diff -Naur wv/escher.c wv.mod/escher.c
--- wv/escher.c	Wed Apr 11 01:27:47 2001
+++ wv.mod/escher.c	Wed Jan 16 13:33:08 2002
@@ -215,8 +215,7 @@
 		count +=
 		    wvGetSpgrContainer (&
 					(item->spgrcontainer
-					 [item->no_spgrcontainer - 1]),
-&amsofbh, fd);
+					 [item->no_spgrcontainer - 1]), &amsofbh, fd);
 		break;
 	    default:
 		count += wvEatmsofbt (&amsofbh, fd);
@@ -303,8 +302,7 @@
 		count +=
 		    wvGetSpgrContainer (&
 					(item->spgrcontainer
-					 [item->no_spgrcontainer - 1]),
-&amsofbh, fd);
+					 [item->no_spgrcontainer - 1]), &amsofbh, fd);
 		break;
 	    default:
 		count += wvEatmsofbt (&amsofbh, fd);
@@ -684,10 +682,14 @@
 U32
 wvEatmsofbt (MSOFBH * amsofbh, wvStream * fd)
 {
+    /* Ries (rvt@dds.nl)
+       Changed read to bound to 32bit instead of 8bit 
+       MS prolly does 32 bit bounderaries ??? */
     U32 i;
-    for (i = 0; i < amsofbh->cbLength; i++)
-	read_8ubit (fd);
-    return (amsofbh->cbLength);
+    U32 check=(amsofbh->cbLength + 3) >> 2;
+    for (i = 0; i < check; i++)
+	read_32ubit (fd);
+    return (check << 2);
 }
 
 void
diff -Naur wv/picf.c wv.mod/picf.c
--- wv/picf.c	Wed Jan  2 20:33:34 2002
+++ wv.mod/picf.c	Wed Jan 16 13:33:08 2002
@@ -218,13 +218,19 @@
 		break;
 	    default:
 		{
-		    U32 len = entry - 2;
+		    U32 lene2 = entry - 2;
 		    U32 i;
 		    wvTrace (
-			     ("len is %d, predict end of %x\n", len,
+			     ("lene2 is %d, predict end of %x\n", len,
 			      wvStream_tell (fd) + (entry - 2) * 2));
-		    for (i = 0; i < len; i++)
+		    /* RIES (rvt@dds.nl)
+		       prolly a dirty patch because I check count
+		       everytime it's incremnented against lene2.
+		       This seems twork very well I tried it on around 15.000
+		       word documents and it seems to work! */
+		    for (i = 0; i < lene2; i++)
 		      {
+		          if ( (count + 1) >= len) return (count);
 			  test = read_16ubit (fd);
 			  if ((i == 0)
 			      && ((test == 0x0f43) || (test == 0x0b41)))
@@ -232,11 +238,13 @@
 				wvTrace (
 					 ("Found a Bitmap, Will strip header and return with bitmap data\n"));
 				count += 2;
+    		        	if ( (count + 1) >= len) return (count);
 				pad = test;
 				test = read_32ubit (fd);	/*0x00cc0020 */
 				if (test != 0x00cc0020)
 				    wvTrace (("Old Graphic\n"));
 				count += 4;
+    		        	if ( (count + 1) >= len) return (count);
 
 				if (pad == 0x0f43)
 				  {
@@ -244,20 +252,26 @@
 				      if (test != 0x0000)
 					  wvTrace (("Old Graphic\n"));
 				      count += 2;
+			              if ( (count + 1) >= len) return (count);
 				  }
 
 				read_16ubit (fd);	/*width */
 				count += 2;
+    		        	if ( (count + 1) >= len) return (count);
 				read_16ubit (fd);	/*height */
 				count += 2;
+    		        	if ( (count + 1) >= len) return (count);
 				test = read_32ubit (fd);	/*0x00000000L */
 				if (test != 0x00000000L)
 				    wvTrace (("Old Graphic\n"));
 				count += 4;
+    		        	if ( (count + 1) >= len) return (count);
 				read_16ubit (fd);	/*width */
 				count += 2;
+    		        	if ( (count + 1) >= len) return (count);
 				read_16ubit (fd);	/*height */
 				count += 2;
+    		        	if ( (count + 1) >= len) return (count);
 				test = read_32ubit (fd);	/*0x00000000L */
 				if (test != 0x00000000L)
 				    wvTrace (("Old Graphic\n"));
@@ -265,6 +279,7 @@
 				return (count);
 			    }
 			  count += 2;
+	        	  if ( (count + 1) >= len) return (count);
 		      }
 		}
 		break;
diff -Naur wv/wvText.in wv.mod/wvText.in
--- wv/wvText.in	Sun Mar 11 20:00:24 2001
+++ wv.mod/wvText.in	Wed Jan 16 13:33:08 2002
@@ -3,6 +3,7 @@
 prefix=@prefix@
 exec_prefix=@exec_prefix@
 datadir=@datadir@
+tmpdir=/tmp
 
 # argument checking
 if [ ${#} -ne "2" ]; then
@@ -29,23 +30,23 @@
     fi
 
     # intermediate file
-    TMP_FILE="/tmp/wv$$.html"
+    TMP_FILE="wv$$.html"
 
-    wvHtml "${1}" "${TMP_FILE}" >/dev/null 2>&1
+    wvHtml "${1}" --targetdir="${tmpdir}" "${TMP_FILE}" >/dev/null 2>&1
     if [ ${?} -ne "0" ]; then
 	echo "Could not convert into HTML"
 	exit 1
     fi
 
     # lynx actually does quite well
-    TERM=vt100 lynx -dump -force_html "${TMP_FILE}" > "${2}"
+    TERM=vt100 lynx -dump -force_html "${tmpdir}/${TMP_FILE}" > "${2}"
     if [ ${?} -ne "0" ]; then
 	    echo "Could not convert into Text"
 	    exit 1
     fi
 
     # clean up
-    rm -f ${TMP_FILE}
+    rm -f "${tmpdir}/${TMP_FILE}"
 
 else
     # fall back onto our cruddy output