emf 0.1.2 → 0.2.0

data/lib/emf/conformance/rules/emf_parse_recovery.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+# Parse-recovery errors (Metafile#errors) and unparseable input become
+# diagnostics. The record count and offsets come from the ParseError itself.
+return if Emf::Conformance::Registry.loaded_elsewhere?(__FILE__)
+
+module Emf
+  module Conformance
+    module ParseRecoveryRules
+      EMF = %i[emf emf_plus].freeze
+      RECOVERED = "the parser recovered and kept the bytes (as a raw record or trailing data), so the file still opens"
+
+      # Recovered ParseErrors (Metafile#errors) carry no #evidence on either backend (measured 2026-10-22:
+      # Emf::ParseEvidence is attached only to the FormatError/ParseError raised for an input that yields no
+      # metafile, and none of its check symbols describes a recovered record). Their rule id is therefore
+      # chosen from the message. When recovered errors start carrying evidence, classify from
+      # error.evidence.check first and keep this table as the fallback for errors without evidence;
+      # spec/emf/conformance/parse_recovery_spec.rb fails the day that happens.
+      #
+      # message pattern => [rule id, kind]
+      CLASSES = [
+        [/header/, "emf.record.truncated_header", :truncated_header],
+        [/nSize \d+ < 8/, "emf.record.size_minimum", :size_minimum],
+        [/truncated record/, "emf.record.size_bounds", :size_bounds],
+        [/declares more entries than nSize allows/, "emf.record.array_exceeds_size", :array_exceeds_size]
+      ].freeze
+      OTHER = ["emf.record.undecodable", :undecodable].freeze
+
+      module_function
+
+      def classify(error) = CLASSES.find { |pattern, *| pattern.match?(error.message) }&.drop(1) || OTHER
+
+      # Text rules that name the same too-large count or too-small record the parser recovered as Raw; where one
+      # fires on the record, the recovery diagnostic would only repeat it.
+      TEXT_OWNERS = %w[emf.exttextout.string_bounds emf.exttextout.dx_bounds].freeze
+
+      def findings(context, id)
+        owned = id == "emf.record.array_exceeds_size" ? text_owned_offsets(context) : []
+        context.metafile.errors.filter_map do |error|
+          next unless classify(error).first == id
+          next if owned.include?(error.offset)
+
+          { message: error.message, offset: error.offset, record_type: error.record_code }
+        end
+      end
+
+      def text_owned_offsets(context)
+        (TEXT_OWNERS.flat_map { |owner| TextRules.findings(context, owner) } + CorpusNamedRules.exttextout_fixed_part(context))
+          .map { |finding| finding[:offset] }
+      end
+
+      def unparseable(context)
+        failure = context.parse_failure
+        return [] if WmfRejectionRules.reason_for(failure) # a named wmf.reject.rNNNN finding already explains it
+        return [] if wmf_header_fault(context.bytes) # wmf.header.unrecognised cites MS-WMF instead
+
+        [{ message: "input could not be parsed: #{failure.message}", offset: 0 }]
+      end
+
+      WMF_TYPES = [1, 2].freeze
+      WMF_VERSIONS = [0x0100, 0x0300].freeze
+
+      # The detector accepts a standard WMF only when Type is 1 or 2 and HeaderSize is 9, so a META_HEADER with
+      # exactly one of those wrong (and a valid Version) never reaches the WMF parser. Name that field here.
+      def wmf_header_fault(bytes)
+        return unless bytes && bytes.bytesize >= 18
+
+        type, header_size, version = bytes.unpack("vvv")
+        return unless WMF_VERSIONS.include?(version)
+        return "HeaderSize #{header_size} is not 9" if WMF_TYPES.include?(type) && header_size != 9
+
+        "Type #{type} is not 1 (memory) or 2 (disk)" if header_size == 9 && !WMF_TYPES.include?(type)
+      end
+
+      def wmf_header(context)
+        fault = wmf_header_fault(context.bytes)
+        fault ? [{ message: "WMF META_HEADER #{fault}, so the input could not be parsed", offset: 0 }] : []
+      end
+    end
+
+    registry = Registry.loading
+    citations = { "emf.record.truncated_header" => "MS-EMF 2.3", "emf.record.size_minimum" => "MS-EMF 2.3",
+                  "emf.record.size_bounds" => "MS-EMF 2.3", "emf.record.array_exceeds_size" => "MS-EMF 2.3",
+                  "emf.record.undecodable" => "MS-EMF 2.3" }
+    (ParseRecoveryRules::CLASSES.map { |_, id, kind| [id, kind] } << ParseRecoveryRules::OTHER).each do |id, kind|
+      registry.register(id: id, formats: ParseRecoveryRules::EMF, citation: citations.fetch(id), kind: kind,
+                        tolerant_reason: ParseRecoveryRules::RECOVERED) do |context|
+        ParseRecoveryRules.findings(context, id)
+      end
+    end
+
+    registry.register(id: "emf.parse.unparseable", formats: [:unparseable], citation: "MS-EMF 2.3.4.2",
+                      kind: :unparseable) { |context| ParseRecoveryRules.unparseable(context) }
+    registry.register(id: "wmf.header.unrecognised", formats: [:unparseable], citation: "MS-WMF 2.3.2.2",
+                      kind: :unparseable) { |context| ParseRecoveryRules.wmf_header(context) }
+  end
+end

data/lib/emf/conformance/rules/emf_path_clip.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+# Path bracket (MS-EMF 2.3.10) and clipping (2.3.2) record rules, plus the
+# RESTOREDC depth sequence rule (2.3.11.6).
+return if Emf::Conformance::Registry.loaded_elsewhere?(__FILE__)
+
+module Emf
+  module Conformance
+    module PathClipRules
+      EMF = %i[emf emf_plus].freeze
+      BEGIN_PATH = 59
+      END_PATH = 60
+      CLOSE_FIGURE = 61
+      ABORT_PATH = 68
+      SAVE_DC = 33
+      RESTORE_DC = 34
+      PATH_TYPES = [BEGIN_PATH, END_PATH, CLOSE_FIGURE, 65, 66, ABORT_PATH].freeze # 65 FLATTENPATH, 66 WIDENPATH
+      SELECT_CLIP_PATH = 67
+      EXT_SELECT_CLIP_RGN = 75
+      # Clipping records have no stated Size; their fixed fields occupy: type => size.
+      CLIP_LAYOUT = { 26 => 16, 28 => 8, 29 => 24, 30 => 24, SELECT_CLIP_PATH => 12 }.freeze
+      REGION_MODES = (1..5)
+      SHIFTED = "a RESTOREDC below the saved depth leaves the rest of the stream readable; bad_corrupted_2014-12-02-215339.emf " \
+                "(tolerant-valid by owner decision) reaches it after a record boundary shift"
+
+      module_function
+
+      def each_wire(context, types)
+        context.records.each_with_index do |record, index|
+          next unless types.include?(context.record_type(record))
+
+          wire = record.wire
+          yield(record, index, wire) if wire.is_a?(Emf::Emr::Binary::Record)
+        end
+      end
+
+      def at(record, index, message)
+        { message: message, offset: record.offset, record_index: index + 1, record_type: record.type_id.to_i }
+      end
+
+      def path_size(context)
+        found = []
+        each_wire(context, PATH_TYPES) do |record, index, _wire|
+          size = context.record_size(record)
+          next if size == 8
+
+          found << at(record, index,
+                      "#{RecordTypes.name(context.record_type(record))} Size is #{size}, path bracket records are 0x00000008")
+        end
+        found
+      end
+
+      def clip_layout_size(context)
+        found = []
+        each_wire(context, CLIP_LAYOUT.keys) do |record, index, _wire|
+          type = context.record_type(record)
+          size = context.record_size(record)
+          next if size == CLIP_LAYOUT.fetch(type)
+
+          found << at(record, index, "#{RecordTypes.name(type)} Size is #{size}, its fixed fields occupy #{CLIP_LAYOUT.fetch(type)}")
+        end
+        found
+      end
+
+      def region_mode(context, type, field, name)
+        found = []
+        each_wire(context, [type]) do |record, index, wire|
+          mode = wire.public_send(field).to_i
+          unless REGION_MODES.cover?(mode)
+            found << at(record, index,
+                        "#{name} RegionMode #{mode} is not in the RegionMode enumeration (RGN_AND..RGN_COPY, 1..5)")
+          end
+        end
+        found
+      end
+
+      def select_clip_path_mode(context) = region_mode(context, SELECT_CLIP_PATH, :region_mode, "EMR_SELECTCLIPPATH")
+
+      def ext_select_clip_rgn_mode(context) = region_mode(context, EXT_SELECT_CLIP_RGN, :dw_mode, "EMR_EXTSELECTCLIPRGN")
+
+      # Walks the records once, tracking whether path bracket construction is open.
+      def bracket_findings(context)
+        open_at = nil
+        found = []
+        context.records.each_with_index do |record, index|
+          type = context.record_type(record)
+          found.concat(bracket_step(type, record, index, open_at))
+          open_at = bracket_open(type, record, index, open_at)
+        end
+        found << [:unclosed, at(*open_at, "EMR_BEGINPATH opens a path bracket that no EMR_ENDPATH or EMR_ABORTPATH closes")] if open_at
+        found
+      end
+
+      def bracket_open(type, record, index, open_at)
+        case type
+        when BEGIN_PATH then open_at || [record, index]
+        when END_PATH, ABORT_PATH then nil
+        else open_at
+        end
+      end
+
+      def bracket_step(type, record, index, open_at)
+        if type == BEGIN_PATH && open_at
+          [[:nested, at(record, index, "EMR_BEGINPATH while a path bracket is open (opened at record #{open_at[1] + 1})")]]
+        elsif type == END_PATH && !open_at
+          [[:unopened, at(record, index, "EMR_ENDPATH closes a path bracket but none is open")]]
+        elsif type == CLOSE_FIGURE && !open_at
+          [[:figure, at(record, index, "EMR_CLOSEFIGURE outside path bracket construction")]]
+        else
+          []
+        end
+      end
+
+      def bracket(context, kind) = bracket_findings(context).filter_map { |k, finding| finding if k == kind }
+
+      # Saved-state depth: SAVEDC pushes, RESTOREDC with a negative SavedDC of -n pops n.
+      def restore_depth(context)
+        depth = 0
+        found = []
+        context.records.each_with_index do |record, index|
+          case context.record_type(record)
+          when SAVE_DC then depth += 1
+          when RESTORE_DC
+            next unless record.wire.respond_to?(:saved_dc)
+
+            saved = record.wire.saved_dc.to_i
+            next unless saved.negative?
+
+            if -saved > depth
+              found << at(record, index, "EMR_RESTOREDC SavedDC #{saved} restores #{-saved} states deep but only #{depth} are saved")
+              depth = 0
+            else
+              depth += saved
+            end
+          end
+        end
+        found
+      end
+    end
+
+    registry = Registry.loading
+    pc = PathClipRules::EMF
+    {
+      "emf.path.fixed_size" => [:path_size, "MS-EMF 2.3.10", :fixed_size, :error],
+      "emf.clip.layout_size" => [:clip_layout_size, "MS-EMF 2.3.2", :layout_size, :warning],
+      "emf.clip.select_clip_path_mode" => [:select_clip_path_mode, "MS-EMF 2.3.2.5", :region_mode, :error],
+      "emf.clip.ext_select_clip_rgn_mode" => [:ext_select_clip_rgn_mode, "MS-EMF 2.3.2.2", :region_mode, :error],
+      "emf.dc.restore_depth" => [:restore_depth, "MS-EMF 2.3.11.6", :restore_depth, :error, PathClipRules::SHIFTED]
+    }.each do |id, (method, citation, kind, severity, reason)|
+      registry.register(id: id, formats: pc, citation: citation, kind: kind, severity: severity, tolerant_reason: reason) do |c|
+        PathClipRules.public_send(method, c)
+      end
+    end
+    {
+      "emf.path.begin_nested" => %i[nested error],
+      "emf.path.unclosed" => %i[unclosed error],
+      "emf.path.end_unopened" => %i[unopened warning],
+      "emf.path.closefigure_outside" => %i[figure warning]
+    }.each do |id, (kind, severity)|
+      registry.register(id: id, formats: pc, citation: "MS-EMF 2.3.10", kind: kind, severity: severity) do |c|
+        PathClipRules.bracket(c, kind)
+      end
+    end
+  end
+end

data/lib/emf/conformance/rules/emf_plus.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+# EMF+ adapter: maps the existing Emf::EmfPlus::Stream::Conformance diagnostics
+# (and the stream's other framing errors) onto lens rules. Offsets are the file
+# offset of the EMR_COMMENT that carries the EMF+ record.
+return if Emf::Conformance::Registry.loaded_elsewhere?(__FILE__)
+
+module Emf
+  module Conformance
+    module EmfPlusRules
+      KINDS = {
+        reserved_type: ["emfplus.record.reserved_type", "MS-EMFPLUS 2.1.1.1"],
+        stroke_fill_path: ["emfplus.record.stroke_fill_path", "MS-EMFPLUS 2.1.1.1"],
+        unknown_type: ["emfplus.record.unknown_type", "MS-EMFPLUS 2.1.1.1"],
+        header_not_after_emf_header: ["emfplus.header.placement", "MS-EMFPLUS 2.3.3.3"]
+      }.freeze
+      TOLERATED = "the records stay readable as unknown records with their bytes intact; corpus files carry them"
+      STREAM_ID = "emfplus.stream.framing"
+
+      module_function
+
+      def findings(context, id)
+        stream = context.metafile.emf_plus_stream
+        return [] unless stream
+
+        undecodable = id == STREAM_ID ? undecodable_types(context) : []
+        stream.errors.filter_map do |error|
+          next unless rule_id(error) == id
+          next if owned_elsewhere?(error, undecodable)
+
+          finding(context, error)
+        end
+      end
+
+      # A record body that does not decode is emfplus.record.body_bounds, and a missing or non-adjacent effect is
+      # emfplus.object.effect_missing; both are located at the record, so the stream-wide copy is dropped.
+      def owned_elsewhere?(error, undecodable)
+        case error
+        when Emf::EmfPlus::Links::LinkError then %i[missing_effect non_adjacent_effect].include?(error.reason)
+        when Emf::ParseError then undecodable.include?(error.record_code) && error.message.match?(/\Amalformed \w+ body at offset/)
+        else false
+        end
+      end
+
+      def undecodable_types(context)
+        EmfPlusSupport.records(context).filter_map do |located|
+          located.record.type unless EmfPlusSupport.typed?(located.record) || !Emf::EmfPlus::Records.registry.key?(located.record.type)
+        end
+      end
+
+      def rule_id(error)
+        error.is_a?(Emf::EmfPlus::Stream::Conformance::Diagnostic) ? KINDS.fetch(error.kind).first : STREAM_ID
+      end
+
+      def finding(context, error)
+        return { message: error.message, offset: nil } unless
+          error.is_a?(Emf::EmfPlus::Stream::Conformance::Diagnostic)
+
+        record = context.records[error.comment_index]
+        { message: error.message, offset: record&.offset, record_index: error.comment_index + 1, record_type: error.record_type }
+      end
+    end
+
+    registry = Registry.loading
+    EmfPlusRules::KINDS.each do |kind, (id, citation)|
+      registry.register(id: id, formats: [:emf_plus], citation: citation, kind: kind,
+                        tolerant_reason: EmfPlusRules::TOLERATED) { |context| EmfPlusRules.findings(context, id) }
+    end
+    registry.register(id: EmfPlusRules::STREAM_ID, formats: [:emf_plus], citation: "MS-EMFPLUS 2.3",
+                      kind: :stream_framing,
+                      tolerant_reason: "the stream keeps unframed bytes verbatim, so nothing is dropped") do |context|
+      EmfPlusRules.findings(context, EmfPlusRules::STREAM_ID)
+    end
+  end
+end

data/lib/emf/conformance/rules/emf_plus_common.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+return if Emf::Conformance::Registry.loaded_elsewhere?(__FILE__)
+
+return if defined?(Emf::Conformance::EmfPlusSupport)
+
+# Shared helper for the emf_plus_*.rb rule files (no rules of its own). It walks
+# the public EMF+ stream and locates each record in the file the way
+# emf_plus.rb does: by the file offset of the EMR_COMMENT that carries it, taken from
+# the handle's comment_offset (nil on a rebuilt stream, then the comment record's own offset).
+module Emf
+  module Conformance
+    module EmfPlusSupport
+      Located = Struct.new(:record, :handle, :comment_index, :comment, keyword_init: true)
+
+      module_function
+
+      # Every EMF+ record of the metafile, in stream order.
+      def records(context)
+        stream = context.metafile.emf_plus_stream
+        return [] unless stream
+
+        stream.each_record.map do |handle|
+          index = stream.segments.fetch(handle.segment_index).record_index
+          Located.new(record: handle.record, handle: handle, comment_index: index, comment: context.records[index])
+        end
+      end
+
+      def finding(located, message)
+        { message: "#{message} (EMF+ record #{format('0x%04X', located.record.type)} at offset #{located.handle.offset} " \
+                   "of EMR_COMMENT_EMFPLUS record #{located.comment_index + 1})",
+          offset: located.handle.comment_offset || located.comment&.offset, record_index: located.comment_index + 1,
+          record_type: located.record.type }
+      end
+
+      # A decoded record (not Records::Unknown).
+      def typed?(record) = record.is_a?(Emf::EmfPlus::Records::Base)
+
+      def size_of(record) = typed?(record) ? record.size : record.frame.size
+
+      def data_size_of(record) = typed?(record) ? record.data_size : record.frame.data_size
+
+      def type_name(record)
+        klass = Emf::EmfPlus::Records.registry[record.type]
+        klass ? klass.name.split("::").last : format("0x%04X", record.type)
+      end
+
+      # Registers a rule whose check runs per EMF+ record. The block gets the
+      # Located record and returns nil, a message, or an Array of messages.
+      def per_record(id:, citation:, kind:, severity: :error, tolerant_reason: nil, &check)
+        Registry.loading.register(id: id, formats: [:emf_plus], citation: citation, kind: kind, severity: severity,
+                                  tolerant_reason: tolerant_reason) do |context|
+          records(context).flat_map { |located| Array(yield(located)).map { |message| finding(located, message) } }
+        end
+      end
+    end
+  end
+end

data/lib/emf/conformance/rules/emf_plus_drawing.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+return if Emf::Conformance::Registry.loaded_elsewhere?(__FILE__)
+
+require_relative "emf_plus_common"
+
+# EMF+ drawing geometry rules over the public decoded records: minimum point and
+# rectangle counts, the image source unit. Counts that run past the record are
+# emfplus.record.body_bounds (the body does not decode at all).
+module Emf
+  module Conformance
+    module EmfPlusDrawing
+      Records = Emf::EmfPlus::Records
+      Support = EmfPlusSupport
+
+      # record class => [minimum, noun, exact?] from the MS-EMFPLUS 2.3.4 Count descriptions.
+      COUNTS = {
+        Records::DrawBeziers => [4, "points", false], Records::DrawClosedCurve => [3, "points", false],
+        Records::DrawCurve => [2, "points", false], Records::DrawLines => [2, "points", false],
+        Records::FillClosedCurve => [3, "points", false], Records::FillPolygon => [3, "points", false],
+        Records::DrawImagePoints => [3, "points", true],
+        Records::DrawRects => [1, "rectangles", false], Records::FillRects => [1, "rectangles", false]
+      }.freeze
+      UNIT_PIXEL = 2
+      # record class => { compressed? => [Size, DataSize] } from the MS-EMFPLUS 2.3.4.7 and 2.3.4.16 Size and DataSize tables.
+      ELLIPSE_SIZES = {
+        Records::DrawEllipse => { true => [0x14, 0x08], false => [0x1C, 0x10] },
+        Records::FillEllipse => { true => [0x18, 0x0C], false => [0x20, 0x14] }
+      }.freeze
+
+      module_function
+
+      def counts(located)
+        record = located.record
+        minimum, noun, exact = COUNTS.find { |klass, _| record.is_a?(klass) }&.last
+        return unless minimum
+
+        count = record.count
+        return if exact ? count == minimum : count >= minimum
+
+        "#{Support.type_name(record)} has #{count} #{noun}; #{exact ? 'exactly' : 'at least'} #{minimum} MUST be specified"
+      end
+
+      def ellipse_size(located)
+        record = located.record
+        sizes = ELLIPSE_SIZES.find { |klass, _| record.is_a?(klass) }&.last
+        return unless sizes
+
+        size, data_size = sizes.fetch(record.compressed?)
+        problems = []
+        problems << "Size is #{record.size}, MUST be 0x#{size.to_s(16).rjust(8, '0')}" unless record.size == size
+        problems << "DataSize is #{record.data_size}, MUST be 0x#{data_size.to_s(16).rjust(8, '0')}" unless record.data_size == data_size
+        return if problems.empty?
+
+        "#{Support.type_name(record)} with the C bit #{record.compressed? ? 'set' : 'clear'}: #{problems.join(' and ')}"
+      end
+
+      def source_unit(located)
+        record = located.record
+        return unless record.is_a?(Records::DrawImage) || record.is_a?(Records::DrawImagePoints)
+        return if record.src_unit == UNIT_PIXEL
+
+        "#{Support.type_name(record)} SrcUnit is #{record.src_unit}, MUST be UnitTypePixel (2)"
+      end
+    end
+
+    EmfPlusSupport.per_record(id: "emfplus.draw.count", citation: "MS-EMFPLUS 2.3.4", kind: :draw_count) do |located|
+      EmfPlusDrawing.counts(located)
+    end
+    EmfPlusSupport.per_record(id: "emfplus.draw.ellipse_size", citation: "MS-EMFPLUS 2.3.4", kind: :draw_size) do |located|
+      EmfPlusDrawing.ellipse_size(located)
+    end
+    EmfPlusSupport.per_record(id: "emfplus.draw.image_source_unit", citation: "MS-EMFPLUS 2.3.4", kind: :draw_source_unit,
+                              tolerant_reason: "a real producer writes SrcUnit 0 (spec/fixtures/emf/test-038.emf)") do |located|
+      EmfPlusDrawing.source_unit(located)
+    end
+  end
+end

data/lib/emf/conformance/rules/emf_plus_effects.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+return if Emf::Conformance::Registry.loaded_elsewhere?(__FILE__)
+
+require_relative "emf_plus_common"
+
+# EMF+ image rules (reading EmfPlusPayloads.completed_object at run time) over the decoded effect parameter blocks (MS-EMFPLUS 2.2.3) and
+# the pixel data of a bitmap (2.2.2.2, 2.2.2.3). Only a "MUST be in the range" /
+# "MUST be one of" clause is an error. A field whose text gives meaningful ranges
+# in "SHOULD" terms (ColorCurve AdjustmentIntensity, ColorMatrix[4][4] = 1.0,
+# SharpenEffect Radius, which has no stated range) is not checked.
+module Emf
+  module Conformance
+    module EmfPlusEffects
+      Effects = Emf::EmfPlus::Effects
+      Records = Emf::EmfPlus::Records
+      Objects = Emf::EmfPlus::Objects
+      Support = EmfPlusSupport
+
+      CURVE_ADJUSTMENTS = (0..7) # CurveAdjustments (2.1.1.7), AdjustExposure..AdjustBlackSaturation
+      CURVE_CHANNELS = (0..3) # CurveChannel (2.1.1.8)
+      BITS_PER_PIXEL_SHIFT = 8
+
+      # effect class => [[reader, allowed range, label], ...]; each range is a MUST (or a defined value table) of 2.2.3.x.
+      RANGES = {
+        Effects::Blur => [[:blur_radius, 0.0..255.0, "BlurRadius"], [:expand_edge, 0..1, "ExpandEdge"]],
+        Effects::BrightnessContrast => [[:brightness_level, -255..255, "BrightnessLevel"],
+                                        [:contrast_level, -100..100, "ContrastLevel"]],
+        Effects::ColorBalance => [[:cyan_red, -100..100, "CyanRed"], [:magenta_green, -100..100, "MagentaGreen"],
+                                  [:yellow_blue, -100..100, "YellowBlue"]],
+        Effects::ColorCurve => [[:curve_adjustment, CURVE_ADJUSTMENTS, "CurveAdjustment"],
+                                [:curve_channel, CURVE_CHANNELS, "CurveChannel"]],
+        Effects::HueSaturationLightness => [[:hue_level, -180..180, "HueLevel"],
+                                            [:saturation_level, -100..100, "SaturationLevel"],
+                                            [:lightness_level, -100..100, "LightnessLevel"]],
+        Effects::Levels => [[:highlight, 0..100, "Highlight"], [:mid_tone, -100..100, "MidTone"],
+                            [:shadow, 0..100, "Shadow"]],
+        Effects::Sharpen => [[:amount, 0.0..100.0, "Amount"]],
+        Effects::Tint => [[:hue, -180..180, "Hue"], [:amount, -100..100, "Amount"]]
+      }.freeze
+
+      module_function
+
+      def effect_parameters(located)
+        record = located.record
+        return unless record.is_a?(Records::SerializableObject) && Effects.lookup(record.object_guid)
+
+        effect = record.effect
+        problems = RANGES.find { |klass, _| effect.is_a?(klass) }&.last.to_a.filter_map do |reader, range, label|
+          value = effect.public_send(reader)
+          "#{label} #{value} is outside #{range.first}..#{range.last}" unless range.cover?(value)
+        end
+        problems.concat(color_matrix_problems(effect)) if effect.is_a?(Effects::ColorMatrix)
+        problems.map { |problem| "#{effect.class.name.split('::').last} effect (#{record.object_guid}) #{problem}" }
+      rescue Emf::ParseError
+        nil # reported by emfplus.object.serializable_buffer
+      end
+
+      # Matrix_4_0 .. Matrix_4_3 MUST be 0.0 (2.2.3.6).
+      def color_matrix_problems(effect)
+        effect.matrix[4].first(4).each_with_index.filter_map do |value, column|
+          "Matrix[4][#{column}] is #{value}, MUST be 0.0" unless value.zero?
+        end
+      end
+
+      # Decoded bitmaps of the object this record completes.
+      def pixel_data(stream, located)
+        logical = EmfPlusPayloads.completed_object(stream, located)
+        return unless logical&.object_type == Objects::IMAGE
+
+        bitmap = logical.body.bitmap
+        return unless bitmap&.bitmap_type&.zero?
+
+        pixel_problems(bitmap).map { |problem| "EmfPlusImage (object ID #{logical.emf_object_id}) bitmap #{problem}" }
+      rescue Emf::ParseError
+        nil # reported by emfplus.object.payload
+      end
+
+      # Stride is bytes per pixel times Width (2.2.2.2), so a scan-line is at least ceil(Width * bits / 8)
+      # bytes; PixelData holds Height scan-lines of Stride bytes (2.2.2.3).
+      def pixel_problems(bitmap)
+        bits = (bitmap.pixel_format >> BITS_PER_PIXEL_SHIFT) & 0xFF
+        row = ((bitmap.width * bits) + 7) / 8
+        problems = []
+        if bitmap.stride < row
+          problems << "Stride #{bitmap.stride} is smaller than the #{row} bytes of a #{bitmap.width}-pixel scan-line " \
+                      "at #{bits} bits per pixel"
+        end
+        needed = bitmap.stride.abs * bitmap.height.abs
+        have = bitmap.bitmap_data.pixel_data.to_s.bytesize
+        problems << "PixelData holds #{have} bytes, Stride #{bitmap.stride} * Height #{bitmap.height} needs #{needed}" if have < needed
+        problems
+      end
+    end
+
+    EmfPlusSupport.per_record(id: "emfplus.object.effect_parameters", citation: "MS-EMFPLUS 2.2.3",
+                              kind: :effect_parameters) { |located| EmfPlusEffects.effect_parameters(located) }
+
+    Registry.loading.register(id: "emfplus.image.pixel_data", formats: [:emf_plus], citation: "MS-EMFPLUS 2.2.2.3",
+                              kind: :pixel_data, tolerant_reason: nil) do |context|
+      EmfPlusPayloads.per_object(context) { |stream, located| EmfPlusEffects.pixel_data(stream, located) }
+    end
+  end
+end