emf 0.1.2 → 0.2.0

data/lib/emf/conformance/rules/wmf_buffers.rb

@@ -0,0 +1,259 @@
+# frozen_string_literal: true
+
+# WMF bitmap, text, palette, region, escape and embedded-EMF buffer rules over typed public
+# records (MS-WMF 2.3.1 bitmap, 2.3.3 drawing, 2.3.4 object, 2.3.5 state and 2.3.6 escape
+# records). Only values the model exposes are judged: records the model keeps opaque
+# (UnknownRecord, escape subtypes without a view, undecodable bytes) are preserved and never
+# reported, except a text record the parser kept verbatim because its StringLength is negative, and no rule
+# here needs the declared record size.
+return if Emf::Conformance::Registry.loaded_elsewhere?(__FILE__)
+
+module Emf
+  module Conformance
+    module WmfBufferRules
+      WMF = %i[wmf].freeze
+      R = Emf::Model::Wmf::Records
+      EE = Emf::Wmf::EmbeddedEmf
+      UINT16 = 0xFFFF
+      INT16 = 0x7FFF
+      DIB_RECORDS = [R::DibBitBlt, R::DibStretchBlt, R::SetDibToDev, R::StretchDib].freeze
+      BITMAP16_RECORDS = [R::BitBlt, R::StretchBlt].freeze
+      PALETTE_RECORDS = [R::CreatePalette, R::SetPalEntries, R::AnimatePalette].freeze
+      CLIPPED_OR_OPAQUE = 0x0006
+      REGION_HEADER_BYTES = 22
+      SEQUENCE_REASONS = %i[sequence_mismatch limit_exceeded remaining_mismatch record_count_mismatch incomplete].freeze
+
+      PRESERVED = "bytes are preserved verbatim; a consumer skips the unusable part instead of rejecting the record"
+
+      module_function
+
+      def dib_layout(context)
+        each_of(context, *DIB_RECORDS) do |record|
+          next if record.bitmap.nil? || record.typed_image
+
+          "#{name(record)} DeviceIndependentBitmap does not decode: header, color table or pixel extent disagrees " \
+            "with the #{record.bitmap.bytesize} bytes carried"
+        end
+      end
+
+      def bitmap16_layout(context)
+        each_of(context, *BITMAP16_RECORDS) do |record|
+          next if record.bitmap.nil? || record.typed_image
+
+          "#{name(record)} Bitmap16 does not decode: Width, Height, Planes, BitsPixel or pixel extent disagrees " \
+            "with the #{record.bitmap.bytesize} bytes carried"
+        end
+      end
+
+      def text_length(context)
+        each_of(context, R::TextOut) do |record|
+          count = record.text.bytesize
+          if count > INT16
+            "#{name(record)} string is #{count} bytes, StringLength is a signed 16-bit count"
+          elsif (count + record.padding.bytesize).odd?
+            "#{name(record)} string and padding take #{count + record.padding.bytesize} bytes, MUST be word aligned"
+          end
+        end
+      end
+
+      # A text record with a negative StringLength cannot be framed as text, so the parser keeps it as an
+      # UnknownRecord (Wmf::Recovery); the sign is read from its own bytes.
+      def text_negative(context)
+        context.records.each_with_index.filter_map do |record, index|
+          next unless record.is_a?(R::UnknownRecord) && Emf::Wmf::Recovery.record(record.raw_bytes, record.type_id, nil)&.last == 1003
+
+          count_at = Emf::Wmf::Recovery::TEXT_COUNTS.fetch(record.type_id & 0xFF).first
+          { message: "#{record.type_id & 0xFF == 0x32 ? 'ExtTextOut' : 'TextOut'} StringLength is " \
+                     "#{record.raw_bytes.byteslice(count_at, 2).unpack1('s<')}, MUST NOT be negative",
+            offset: record.offset, record_index: index + 1, record_type: record.type_id.to_i }
+        end
+      end
+
+      # A region whose ObjectCount is two bytes wide (libUEMF) has no readable header under the spec layout, so the
+      # parser keeps it verbatim as an UnknownRecord (Wmf::Recovery).
+      def region_header(context)
+        context.records.each_with_index.filter_map do |record, index|
+          next unless record.is_a?(R::UnknownRecord) && record.type_id & 0xFF == Emf::Wmf::Recovery::REGION &&
+                      Emf::Wmf::Recovery.record(record.raw_bytes, record.type_id, nil)&.last == 1203
+
+          { message: "region header does not follow the Region Object layout (ObjectCount is not 4 bytes wide)",
+            offset: record.offset, record_index: index + 1, record_type: record.type_id.to_i }
+        end
+      end
+
+      def text_spacing(context)
+        each_of(context, R::ExtTextOut) do |record|
+          next if record.dx.nil? || record.dx.size == record.text.bytesize
+
+          "ExtTextOut has #{record.dx.size} Dx entries for a #{record.text.bytesize}-byte string, MUST match StringLength"
+        end
+      end
+
+      def text_rectangle(context)
+        each_of(context, R::ExtTextOut) do |record|
+          wanted = record.options.to_i.anybits?(CLIPPED_OR_OPAQUE)
+          next if wanted == !record.rectangle.nil?
+
+          if wanted
+            "ExtTextOut options select ETO_OPAQUE or ETO_CLIPPED but the Rectangle is absent"
+          else
+            "ExtTextOut has a Rectangle but its options select neither ETO_OPAQUE nor ETO_CLIPPED"
+          end
+        end
+      end
+
+      def palette_count(context)
+        each_of(context, *PALETTE_RECORDS, R::ResizePalette) do |record|
+          count = record.is_a?(R::ResizePalette) ? record.entry_count : record.entries.size
+          next if count.is_a?(Integer) && count.between?(0, UINT16)
+
+          "#{name(record)} entry count #{count.inspect} does not fit the unsigned 16-bit field"
+        end
+      end
+
+      def palette_entries(context)
+        each_of(context, *PALETTE_RECORDS) do |record|
+          bad = record.entries.find do |entry|
+            [entry.red, entry.green, entry.blue, entry.flags].any? { |value| !value.is_a?(Integer) || !value.between?(0, 0xFF) }
+          end
+          "#{name(record)} holds a PaletteEntry with a component outside 0..255" if bad
+        end
+      end
+
+      def palette_start(context)
+        each_of(context, R::CreatePalette) do |record|
+          format("CreatePalette Start is 0x%04X, MUST be 0x0300", record.start.to_i) unless record.start == 0x0300
+        end
+      end
+
+      def region_scans(context)
+        each_of(context, R::CreateRegion) do |record|
+          scans = record.scans
+          if scans.size > INT16
+            "region has #{scans.size} scans, ScanCount is a signed 16-bit count"
+          elsif (scan = scans.find { |item| item.lines.size * 2 > UINT16 })
+            "region scan at Top #{scan.top} has #{scan.lines.size * 2} scan points, the count is an unsigned 16-bit field"
+          end
+        end
+      end
+
+      def region_size(context)
+        each_of(context, R::CreateRegion) do |record|
+          next if record.scans.size > INT16 || record.scans.any? { |scan| scan.lines.size * 2 > UINT16 }
+
+          size = REGION_HEADER_BYTES + record.scans.sum { |scan| 8 + (scan.lines.size * 4) }
+          "region needs #{size} bytes, RegionSize is a signed 16-bit field" if size > INT16
+        end
+      end
+
+      def escape_count(context)
+        each_of(context, R::Escape) do |record|
+          bytes = record.data.bytesize
+          if bytes > UINT16
+            "Escape carries #{bytes} data bytes, ByteCount is an unsigned 16-bit field"
+          elsif record.padding.nil? == bytes.odd?
+            "Escape data of #{bytes} bytes #{bytes.odd? ? 'lacks' : 'has'} a padding byte, the record MUST stay word aligned"
+          end
+        end
+      end
+
+      def embedded_segment(context)
+        each_of(context, R::Escape) do |record|
+          record.embedded_emf_segment
+          nil
+        rescue EE::Invalid => e
+          "embedded EMF escape segment is invalid: #{e.reason}" unless e.reason == :not_embedded_emf
+        end
+      end
+
+      def embedded_sequence(context)
+        embedded_runs(context) do |run|
+          "embedded EMF escape sequence is inconsistent: #{run.error}" if SEQUENCE_REASONS.include?(run.error)
+        end
+      end
+
+      def embedded_checksum(context)
+        embedded_runs(context) do |run|
+          next unless run.stream && !run.stream.checksum_valid
+
+          "embedded EMF stream does not match the Checksum of its first escape segment"
+        end
+      end
+
+      # Findings for each run of consecutive 0x000F escapes, positioned at its first record.
+      def embedded_runs(context)
+        EE.sequences(context.records).filter_map do |run|
+          message = yield run
+          next unless message
+
+          record = context.records[run.first_record]
+          { message: message, offset: record.offset, record_index: run.first_record + 1, record_type: record.type_id.to_i }
+        end
+      end
+
+      def name(record) = record.class.name.split("::").last
+
+      def each_of(context, *classes)
+        context.records.each_with_index.filter_map do |record, index|
+          next unless classes.any? { |klass| record.is_a?(klass) }
+
+          message = yield record
+          next unless message
+
+          { message: message, offset: record.offset, record_index: index + 1, record_type: record.type_id.to_i }
+        end
+      end
+    end
+
+    # [id, method, citation, kind, tolerant_reason]
+    [
+      ["wmf.bitmap.dib_layout", :dib_layout,
+       "MS-WMF 2.2.2.9 DeviceIndependentBitmap Object; 2.3.1.2.1 META_DIBBITBLT, 2.3.1.3.1 " \
+       "META_DIBSTRETCHBLT (Target), 2.3.1.4 META_SETDIBTODEV, 2.3.1.6 META_STRETCHDIB (DIB)",
+       :buffer_layout, WmfBufferRules::PRESERVED],
+      ["wmf.bitmap.bitmap16_layout", :bitmap16_layout, "MS-WMF 2.2.2.1 Bitmap16 Object; 2.3.1.1.1 META_BITBLT, 2.3.1.5.1 META_STRETCHBLT " \
+                                                       "(Target)",
+       :buffer_layout, WmfBufferRules::PRESERVED],
+      ["wmf.text.length", :text_length, "MS-WMF 2.3.3.20 META_TEXTOUT, 2.3.3.5 META_EXTTEXTOUT (StringLength, String)",
+       :string_length, nil],
+      ["wmf.text.negative_length", :text_negative,
+       "MS-WMF 2.3.3.20 META_TEXTOUT, 2.3.3.5 META_EXTTEXTOUT (StringLength, String)", :string_length,
+       "the parser keeps the record verbatim as an opaque record; readers (LibreOffice) import the file"],
+      ["wmf.region.header", :region_header, "MS-WMF 2.2.1.5 Region Object (ObjectCount, RegionSize); 2.3.4.6 META_CREATEREGION",
+       :buffer_layout,
+       "libUEMF, the library Inkscape writes WMF with, declares ObjectCount as 2 bytes; the parser keeps the record " \
+       "verbatim as an opaque region and readers (LibreOffice) import the file"],
+      ["wmf.text.spacing_count", :text_spacing, "MS-WMF 2.3.3.5 META_EXTTEXTOUT (Dx)", :array_counts, nil],
+      ["wmf.text.rectangle_options", :text_rectangle, "MS-WMF 2.3.3.5 META_EXTTEXTOUT (fwOpts, Rectangle)", :field_dependency,
+       "readers ignore a Rectangle the options do not select"],
+      ["wmf.palette.entry_count", :palette_count,
+       "MS-WMF 2.3.4.3 META_CREATEPALETTE, 2.3.5.19 META_SETPALENTRIES, 2.3.5.1 META_ANIMATEPALETTE, " \
+       "2.3.5.9 META_RESIZEPALETTE (NumberOfEntries); 2.2.1.3 Palette Object (NumberOfEntries)",
+       :array_counts, nil],
+      ["wmf.palette.entry_fields", :palette_entries,
+       "MS-WMF 2.2.2.13 PaletteEntry Object; 2.2.1.3 Palette Object (aPaletteEntries); " \
+       "2.3.4.3 META_CREATEPALETTE, 2.3.5.19 META_SETPALENTRIES, 2.3.5.1 META_ANIMATEPALETTE",
+       :coordinate_range, nil],
+      ["wmf.palette.start", :palette_start, "MS-WMF 2.2.1.3 Palette Object (Start, MUST be 0x0300 for META_CREATEPALETTE); 2.3.4.3 " \
+                                            "META_CREATEPALETTE", :fixed_value,
+       "readers ignore the Start of a created palette"],
+      ["wmf.region.scan_counts", :region_scans, "MS-WMF 2.2.1.5 Region Object (ScanCount, aScans), 2.2.2.21 Scan Object; 2.3.4.6 " \
+                                                "META_CREATEREGION", :array_counts, nil],
+      ["wmf.region.size", :region_size, "MS-WMF 2.2.1.5 Region Object (RegionSize); 2.3.4.6 META_CREATEREGION", :buffer_layout, nil],
+      ["wmf.escape.byte_count", :escape_count, "MS-WMF 2.3.6.1 META_ESCAPE (ByteCount, EscapeData)", :byte_count, nil],
+      ["wmf.escape.embedded_emf.segment", :embedded_segment, "MS-WMF 2.3.6.25 META_ESCAPE_ENHANCED_METAFILE", :buffer_layout,
+       "producers write other data under Escape 0x000F (Micrografx Flowcharter); readers skip an embedded stream they " \
+       "cannot use and play the WMF records"],
+      ["wmf.escape.embedded_emf.sequence", :embedded_sequence,
+       "MS-WMF 2.3.6.25 META_ESCAPE_ENHANCED_METAFILE (CommentRecordCount, CurrentRecordSize, " \
+       "RemainingBytes, EnhancedMetafileDataSize)",
+       :array_counts, nil],
+      ["wmf.escape.embedded_emf.checksum", :embedded_checksum, "MS-WMF 2.3.6.25 META_ESCAPE_ENHANCED_METAFILE (Checksum)", :checksum,
+       "readers do not validate the embedded stream Checksum"]
+    ].each do |id, method, citation, kind, reason|
+      Registry.loading.register(id: id, formats: WmfBufferRules::WMF, citation: citation, kind: kind, tolerant_reason: reason) do |context|
+        WmfBufferRules.public_send(method, context)
+      end
+    end
+  end
+end

data/lib/emf/conformance/rules/wmf_framing.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+# WMF header, placeable header and record-framing rules over the accepted public
+# model (MS-WMF 2.2.2 headers, 2.3.2 control records). They read only
+# Metafile#header, Metafile#records and the input length; declared record sizes
+# are not on the public WMF model, so size rules stay blocked (see manifest).
+return if Emf::Conformance::Registry.loaded_elsewhere?(__FILE__)
+
+module Emf
+  module Conformance
+    module WmfFramingRules
+      WMF = %i[wmf].freeze
+      PLACEABLE_KEY = 0x9AC6CDD7
+      HEADER_WORDS = 9
+      PLACEABLE_BYTES = 22
+      EOF_FUNCTION = 0
+
+      module_function
+
+      def header_type(context)
+        type = context.header.type
+        return [] if [1, 2].include?(type)
+
+        [{ message: "WMF header Type is #{type.inspect}, MUST be 1 (memory) or 2 (disk)", offset: header_offset(context) }]
+      end
+
+      def header_version(context)
+        version = context.header.version
+        return [] if [0x0100, 0x0300].include?(version)
+
+        [{ message: format("WMF header Version is 0x%04X, MUST be 0x0100 or 0x0300", version.to_i), offset: header_offset(context) + 4 }]
+      end
+
+      def header_size(context)
+        words = context.header.size_words.to_i
+        found = []
+        found << "WMF header Size is #{words} words, less than the #{HEADER_WORDS}-word header" if words < HEADER_WORDS
+        if context.byte_length && (words * 2) + header_offset(context) > context.byte_length
+          found << "WMF header Size #{words} words runs past the #{context.byte_length}-byte input"
+        end
+        found.map { |message| { message: message, offset: header_offset(context) + 6 } }
+      end
+
+      def header_members(context)
+        members = context.header.number_of_members.to_i
+        return [] if members.zero?
+
+        [{ message: "WMF header NumberOfMembers is #{members}, SHOULD be 0", offset: header_offset(context) + 16 }]
+      end
+
+      # HWmf MUST be 0 only for a metafile on disk (Type 2); an in-memory metafile (Type 1) carries its handle.
+      def placeable_handle(context)
+        placeable = context.header.placeable
+        return [] unless placeable && context.header.type.to_i == 2 && !placeable.handle.to_i.zero?
+
+        [{ message: "WMF placeable HWmf is #{placeable.handle} on a disk metafile (Type 2), MUST be 0", offset: 4 }]
+      end
+
+      def placeable_checksum(context)
+        placeable = context.header.placeable
+        return [] unless placeable
+
+        expected = checksum(placeable)
+        return [] if placeable.checksum == expected
+
+        [{ message: format("WMF placeable Checksum is 0x%<actual>04X, the XOR of the preceding ten words is 0x%<expected>04X",
+                           actual: placeable.checksum.to_i, expected: expected), offset: 20 }]
+      end
+
+      def eof_missing(context)
+        last = context.records.last
+        return [] if last && last.type_id.to_i == EOF_FUNCTION
+
+        [{ message: "WMF metafile does not end with a META_EOF record", offset: last&.offset, record_index: context.records.size,
+           record_type: last&.type_id }]
+      end
+
+      def eof_not_last(context)
+        context.records.each_with_index.filter_map do |record, index|
+          next unless record.type_id.to_i == EOF_FUNCTION && index != context.records.size - 1
+
+          at(record, index, "META_EOF is followed by #{context.records.size - 1 - index} more record(s)")
+        end
+      end
+
+      def unknown_function(context)
+        context.records.each_with_index.filter_map do |record, index|
+          next unless record.is_a?(Emf::Model::Wmf::Records::UnknownRecord)
+          # A specified text function kept verbatim for its negative StringLength is reported by wmf.text.negative_length.
+          next if Emf::Wmf::Binary::TYPED_FUNCTIONS.include?(record.type_id.to_i & 0xFF)
+
+          at(record, index, format("record function 0x%04X is not a specified MS-WMF record type", record.type_id.to_i))
+        end
+      end
+
+      def trailing_bytes(context)
+        extra = context.metafile.trailing.to_s.bytesize
+        return [] if extra.zero?
+
+        [{ message: "#{extra} bytes follow the first META_EOF record", offset: context.byte_length && (context.byte_length - extra),
+           record_index: context.records.size }]
+      end
+
+      def header_offset(context) = context.header.placeable ? PLACEABLE_BYTES : 0
+
+      def checksum(placeable)
+        words = [PLACEABLE_KEY & 0xFFFF, PLACEABLE_KEY >> 16, placeable.handle, placeable.left, placeable.top, placeable.right,
+                 placeable.bottom, placeable.inch, 0, 0]
+        words.map { |word| word.to_i & 0xFFFF }.reduce(0, :^)
+      end
+
+      def at(record, index, message)
+        { message: message, offset: record.offset, record_index: index + 1, record_type: record.type_id.to_i }
+      end
+    end
+
+    registry = Registry.loading
+    [
+      ["wmf.header.type", :header_type, "MS-WMF 2.3.2.2 META_HEADER (Type); 2.1.1.18 MetafileType Enumeration", :header_type, nil],
+      ["wmf.header.version", :header_version, "MS-WMF 2.3.2.2 META_HEADER (Version); " \
+                                              "2.1.1.19 MetafileVersion Enumeration", :header_version, nil],
+      ["wmf.header.size", :header_size, "MS-WMF 2.3.2.2 META_HEADER (SizeLow, SizeHigh)", :header_size,
+       "the parser reads the records actually present and records the Size drift in Metafile#errors " \
+       "(seen in files from Inkscape)"],
+      ["wmf.header.number_of_members", :header_members, "MS-WMF 2.3.2.2 META_HEADER (NumberOfMembers)", :header_members,
+       "NumberOfMembers is reserved and no reader consults it", :warning],
+      ["wmf.placeable.handle", :placeable_handle, "MS-WMF 2.3.2.3 META_PLACEABLE (HWmf)", :placeable_handle,
+       "readers ignore the handle of an in-file placeable header"],
+      ["wmf.placeable.checksum", :placeable_checksum, "MS-WMF 2.3.2.3 META_PLACEABLE (Checksum)", :placeable_checksum,
+       "readers ignore the placeable checksum; the parser keeps the declared value and records the mismatch in " \
+       "Metafile#errors (seen in LibreOffice test files)"],
+      ["wmf.eof.missing", :eof_missing, "MS-WMF 2.3.2.1 META_EOF", :eof_missing, nil],
+      ["wmf.eof.not_last", :eof_not_last, "MS-WMF 2.3.2.1 META_EOF", :eof_not_last, nil],
+      ["wmf.record.unknown_function", :unknown_function, "MS-WMF 2.1.1.1 RecordType Enumeration; " \
+                                                         "2.3 WMF Records (unknown record types are ignored)", :unknown_function,
+       "unspecified functions are skipped by size, so the stream stays readable"],
+      ["wmf.eof.trailing_bytes", :trailing_bytes, "MS-WMF 2.3.2.2 META_HEADER (SizeLow, SizeHigh)", :trailing_bytes,
+       "bytes after the declared Size are ignored by readers"]
+    ].each do |id, method, citation, kind, reason, severity = :error|
+      registry.register(id: id, formats: WmfFramingRules::WMF, citation: citation, kind: kind, severity: severity,
+                        tolerant_reason: reason) do |context|
+        WmfFramingRules.public_send(method, context)
+      end
+    end
+  end
+end

data/lib/emf/conformance/rules/wmf_layout_records.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+# WMF rules for the fixed-layout records whose only stated constraints are their exact layout and a
+# reserved or enumerated field (MS-WMF 2.3.3 drawing, 2.3.5 state records). The parser keeps any words
+# after the last field in `suffix`, so a record can pass decoding with a RecordSize larger than its
+# layout. Records whose size is exact at decoding time (the rectangle, point and offset records of
+# Binary::FIXED_RECORDS) are checked by wmf.record.declared_size instead.
+return if Emf::Conformance::Registry.loaded_elsewhere?(__FILE__)
+
+module Emf
+  module Conformance
+    module WmfLayoutRules
+      WMF = %i[wmf].freeze
+      R = Emf::Model::Wmf::Records
+      KEPT = "the surplus words stay in the record's suffix, so nothing is dropped"
+      COLORREF_RESERVED_SHIFT = 24
+      COLORREF_CITATION = "MS-WMF 2.2.2.8 ColorRef Object (Reserved); 2.3.3.7 META_FLOODFILL, 2.3.3.19 META_SETPIXEL, " \
+                          "2.3.5.14 META_SETBKCOLOR, 2.3.5.26 META_SETTEXTCOLOR"
+
+      # record class => [parameter bytes the layout defines, section]. Each section lists the record's fields; none lists more.
+      LAYOUTS = {
+        R::FloodFill => [8, "2.3.3.7 META_FLOODFILL"], R::SetPixel => [8, "2.3.3.19 META_SETPIXEL"],
+        R::PatBlt => [12, "2.3.3.12 META_PATBLT"], R::ExcludeClipRect => [8, "2.3.5.2 META_EXCLUDECLIPRECT"],
+        R::IntersectClipRect => [8, "2.3.5.3 META_INTERSECTCLIPRECT"], R::OffsetClipRgn => [4, "2.3.5.5 META_OFFSETCLIPRGN"],
+        R::RealizePalette => [0, "2.3.5.8 META_REALIZEPALETTE"], R::SetBkColor => [4, "2.3.5.14 META_SETBKCOLOR"],
+        R::SetMapperFlags => [4, "2.3.5.18 META_SETMAPPERFLAGS"], R::SetRelAbs => [0, "2.3.5.21 META_SETRELABS"],
+        R::SetTextCharExtra => [2, "2.3.5.25 META_SETTEXTCHAREXTRA"], R::SetTextColor => [4, "2.3.5.26 META_SETTEXTCOLOR"],
+        R::SetTextJustification => [4, "2.3.5.27 META_SETTEXTJUSTIFICATION"]
+      }.freeze
+      COLOR_FIELDS = { R::SetBkColor => :color_ref, R::SetTextColor => :color_ref, R::FloodFill => :color, R::SetPixel => :color }.freeze
+
+      module_function
+
+      def layout_size(context)
+        each_of(context, *LAYOUTS.keys) do |record|
+          surplus = record.suffix.to_s.bytesize
+          next if surplus.zero?
+
+          payload, section = LAYOUTS.fetch(record.class)
+          words = 3 + ((payload + surplus) / 2)
+          note = payload.zero? ? ", the record has no parameters" : ""
+          "#{section.split.last} RecordSize is #{words} words, the layout is #{3 + (payload / 2)} words " \
+            "(#{surplus} surplus bytes#{note})"
+        end
+      end
+
+      def raster_operation(context)
+        each_of(context, R::PatBlt) do |record|
+          value = record.raster_operation.to_i
+          if value >= (1 << COLORREF_RESERVED_SHIFT)
+            next format("PatBlt RasterOperation 0x%<value>08X has bits set above the 24-bit ternary code, " \
+                        "so it is no TernaryRasterOperation value", value: value)
+          end
+
+          expected = TernaryRasterOperations.expected(value)
+          next if expected.nil? || expected == value
+
+          format("PatBlt RasterOperation 0x%<value>08X is not a TernaryRasterOperation value; " \
+                 "operation 0x%<index>02X is 0x%<expected>08X", value: value, index: (value >> 16) & 0xFF, expected: expected)
+        end
+      end
+
+      PALETTE_RESERVED = [0x01, 0x02].freeze
+
+      def colorref_reserved(context)
+        colorref_findings(context) { |reserved| !PALETTE_RESERVED.include?(reserved) }
+      end
+
+      def colorref_palette(context)
+        colorref_findings(context) { |reserved| PALETTE_RESERVED.include?(reserved) }
+      end
+
+      def colorref_findings(context)
+        each_of(context, *COLOR_FIELDS.keys) do |record|
+          value = record.public_send(COLOR_FIELDS.fetch(record.class)).to_i
+          reserved = value >> COLORREF_RESERVED_SHIFT
+          next if reserved.zero? || !yield(reserved)
+
+          format("%<name>s ColorRef 0x%<value>08X has Reserved byte 0x%<reserved>02X, MUST be 0x00",
+                 name: record.class.name.split("::").last, value: value, reserved: reserved)
+        end
+      end
+
+      def each_of(context, *classes)
+        context.records.each_with_index.filter_map do |record, index|
+          next unless classes.any? { |klass| record.instance_of?(klass) }
+
+          message = yield record
+          next unless message
+
+          { message: message, offset: record.offset, record_index: index + 1, record_type: record.type_id.to_i }
+        end
+      end
+    end
+
+    [
+      ["wmf.record.layout_size", :layout_size, :record_layout, WmfLayoutRules::KEPT,
+       "MS-WMF 2.3.3.7, 2.3.3.12, 2.3.3.19, 2.3.5.2, 2.3.5.3, 2.3.5.5, 2.3.5.8, 2.3.5.14, 2.3.5.18, 2.3.5.21, 2.3.5.25, " \
+       "2.3.5.26, 2.3.5.27 (RecordSize; the record lists no field after its last parameter)"],
+      ["wmf.fixed.raster_operation", :raster_operation, :flag_mask, nil,
+       "MS-WMF 2.3.3.12 META_PATBLT (RasterOperation); 2.1.1.31 TernaryRasterOperation Enumeration"],
+      ["wmf.fixed.colorref_reserved", :colorref_reserved, :reserved_zero, nil, WmfLayoutRules::COLORREF_CITATION],
+      ["wmf.fixed.colorref_palette", :colorref_palette, :reserved_zero,
+       "GDI writes PALETTEINDEX and PALETTERGB colors with 0x01 or 0x02 in the Reserved byte, and readers resolve them",
+       WmfLayoutRules::COLORREF_CITATION]
+    ].each do |id, method, kind, reason, citation|
+      Registry.loading.register(id: id, formats: WmfLayoutRules::WMF, citation: citation, kind: kind, tolerant_reason: reason) do |context|
+        WmfLayoutRules.public_send(method, context)
+      end
+    end
+  end
+end