Dear Maintainer,

I found an out-of-bounds read while fuzzing Antiword 0.37 with AFL++.
The issue is reproducible against the Debian 0.37-18 source package when
built with AddressSanitizer.

A malformed .doc file causes vGet8PapInfo() in prop8.c to use
document-controlled FKP/PAP metadata without adequately validating the
calculated offsets against the 512-byte FKP page.

For one reproducer, AddressSanitizer reports:

    ERROR: AddressSanitizer: stack-buffer-overflow
    ...
    #0 vGet8PapInfo .../prop8.c:1001

GDB shows the following values immediately before the invalid access:

    iRun = 53
    iIndex2 = 23
    (iRun + 1) * 4 + iIndex2 * 13 = 515
    sizeof(aucFpage) = 512

The resulting index is therefore 515 bytes into a 512-byte stack buffer.

Other AFL inputs produced related out-of-bounds reads at prop8.c:1013
in vGet8PapInfo() and prop8.c:549 in vGet8StyleInfo(). These appear to
be manifestations of the same missing bounds validation in the FKP/PAP
record parsing path.

Reproduction:

1. Build Debian Antiword 0.37-18 with AddressSanitizer.
2. Run:

       ./antiword candidate-A-original.doc

3. AddressSanitizer reports a stack-buffer-overflow in vGet8PapInfo()
   at prop8.c:1001.

I have also prepared a candidate patch which adds bounds checks for the
FKP descriptor offsets, iFodo, and record ranges before accessing the
512-byte FKP page or passing data to vGet8StyleInfo().

With the patch applied:
- the reproducer exits without an AddressSanitizer finding;
- a valid .doc test file continues to process successfully; and
- its generated output is byte-for-byte identical to the output from
  the unpatched build for that valid test file.

I can provide the crashing .doc reproducer and candidate patch.