIT_FIELD	2
-
-
-/*
- * bBarInfo - Show iconbar information
- */
-static BOOL
-bBarInfo(event_pollblock *pEvent, void *pvReference)
-{
-	diagram_type	*pDiag;
-
-	TRACE_MSG("bBarInfo");
-
-	fail(pEvent == NULL);
-	fail(pEvent->type != event_SEND);
-	fail(pEvent->data.message.header.action != message_MENUWARN);
-	fail(pvReference == NULL);
-
-	pDiag = (diagram_type *)pvReference;
-
-	if (menu_currentopen != pDiag->pSaveMenu ||
-	    pEvent->data.message.data.menuwarn.selection[0] != ICONBAR_INFO_FIELD) {
-		return FALSE;
-	}
-
-	Dialog2_OpenDialogMenuLeaf(pEvent, pInfoBox);
-	return TRUE;
-} /* end of bBarInfo */
-
-/*
- * vBarInfoSetText - Set the iconbar infobox text
- */
-static void
-vBarInfoSetText(dialog2_block *pBox)
-{
-	TRACE_MSG("vBarInfoSetText");
-
-	fail(pBox == NULL);
-	fail(pBox != pInfoBox);
-
-	Icon_SetText(pBox->window, PURPOSE_INFO_FIELD, PURPOSESTRING);
-	Icon_SetText(pBox->window, AUTHOR_INFO_FIELD, AUTHORSTRING);
-	Icon_SetText(pBox->window, VERSION_INFO_FIELD, VERSIONSTRING);
-	Icon_SetText(pBox->window, STATUS_INFO_FIELD, STATUSSTRING);
-} /* end of vBarInfoSetText */
-
-/*
- * bMouseButtonClick - respond to mouse button click
- */
-static BOOL
-bMouseButtonClick(event_pollblock *pEvent, void *pvReference)
-{
-	diagram_type	*pDiag;
-	menu_ptr	pMenu;
-	int		iPosY;
-
-	TRACE_MSG("bMouseButtonClick");
-
-	fail(pEvent == NULL);
-	fail(pEvent->type != event_CLICK);
-	fail(pvReference == NULL);
-
-	pDiag = (diagram_type *)pvReference;
-
-	if (pEvent->data.mouse.button.data.menu) {
-		pMenu = pDiag->pSaveMenu;
-		iPosY = (pMenu == tDummyDiagram.pSaveMenu) ?
-					-1 : pEvent->data.mouse.pos.y;
-		Menu_Show(pMenu, pEvent->data.mouse.pos.x, iPosY);
-		return TRUE;
-	}
-	if (pEvent->data.mouse.window == pDiag->tMainWindow &&
-	    pEvent->data.mouse.icon == -1) {
-		vMainButtonClick(&pEvent->data.mouse);
-		return TRUE;
-	}
-	if (pEvent->data.mouse.window == pDiag->tScaleWindow &&
-	    pEvent->data.mouse.icon >= 0) {
-		vScaleButtonClick(&pEvent->data.mouse, pDiag);
-		return TRUE;
-	}
-	return FALSE;
-} /* end of bMouseButtonClick */
-
-/*
- * bAutoRedrawWindow - the redraw is handled by the WIMP
- */
-static BOOL
-bAutoRedrawWindow(event_pollblock *pEvent, void *pvReference)
-{
-	return TRUE;
-} /* end of bAutoRedrawWindow */
-
-static BOOL
-bSaveSelect(event_pollblock *pEvent, void *pvReference)
-{
-	TRACE_MSG("bSaveSelect");
-
-	fail(pEvent == NULL);
-	fail(pEvent->type != event_MENU);
-	fail(pvReference == NULL);
-
-	DBG_DEC(pEvent->data.selection[0]);
-
-	switch (pEvent->data.selection[0]) {
-	case SAVEMENU_SCALEVIEW:
-		return bScaleOpenAction(pEvent, pvReference);
-	case SAVEMENU_SAVEDRAW:
-		return bSaveDrawfile(pEvent, pvReference);
-	case SAVEMENU_SAVETEXT:
-		return bSaveTextfile(pEvent, pvReference);
-	default:
-		DBG_DEC(pEvent->data.selection[0]);
-		return FALSE;
-	}
-} /* end of bSaveSelect */
-
-/*
- * Create the window for the text from the given file
- */
-static diagram_type *
-pCreateTextWindow(const char *szFilename)
-{
-	diagram_type	*pDiag;
-
-	TRACE_MSG("pCreateTextWindow");
-
-	fail(szFilename == NULL || szFilename[0] == '\0');
-
-	/* Create the diagram */
-	pDiag = pCreateDiagram(szTask+1, szFilename);
-	if (pDiag == NULL) {
-		werr(0, "Sorry, no new diagram object");
-		return NULL;
-	}
-
-	/* Prepare a save menu for this diagram */
-	pDiag->pSaveMenu = Menu_New(szTask+1,
-		">Scale view,"
-		">Save (Drawfile)   F3,"
-		">Save (Text only) \213F3");
-	if (pDiag->pSaveMenu == NULL) {
-		werr(1, "Sorry, no Savemenu object");
-	}
-	Menu_Warn(pDiag->pSaveMenu, SAVEMENU_SCALEVIEW,
-					TRUE, bScaleOpenAction, pDiag);
-	Menu_Warn(pDiag->pSaveMenu, SAVEMENU_SAVEDRAW,
-					TRUE, bSaveDrawfile, pDiag);
-	Menu_Warn(pDiag->pSaveMenu, SAVEMENU_SAVETEXT,
-					TRUE, bSaveTextfile, pDiag);
-
-	/* Claim events for the main window */
-        Event_Claim(event_REDRAW, pDiag->tMainWindow, icon_ANY,
-                                        bRedrawMainWindow, pDiag);
-        Event_Claim(event_CLOSE, pDiag->tMainWindow, icon_ANY,
-                                        bDestroyDiagram, pDiag);
-        Event_Claim(event_CLICK, pDiag->tMainWindow, icon_ANY,
-                                        bMouseButtonClick, pDiag);
-        Event_Claim(event_KEY, pDiag->tMainWindow, icon_ANY,
-                                        bMainKeyPressed, pDiag);
-
-	/* Claim events for the scale window */
-	Event_Claim(event_REDRAW, pDiag->tScaleWindow, icon_ANY,
-					bAutoRedrawWindow, NULL);
-        Event_Claim(event_CLICK, pDiag->tScaleWindow, icon_ANY,
-                                        bMouseButtonClick, pDiag);
-        Event_Claim(event_KEY, pDiag->tScaleWindow, icon_ANY,
-                                        bScaleKeyPressed, pDiag);
-
-	/* Set the window title */
-	vSetTitle(pDiag);
-	return pDiag;
-} /* end of pCreateTextWindow */
-
-/*
- * vProcessFile - process one file
- */
-static void
-vProcessFile(const char *szFilename, int iFiletype)
-{
-	options_type	tOptions;
-	FILE		*pFile;
-	diagram_type	*pDiag;
-	long		lFilesize;
-	int		iWordVersion;
-
-	TRACE_MSG("vProcessFile");
-
-	fail(szFilename == NULL || szFilename[0] == '\0');
-
-	DBG_MSG(szFilename);
-
-	pFile = fopen(szFilename, "rb");
-	if (pFile == NULL) {
-		werr(0, "I can't open '%s' for reading", szFilename);
-		return;
-	}
-
-	lFilesize = lGetFilesize(szFilename);
-	if (lFilesize < 0) {
-		(void)fclose(pFile);
-		werr(0, "I can't get the size of '%s'", szFilename);
-		return;
-	}
-
-	iWordVersion = iGuessVersionNumber(pFile, lFilesize);
-	if (iWordVersion < 0 || iWordVersion == 3) {
-		if (bIsRtfFile(pFile)) {
-			werr(0, "%s is not a Word Document."
-				" It is probably a Rich Text Format file",
-				szFilename);
-		} if (bIsWordPerfectFile(pFile)) {
-			werr(0, "%s is not a Word Document."
-				" It is probably a Word Perfect file",
-				szFilename);
-		} else {
-			werr(0, "%s is not a Word Document.", szFilename);
-		}
-		(void)fclose(pFile);
-		return;
-	}
-	/* Reset any reading done during file-testing */
-	rewind(pFile);
-
-	if (iFiletype != FILETYPE_MSWORD) {
-		vGetOptions(&tOptions);
-		if (tOptions.bAutofiletypeAllowed) {
-			vSetFiletype(szFilename, FILETYPE_MSWORD);
-		}
-	}
-
-	pDiag = pCreateTextWindow(szFilename);
-	if (pDiag == NULL) {
-		(void)fclose(pFile);
-		return;
-	}
-
-	(void)bWordDecryptor(pFile, lFilesize, pDiag);
-	Error_CheckFatal(Drawfile_VerifyDiagram(&pDiag->tInfo));
-	vShowDiagram(pDiag);
-	TRACE_MSG("After vShowDiagram");
-
-	TRACE_MSG("before debug print");
-	DBG_HEX(pFile);
-	TRACE_MSG("before fclose");
-	(void)fclose(pFile);
-	TRACE_MSG("after fclose");
-} /* end of vProcessFile */
-
-/*
- * vSendAck - send an acknowledge
- */
-static void
-vSendAck(event_pollblock *pEvent)
-{
-	message_block	tMessage;
-
-	TRACE_MSG("vSendAck");
-
-	fail(pEvent == NULL);
-	fail(pEvent->type != event_SEND && pEvent->type != event_SENDWANTACK);
-	fail(pEvent->data.message.header.action != message_DATALOAD &&
-		pEvent->data.message.header.action != message_DATAOPEN);
-
-	tMessage.header.action = message_DATALOADACK;
-	tMessage.header.size = sizeof(tMessage);
-	tMessage.header.yourref = pEvent->data.message.header.myref;
-	Error_CheckFatal(Wimp_SendMessage(event_SEND, &tMessage,
-				pEvent->data.message.header.sender, 0));
-} /* end of vSendAck */
-
-static BOOL
-bEventMsgHandler(event_pollblock *pEvent, void *pvReference)
-{
-	TRACE_MSG("bEventMsgHandler");
-
-	fail(pEvent == NULL);
-
-	switch (pEvent->type) {
-	case event_SEND:
-	case event_SENDWANTACK:
-		switch (pEvent->data.message.header.action) {
-		case message_CLOSEDOWN:
-			exit(EXIT_SUCCESS);
-			break;
-		case message_DATALOAD:
-		case message_DATAOPEN:
-			vProcessFile(
-				pEvent->data.message.data.dataload.filename,
-				pEvent->data.message.data.dataload.filetype);
-			vSendAck(pEvent);
-			break;
-		default:
-			DBG_DEC(pEvent->data.message.header.action);
-			break;
-		}
-		return TRUE;
-	default:
-		DBG_DEC(pEvent->type);
-		return FALSE;
-	}
-} /* end of bEventMsgHandler */
-
-/*
- * bMenuSelect - select from the iconbar menu
- */
-static BOOL
-bMenuSelect(event_pollblock *pEvent, void *pvReference)
-{
-	TRACE_MSG("bMenuSelect");
-
-	fail(pEvent == NULL);
-	fail(pEvent->type != event_MENU);
-
-	DBG_DEC(pEvent->data.selection[0]);
-
-	switch (pEvent->data.selection[0]) {
-	case ICONBAR_INFO_FIELD:
-		return bBarInfo(pEvent, pvReference);
-	case ICONBAR_CHOICES_FIELD:
-		vChoicesOpenAction(tChoicesWindow);
-		Window_BringToFront(tChoicesWindow);
-		break;
-	case ICONBAR_QUIT_FIELD:
-		TRACE_MSG("before exit");
-		exit(EXIT_SUCCESS);
-		break;
-	default:
-		DBG_DEC(pEvent->data.selection[0]);
-		break;
-	}
-	return TRUE;
-} /* end of bMenuSelect */
-
-/*
- * bMenuClick - respond to an menu click
- */
-static BOOL
-bMenuClick(event_pollblock *pEvent, void *pvReference)
-{
-	TRACE_MSG("bMenuClick");
-
-	fail(pEvent == NULL);
-	fail(pEvent->type != event_MENU);
-
-	if (menu_currentopen == tDummyDiagram.pSaveMenu) {
-		return bMenuSelect(pEvent, pvReference);
-	} else if (pvReference == NULL) {
-		return FALSE;
-	}
-	return bSaveSelect(pEvent, pvReference);
-} /* end of bMenuClick */
-
-static void
-vTemplates(void)
-{
-	TRACE_MSG("vTemplates");
-
-	Template_Initialise();
-	Template_LoadFile("Templates");
-
-	tChoicesWindow = Window_Create("Choices", template_TITLEMIN);
-	if (tChoicesWindow == 0) {
-		werr(1, "I can't find the 'Choices' template");
-	}
-
-	/* Claim events for the choices window */
-	Event_Claim(event_REDRAW, tChoicesWindow, icon_ANY,
-					bAutoRedrawWindow, NULL);
-	Event_Claim(event_CLICK, tChoicesWindow, icon_ANY,
-					bChoicesMouseClick, NULL);
-	Event_Claim(event_KEY, tChoicesWindow, icon_ANY,
-					bChoicesKeyPressed, NULL);
-} /* end of vTemplates */
-
-static void
-vInitialise(void)
-{
-	int	aiMessages[] = {0};
-	icon_handle	tBarIcon;
-
-
-	TRACE_MSG("vInitialise");
-
-	Resource_Initialise(szTask+1);
-	Event_Initialise3(szTask+1, 310, aiMessages);
-	EventMsg_Initialise();
-	Screen_CacheModeInfo();
-#if defined(__GNUC__)
-	flex_init(szTask+1, 0, 0);
-	flex_set_budge(1);
-#endif /* __GNUC__ */
-	vTemplates();
-
-	/* Prepare iconbar menu */
-	tDummyDiagram.tInfo.data = NULL;
-	tDummyDiagram.tInfo.length = 0;
-	tDummyDiagram.pSaveMenu = Menu_New(szTask+1, ">Info,Choices...,Quit");
-	if (tDummyDiagram.pSaveMenu == NULL) {
-		werr(1, "Sorry, no Barmenu object");
-	}
-	pInfoBox = Dialog2_CreateDialogBlock("ProgInfo", -1, -1,
-					vBarInfoSetText, NULL, NULL);
-
-	if (pInfoBox == NULL) {
-		werr(1, "Sorry, no Infobox object");
-	}
-	Menu_Warn(tDummyDiagram.pSaveMenu, ICONBAR_INFO_FIELD,
-					TRUE, bBarInfo, &tDummyDiagram);
-
-	/* Create an icon on the icon bar */
-	tBarIcon = Icon_BarIcon(szTask, iconbar_RIGHT);
-	Event_Claim(event_CLICK, window_ICONBAR, tBarIcon,
-					bMouseButtonClick, &tDummyDiagram);
-
-	/* Generic claims */
-	Event_Claim(event_OPEN, window_ANY, icon_ANY,
-					Handler_OpenWindow, NULL);
-	Event_Claim(event_CLOSE, window_ANY, icon_ANY,
-					Handler_CloseWindow, NULL);
-	Event_Claim(event_MENU, window_ANY, icon_ANY,
-					bMenuClick, NULL);
-	EventMsg_Claim(message_DATALOAD, window_ICONBAR,
-					bEventMsgHandler, NULL);
-	EventMsg_Claim(message_MODECHANGE, window_ANY,
-					Handler_ModeChange, NULL);
-} /* end of vInitialise */
-
-int
-main(int argc, char **argv)
-{
-	int	iFirst, iFiletype;
-
-	TRACE_MSG("main");
-
-	vInitialise();
-	iFirst = iReadOptions(argc, argv);
-	if (iFirst != 1) {
-		return EXIT_FAILURE;
-	}
-
-	if (argc > 1) {
-		iFiletype = iGetFiletype(argv[1]);
-		if (iFiletype < 0) {
-			return EXIT_FAILURE;
-		}
-		vProcessFile(argv[1], iFiletype);
-		TRACE_MSG("main after vProcessFile");
-	}
-
-	for (;;) {
-		Event_Poll();
-	}
-} /* end of main */

src/main_u.c

@@ -1,321 +0,0 @@
-/*
- * main_u.c
- *
- * Released under GPL
- *
- * Copyright (C) 1998-2004 A.J. van Os
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
- *
- * Description:
- * The main program of 'antiword' (Unix version)
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#if defined(__dos)
-#include <fcntl.h>
-#include <io.h>
-#endif /* __dos */
-#if defined(__CYGWIN__) || defined(__CYGMING__)
-#  ifdef X_LOCALE
-#    include <X11/Xlocale.h>
-#  else
-#    include <locale.h>
-#  endif
-#else
-#include <locale.h>
-#endif /* __CYGWIN__ || __CYGMING__ */
-#if defined(N_PLAT_NLM)
-#if !defined(_VA_LIST)
-#include "NW-only/nw_os.h"
-#endif /* !_VA_LIST */
-#include "getopt.h"
-#endif /* N_PLAT_NLM */
-#include "version.h"
-#include "antiword.h"
-
-/* The name of this program */
-static const char	*szTask = NULL;
-
-
-static void
-vUsage(void)
-{
-	fprintf(stderr, "\tName: %s\n", szTask);
-	fprintf(stderr, "\tPurpose: "PURPOSESTRING"\n");
-	fprintf(stderr, "\tAuthor: "AUTHORSTRING"\n");
-	fprintf(stderr, "\tVersion: "VERSIONSTRING);
-#if defined(__dos)
-	fprintf(stderr, VERSIONSTRING2);
-#endif /* __dos */
-	fprintf(stderr, "\n");
-	fprintf(stderr, "\tStatus: "STATUSSTRING"\n");
-	fprintf(stderr,
-		"\tUsage: %s [switches] wordfile1 [wordfile2 ...]\n", szTask);
-	fprintf(stderr,
-		"\tSwitches: [-f|-t|-a papersize|-p papersize|-x dtd]"
-		"[-m mapping][-w #][-i #][-Ls]\n");
-	fprintf(stderr, "\t\t-f formatted text output\n");
-	fprintf(stderr, "\t\t-t text output (default)\n");
-	fprintf(stderr, "\t\t-a <paper size name> Adobe PDF output\n");
-	fprintf(stderr, "\t\t-p <paper size name> PostScript output\n");
-	fprintf(stderr, "\t\t   paper size like: a4, letter or legal\n");
-	fprintf(stderr, "\t\t-x <dtd> XML output\n");
-	fprintf(stderr, "\t\t   like: db (DocBook)\n");
-	fprintf(stderr, "\t\t-m <mapping> character mapping file\n");
-	fprintf(stderr, "\t\t-w <width> in characters of text output\n");
-	fprintf(stderr, "\t\t-i <level> image level (PostScript only)\n");
-	fprintf(stderr, "\t\t-L use landscape mode (PostScript only)\n");
-	fprintf(stderr, "\t\t-r Show removed text\n");
-	fprintf(stderr, "\t\t-s Show hidden (by Word) text\n");
-} /* end of vUsage */
-
-/*
- * pStdin2TmpFile - save stdin in a temporary file
- *
- * returns: the pointer to the temporary file or NULL
- */
-static FILE *
-pStdin2TmpFile(long *lFilesize)
-{
-	FILE	*pTmpFile;
-	size_t	tSize;
-	BOOL	bFailure;
-	UCHAR	aucBytes[BUFSIZ];
-
-	DBG_MSG("pStdin2TmpFile");
-
-	fail(lFilesize == NULL);
-
-	/* Open the temporary file */
-	pTmpFile = tmpfile();
-	if (pTmpFile == NULL) {
-		return NULL;
-	}
-
-#if defined(__dos)
-	/* Stdin must be read as a binary stream */
-	setmode(fileno(stdin), O_BINARY);
-#endif /* __dos */
-
-	/* Copy stdin to the temporary file */
-	*lFilesize = 0;
-	bFailure = TRUE;
-	for (;;) {
-		tSize = fread(aucBytes, 1, sizeof(aucBytes), stdin);
-		if (tSize == 0) {
-			bFailure = feof(stdin) == 0;
-			break;
-		}
-		if (fwrite(aucBytes, 1, tSize, pTmpFile) != tSize) {
-			bFailure = TRUE;
-			break;
-		}
-		*lFilesize += (long)tSize;
-	}
-
-#if defined(__dos)
-	/* Switch stdin back to a text stream */
-	setmode(fileno(stdin), O_TEXT);
-#endif /* __dos */
-
-	/* Deal with the result of the copy action */
-	if (bFailure) {
-		*lFilesize = 0;
-		(void)fclose(pTmpFile);
-		return NULL;
-	}
-	rewind(pTmpFile);
-	return pTmpFile;
-} /* end of pStdin2TmpFile */
-
-/*
- * bProcessFile - process a single file
- *
- * returns: TRUE when the given file is a supported Word file, otherwise FALSE
- */
-static BOOL
-bProcessFile(const char *szFilename)
-{
-	FILE		*pFile;
-	diagram_type	*pDiag;
-	long		lFilesize;
-	int		iWordVersion;
-	BOOL		bResult;
-
-	fail(szFilename == NULL || szFilename[0] == '\0');
-
-	DBG_MSG(szFilename);
-
-	if (szFilename[0] == '-' && szFilename[1] == '\0') {
-		pFile = pStdin2TmpFile(&lFilesize);
-		if (pFile == NULL) {
-			werr(0, "I can't save the standard input to a file");
-			return FALSE;
-		}
-	} else {
-		pFile = fopen(szFilename, "rb");
-		if (pFile == NULL) {
-			werr(0, "I can't open '%s' for reading", szFilename);
-			return FALSE;
-		}
-
-		lFilesize = lGetFilesize(szFilename);
-		if (lFilesize < 0) {
-			(void)fclose(pFile);
-			werr(0, "I can't get the size of '%s'", szFilename);
-			return FALSE;
-		}
-	}
-
-	iWordVersion = iGuessVersionNumber(pFile, lFilesize);
-	if (iWordVersion < 0 || iWordVersion == 3) {
-		if (bIsRtfFile(pFile)) {
-			werr(0, "%s is not a Word Document."
-				" It is probably a Rich Text Format file",
-				szFilename);
-		} if (bIsWordPerfectFile(pFile)) {
-			werr(0, "%s is not a Word Document."
-				" It is probably a Word Perfect file",
-				szFilename);
-		} else {
-#if defined(__dos)
-			werr(0, "%s is not a Word Document or the filename"
-				" is not in the 8+3 format.", szFilename);
-#else
-			werr(0, "%s is not a Word Document.", szFilename);
-#endif /* __dos */
-		}
-		(void)fclose(pFile);
-		return FALSE;
-	}
-	/* Reset any reading done during file testing */
-	rewind(pFile);
-
-	pDiag = pCreateDiagram(szTask, szFilename);
-	if (pDiag == NULL) {
-		(void)fclose(pFile);
-		return FALSE;
-	}
-
-	bResult = bWordDecryptor(pFile, lFilesize, pDiag);
-	vDestroyDiagram(pDiag);
-
-	(void)fclose(pFile);
-	return bResult;
-} /* end of bProcessFile */
-
-int
-main(int argc, char **argv)
-{
-	options_type	tOptions;
-	const char	*szWordfile;
-	int	iFirst, iIndex, iGoodCount;
-	BOOL	bUsage, bMultiple, bUseTXT, bUseXML;
-
-	if (argc <= 0) {
-		return EXIT_FAILURE;
-	}
-
-	szTask = szBasename(argv[0]);
-
-	if (argc <= 1) {
-		iFirst = 1;
-		bUsage = TRUE;
-	} else {
-		iFirst = iReadOptions(argc, argv);
-		bUsage = iFirst <= 0;
-	}
-	if (bUsage) {
-		vUsage();
-		return iFirst < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
-	}
-
-#if defined(N_PLAT_NLM) && !defined(_VA_LIST)
-	nwinit();
-#endif /* N_PLAT_NLM && !_VA_LIST */
-
-	vGetOptions(&tOptions);
-
-#if !defined(__dos)
-	if (is_locale_utf8()) {
-#if defined(__STDC_ISO_10646__)
-		/*
-		 * If the user wants UTF-8 and the envirionment variables
-		 * support UTF-8, than set the locale accordingly
-		 */
-		if (tOptions.eEncoding == encoding_utf_8) {
-			if (setlocale(LC_CTYPE, "") == NULL) {
-				werr(1, "Can't set the UTF-8 locale! "
-					"Check LANG, LC_CTYPE, LC_ALL.");
-			}
-			DBG_MSG("The UTF-8 locale has been set");
-		} else {
-			(void)setlocale(LC_CTYPE, "C");
-		}
-#endif /* __STDC_ISO_10646__ */
-	} else {
-		if (setlocale(LC_CTYPE, "") == NULL) {
-			werr(0, "Can't set the locale! Will use defaults");
-			(void)setlocale(LC_CTYPE, "C");
-		}
-		DBG_MSG("The locale has been set");
-	}
-#endif /* !__dos */
-
-	bMultiple = argc - iFirst > 1;
-	bUseTXT = tOptions.eConversionType == conversion_text ||
-		tOptions.eConversionType == conversion_fmt_text;
-	bUseXML = tOptions.eConversionType == conversion_xml;
-	iGoodCount = 0;
-
-#if defined(__dos)
-	if (tOptions.eConversionType == conversion_pdf) {
-		/* PDF must be written as a binary stream */
-		setmode(fileno(stdout), O_BINARY);
-	}
-#endif /* __dos */
-
-	if (bUseXML) {
-		fprintf(stdout,
-	"<?xml version=\"1.0\" encoding=\"utf-8\"?>\n"
-	"<!DOCTYPE %s PUBLIC \"-//OASIS//DTD DocBook XML V4.1.2//EN\"\n"
-	"\t\"http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd\">\n",
-		bMultiple ? "set" : "book");
-		if (bMultiple) {
-			fprintf(stdout, "<set>\n");
-		}
-	}
-
-	for (iIndex = iFirst; iIndex < argc; iIndex++) {
-		if (bMultiple && bUseTXT) {
-			szWordfile = szBasename(argv[iIndex]);
-			fprintf(stdout, "::::::::::::::\n");
-			fprintf(stdout, "%s\n", szWordfile);
-			fprintf(stdout, "::::::::::::::\n");
-		}
-		if (bProcessFile(argv[iIndex])) {
-			iGoodCount++;
-		}
-	}
-
-	if (bMultiple && bUseXML) {
-		fprintf(stdout, "</set>\n");
-	}
-
-	DBG_DEC(iGoodCount);
-	return iGoodCount <= 0 ? EXIT_FAILURE : EXIT_SUCCESS;
-} /* end of main */

src/misc.c

@@ -224,11 +224,12 @@ bReadBuffer(FILE *pFile, ULONG ulStartBlock,
 		if (ulIndex >= (ULONG)tBlockDepotLen) {
 			DBG_DEC(ulIndex);
 			DBG_DEC(tBlockDepotLen);
-			if (tBlockSize >= BIG_BLOCK_SIZE) {
+//			if (tBlockSize >= BIG_BLOCK_SIZE) {
-				werr(1, "The Big Block Depot is damaged");
+//				werr(1, "The Big Block Depot is damaged");
-			} else {
+//			} else {
-				werr(1, "The Small Block Depot is damaged");
+//				werr(1, "The Small Block Depot is damaged");
-			}
+//			}
+			return FALSE;
 		}
 		if (ulOffset >= (ULONG)tBlockSize) {
 			ulOffset -= tBlockSize;

src/prop6.c

@@ -410,7 +410,7 @@ eGet6RowInfo(int iFodo,
 			}
 			if (iCol >= (int)elementsof(pRow->asColumnWidth)) {
 				DBG_DEC(iCol);
-				werr(1, "The number of columns is corrupt");
+				return found_nothing;
 			}
 			pRow->ucNumberOfColumns = (UCHAR)iCol;
 			iPosPrev = (int)(short)usGetWord(

src/prop8.c

@@ -479,7 +479,8 @@ eGet8RowInfo(int iFodo,
 			}
 			if (iCol >= (int)elementsof(pRow->asColumnWidth)) {
 				DBG_DEC(iCol);
-				werr(1, "The number of columns is corrupt");
+				return found_nothing;
+//				werr(1, "The number of columns is corrupt");
 			}
 			pRow->ucNumberOfColumns = (UCHAR)iCol;
 			iPosPrev = (int)(short)usGetWord(

src/properties.c

@@ -115,8 +115,10 @@ vGetPropertyInfo(FILE *pFile, const pps_info_type *pPPS,
 	case 8:
 		vGet8LstInfo(pFile, pPPS,
 			aulBBD, tBBDLen, aulSBD, tSBDLen, aucHeader);
-		vGet8Stylesheet(pFile, pPPS,
+		if (!vGet8Stylesheet(pFile, pPPS,
-			aulBBD, tBBDLen, aulSBD, tSBDLen, aucHeader);
+			aulBBD, tBBDLen, aulSBD, tSBDLen, aucHeader)) {
+		    return;
+		}
 		vGet8DopInfo(pFile, &pPPS->tTable,
 			aulBBD, tBBDLen, aulSBD, tSBDLen, aucHeader);
 		vGet8SepInfo(pFile, pPPS,

src/propmod.c

@@ -63,6 +63,9 @@ vAdd2PropModList(const UCHAR *aucPropMod)
 	NO_DBG_DEC(tNextFree);
 
 	tLen = 2 + (size_t)usGetWord(0, aucPropMod);
+	if (isOutOfBounds(tLen)) {
+	    return;
+	}
 	NO_DBG_HEX(tLen);
 	NO_DBG_PRINT_BLOCK(pucPropMod, tLen);
 	ppAnchor[tNextFree] = xmalloc(tLen);

src/sist2_hotfix.c

@@ -0,0 +1,11 @@
+#include "antiword.h"
+
+static __thread ULONG buffer;
+
+BOOL isOutOfBounds(ULONG offset) {
+    return offset > buffer;
+}
+
+void setBufferSize(ULONG size) {
+    buffer = size;
+}

src/startup.c

@@ -1,145 +0,0 @@
-/*
- * startup.c
- * Copyright (C) 1998-2001 A.J. van Os; Released under GPL
- *
- * Description:
- * Try to force a single startup of !Antiword
- */
-
-#include <stdlib.h>
-#include <string.h>
-#include <ctype.h>
-#include "DeskLib:Error.h"
-#include "DeskLib:Event.h"
-#include "DeskLib:SWI.h"
-#include "antiword.h"
-
-
-#if !defined(TaskManager_EnumerateTasks)
-#define TaskManager_EnumerateTasks	0x042681
-#endif /* TaskManager_EnumerateTasks */
-
-/*
- * bIsMatch - decide whether the two strings match
- *
- * like strcmp, but this one ignores case
- */
-static BOOL
-bIsMatch(const char *szStr1, const char *szStr2)
-{
-	const char	*pcTmp1, *pcTmp2;
-
-	for (pcTmp1 = szStr1, pcTmp2 = szStr2;
-	     *pcTmp1 != '\0';
-	     pcTmp1++, pcTmp2++) {
-		if (toupper(*pcTmp1) != toupper(*pcTmp2)) {
-			return FALSE;
-		}
-	}
-	return *pcTmp2 == '\0';
-} /* end of bIsMatch */
-
-/*
- * tGetTaskHandle - get the task handle of the given task
- *
- * returns the task handle when found, otherwise 0
- */
-static task_handle
-tGetTaskHandle(const char *szTaskname)
-{
-	const char	*pcTmp;
-	int	iReg0, iIndex;
-	int	aiBuffer[4];
-	char	szTmp[21];
-
-	iReg0 = 0;
-	do {
-		/* Get info on the next task */
-		Error_CheckFatal(SWI(3, 1, TaskManager_EnumerateTasks | XOS_Bit,
-			iReg0, aiBuffer, sizeof(aiBuffer), &iReg0));
-		/* Copy the (control character terminated) task name */
-		for (iIndex = 0, pcTmp = (const char *)aiBuffer[1];
-		     iIndex < elementsof(szTmp);
-		     iIndex++, pcTmp++) {
-			if (iscntrl(*pcTmp)) {
-				szTmp[iIndex] = '\0';
-				break;
-			}
-			szTmp[iIndex] = *pcTmp;
-		}
-		szTmp[elementsof(szTmp) - 1] = '\0';
-		if (bIsMatch(szTmp, szTaskname)) {
-			/* Task found */
-			return (task_handle)aiBuffer[0];
-		}
-	} while (iReg0 >= 0);
-
-	/* Task not found */
-	return 0;
-} /* end of tGetTaskHandle */
-
-int
-main(int argc, char **argv)
-{
-	message_block	tMsg;
-	task_handle	tTaskHandle;
-	size_t	tArgLen;
-	int	aiMessages[] = {0};
-	char	szCommand[512];
-
-	Event_Initialise3("StartUp", 310, aiMessages);
-
-	if (argc > 1) {
-		tArgLen = strlen(argv[1]);
-	} else {
-		tArgLen = 0;
-	}
-	if (tArgLen >= sizeof(tMsg.data.dataload.filename)) {
-		werr(1, "Input filename too long");
-		return EXIT_FAILURE;
-	}
-
-	tTaskHandle = tGetTaskHandle("antiword");
-
-	if (tTaskHandle == 0) {
-		/* Antiword is not active */
-		strcpy(szCommand, "chain:<Antiword$Dir>.!Antiword");
-		if (argc > 1) {
-			strcat(szCommand, " ");
-			strcat(szCommand, argv[1]);
-		}
-#if defined(DEBUG)
-		strcat(szCommand, " ");
-		strcat(szCommand, "2><Antiword$Dir>.Debug");
-#endif /* DEBUG */
-		system(szCommand);
-		/* If we reach here something has gone wrong */
-		return EXIT_FAILURE;
-	}
-
-	/* Antiword is active */
-	if (argc > 1) {
-		/*
-		 * Send the argument to Antiword by imitating a
-		 * drag-and-drop to Antiword's iconbar icon
-		 */
-		memset(&tMsg, 0, sizeof(tMsg));
-		tMsg.header.size = ROUND4(offsetof(message_block, data) +
-					offsetof(message_dataload, filename) +
-					1 + tArgLen);
-		tMsg.header.yourref = 0;
-		tMsg.header.action = message_DATALOAD;
-		tMsg.data.dataload.window = window_ICONBAR;
-		tMsg.data.dataload.icon = -1;
-		tMsg.data.dataload.size = 0;
-		tMsg.data.dataload.filetype = FILETYPE_MSWORD;
-		strcpy(tMsg.data.dataload.filename, argv[1]);
-		Error_CheckFatal(Wimp_SendMessage(event_SEND,
-						&tMsg, tTaskHandle, 0));
-		return EXIT_SUCCESS;
-	} else {
-		/* Give an error message and return */
-		werr(1, "Antiword is already running");
-		return EXIT_FAILURE;
-	}
-} /* end of main */

src/stylesheet.c

@@ -458,6 +458,9 @@ vGet6Stylesheet(FILE *pFile, ULONG ulStartBlock,
 		     iIndex < (int)tStdCount;
 		     iIndex++, tOffset += 2 + tStdLen) {
 			NO_DBG_DEC(tOffset);
+			if (tOffset > tStshInfoLen) {
+			    return;
+			}
 			tStdLen = (size_t)usGetWord(tOffset, aucBuffer);
 			NO_DBG_DEC(tStdLen);
 			if (abFilled[iIndex]) {
@@ -505,6 +508,9 @@ vGet6Stylesheet(FILE *pFile, ULONG ulStartBlock,
 			NO_DBG_DEC(usUpxCount);
 			tPos = 2 + tStdBaseInFile;
 			NO_DBG_DEC(tPos);
+			if (tOffset + tPos > tStshInfoLen) {
+			    return;
+			}
 			tNameLen = (size_t)ucGetByte(tOffset + tPos, aucBuffer);
 			NO_DBG_DEC(tNameLen);
 			NO_DBG_STRN(aucBuffer + tOffset + tPos + 1, tNameLen);
@@ -590,7 +596,7 @@ vGet6Stylesheet(FILE *pFile, ULONG ulStartBlock,
 /*
  * Build the lists with Stylesheet Information for Word 8/9/10 files
  */
-void
+BOOL
 vGet8Stylesheet(FILE *pFile, const pps_info_type *pPPS,
 	const ULONG *aulBBD, size_t tBBDLen,
 	const ULONG *aulSBD, size_t tSBDLen,
@@ -619,7 +625,7 @@ vGet8Stylesheet(FILE *pFile, const pps_info_type *pPPS,
 	NO_DBG_HEX(pPPS->tTable.ulSize);
 	if (pPPS->tTable.ulSize == 0) {
 		DBG_MSG("No stylesheet information");
-		return;
+		return TRUE;
 	}
 
 	if (pPPS->tTable.ulSize < MIN_SIZE_FOR_BBD_USE) {
@@ -638,7 +644,7 @@ vGet8Stylesheet(FILE *pFile, const pps_info_type *pPPS,
 			aulBlockDepot, tBlockDepotLen, tBlockSize,
 			aucBuffer, ulBeginStshInfo, tStshInfoLen)) {
 		aucBuffer = xfree(aucBuffer);
-		return;
+		return FALSE;
 	}
 	NO_DBG_PRINT_BLOCK(aucBuffer, tStshInfoLen);
 
@@ -659,6 +665,10 @@ vGet8Stylesheet(FILE *pFile, const pps_info_type *pPPS,
 		     iIndex < (int)tStdCount;
 		     iIndex++, tOffset += 2 + tStdLen) {
 			NO_DBG_DEC(tOffset);
+			if (tOffset + 6 > tStshInfoLen) {
+                aucBuffer = xfree(aucBuffer);
+			    return FALSE;
+			}
 			tStdLen = (size_t)usGetWord(tOffset, aucBuffer);
 			NO_DBG_DEC(tStdLen);
 			if (abFilled[iIndex]) {
@@ -706,6 +716,9 @@ vGet8Stylesheet(FILE *pFile, const pps_info_type *pPPS,
 			NO_DBG_DEC(usUpxCount);
 			tPos = 2 + tStdBaseInFile;
 			NO_DBG_DEC(tPos);
+			if (tOffset + tPos > tStshInfoLen) {
+			    return FALSE;
+			}
 			tNameLen = (size_t)usGetWord(tOffset + tPos, aucBuffer);
 			NO_DBG_DEC(tNameLen);
 			tNameLen *= 2;	/* From Unicode characters to bytes */
@@ -720,6 +733,9 @@ vGet8Stylesheet(FILE *pFile, const pps_info_type *pPPS,
 			if (tPos >= tStdLen) {
 				continue;
 			}
+			if (tOffset + tPos > tStshInfoLen) {
+			    return FALSE;
+			}
 			tUpxLen = (size_t)usGetWord(tOffset + tPos, aucBuffer);
 			NO_DBG_DEC(tUpxLen);
 			if (tPos + tUpxLen > tStdLen) {
@@ -788,6 +804,7 @@ vGet8Stylesheet(FILE *pFile, const pps_info_type *pPPS,
 	/* Clean up before you leave */
 	abFilled = xfree(abFilled);
 	aucBuffer = xfree(aucBuffer);
+	return TRUE;
 } /* end of vGet8Stylesheet */
 
 /*

src/summary.c

@@ -207,7 +207,7 @@ tFiletime(ULONG ulOffset, const UCHAR *aucBuffer)
 /*
  * vAnalyseSummaryInfo - analyse the summary information
  */
-static void
+static BOOL
 vAnalyseSummaryInfo(const UCHAR *aucBuffer)
 {
 	ULONG	ulOffset;
@@ -220,6 +220,9 @@ vAnalyseSummaryInfo(const UCHAR *aucBuffer)
 		ulOffset = ulGetLong(12 + tIndex * 8, aucBuffer);
 		NO_DBG_DEC(tPropID);
 		NO_DBG_HEX(ulOffset);
+		if (isOutOfBounds(ulOffset)) {
+		    return FALSE;
+		}
 		tPropType = (size_t)ulGetLong(ulOffset, aucBuffer);
 		NO_DBG_DEC(tPropType);
 		switch (tPropID) {
@@ -277,6 +280,9 @@ vAnalyseDocumentSummaryInfo(const UCHAR *aucBuffer)
 		ulOffset = ulGetLong(12 + tIndex * 8, aucBuffer);
 		NO_DBG_DEC(tPropID);
 		NO_DBG_HEX(ulOffset);
+		if (isOutOfBounds(ulOffset)) {
+		    return;
+		}
 		tPropType = (size_t)ulGetLong(ulOffset, aucBuffer);
 		NO_DBG_DEC(tPropType);
 		switch (tPropID) {
@@ -406,6 +412,7 @@ pucAnalyseSummaryInfoHeader(FILE *pFile,
 
 	/* Read the Summery Information */
 	aucBuffer = xmalloc(tLength);
+	setBufferSize(tLength);
 	if (!bReadBuffer(pFile, ulStartBlock,
 			aulBlockDepot, tBlockDepotLen, tBlockSize,
 			aucBuffer, ulOffset, tLength)) {
@@ -625,7 +632,9 @@ vSetSummaryInfoOLE(FILE *pFile, const pps_info_type *pPPS,
 		pPPS->tSummaryInfo.ulSB, pPPS->tSummaryInfo.ulSize,
 		aulBBD, tBBDLen, aulSBD, tSBDLen);
 	if (pucBuffer != NULL) {
-		vAnalyseSummaryInfo(pucBuffer);
+		if (!vAnalyseSummaryInfo(pucBuffer)) {
+		    return;
+		}
 		pucBuffer = xfree(pucBuffer);
 	}
 

src/unix.c

@@ -21,9 +21,9 @@ werr(int iFatal, const char *szFormat, ...)
 	va_list tArg;
 
 	va_start(tArg, szFormat);
-	(void)vfprintf(stderr, szFormat, tArg);
+//	(void)vfprintf(stderr, szFormat, tArg);
 	va_end(tArg);
-	fprintf(stderr, "\n");
+//	fprintf(stderr, "\n");
 	switch (iFatal) {
 	case 0:		/* The message is just a warning, so no exit */
 		return;

src/xml.c

@@ -217,7 +217,7 @@ ucPopStack(void)
 	fail(tStackNextFree == 0);
 
 	if (tStackNextFree == 0) {
-		werr(1, "The stack is empty, unable to continue");
+//		werr(1, "The stack is empty, unable to continue");
 		return TAG_NOTAG;
 	}
 	return aucStack[--tStackNextFree];
@@ -504,7 +504,8 @@ vAddEndTag(diagram_type *pDiag, UCHAR ucTag)
 		DBG_DEC(ucTag);
 		DBG_DEC(ucTopTag);
 		DBG_FIXME();
-		werr(1, "Impossible tag sequence, unable to continue");
+//		werr(1, "Impossible tag sequence, unable to continue");
+		return;
 	}
 
 	if (atDocBookTags[(UINT)ucTag].bAddNewlineEnd) {
@@ -1010,7 +1011,7 @@ vEndOfParagraphXML(diagram_type *pDiag, UINT uiMaxLevel)
 			break;
 		case TAG_NOTAG:
 			DBG_FIXME();
-			werr(1, "Impossible tag sequence, unable to continue");
+//			werr(1, "Impossible tag sequence, unable to continue");
 			break;
 		default:
 			DBG_DEC(ucTopTag);