Dear Maintainer,

I am reporting on behalf of an engineer at Quarklsab, a divide-by-zero issue in antiword 0.37-17 which can be triggered by a specially crafted Word document.

The issue causes antiword to crash.

The problem occurs in word2text.c when the width returned for the em-dash glyph is zero. The returned value is subsequently used as the denominator of an integer division without checking for zero:

    lCharWidth = lComputeStringWidth(szOne, 1, pOutput->tFontRef,
                                     pOutput->usFontSize);
    iChars = (int)((144000 + lCharWidth / 2) / lCharWidth);

When lCharWidth is zero, this results in an integer divide-by-zero.

CWE: CWE-369 (Divide By Zero)

Reproduction
============

With the attached PoC document:

    antiword -a a4 ./sample_dos_1.doc

Observed behavior:
antiword crashes due to the divide-by-zero.

Expected behavior:
antiword should reject or safely handle the malformed document without crashing.

The issue was reproduced with antiword 0.37-17.

I have attached the PoC document and a technical report containing further details.

Regards,
Salwa
Quarkslab VulnReport Team