Better support for .doc files

test/main.cpp

@@ -786,6 +786,27 @@ TEST(Msdoc, Test4Pdf) {
     cleanup(&doc, &f);
 }
 
+TEST(Msdoc, TestFuzz1) {
+    vfile_t f;
+    document_t doc;
+    load_doc_file("libscan-test-files/test_files/msdoc/fuzz_ole.doc", &f, &doc);
+
+    size_t buf_len;
+    char *buf = (char *) read_all(&f, &buf_len);
+
+    for (int i = 0; i < 1000; i++) {
+        size_t buf_len_copy = buf_len;
+        char *buf_copy = (char*)malloc(buf_len);
+        memcpy(buf_copy, buf, buf_len);
+
+        fuzz_buffer(buf_copy, &buf_len_copy, 3, 8, 5);
+        FILE *file = fmemopen(buf_copy, buf_len_copy, "rb");
+        parse_msdoc_text(&msdoc_text_ctx, &f, &doc, file, buf_copy, buf_len_copy);
+    }
+    free(buf);
+    cleanup(&doc, &f);
+}
+
 
 int main(int argc, char **argv) {
     setlocale(LC_ALL, "");
@@ -833,7 +854,7 @@ int main(int argc, char **argv) {
     media_ctx.store = counter_store;
     media_ctx.tn_size = 500;
     media_ctx.tn_qscale = 1.0;
-    media_ctx.max_media_buffer = (long)2000 * (long)1024 * (long)1024;
+    media_ctx.max_media_buffer = (long) 2000 * (long) 1024 * (long) 1024;
 
     ooxml_500_ctx.content_size = 500;
     ooxml_500_ctx.log = noop_log;

test/test_util.cpp

@@ -94,3 +94,19 @@ void destroy_doc(document_t *doc) {
         free(tmp);
     }
 }
+
+void fuzz_buffer(char *buf, size_t *buf_len, int width, int n, int trunc_p) {
+    for (int i = 0; i < n; i++) {
+
+        size_t offset = rand() % (*buf_len - width - 1);
+
+        if (rand() % 100 < trunc_p) {
+            *buf_len = MAX(offset, 1000);
+            continue;
+        }
+
+        for (int disp = 0; disp < width; disp++) {
+            buf[offset + disp] = (int8_t)rand();
+        }
+    }
+}

test/test_util.h

@@ -42,4 +42,6 @@ meta_line_t *get_meta_from(meta_line_t *meta, metakey key);
 
 void destroy_doc(document_t *doc);
 
+void fuzz_buffer(char *buf, size_t *buf_len, int width, int n, int trunc_p);
+
 #endif