emf 0.1.2 → 0.2.0

data/lib/emf/conformance/rules/wmf_objects.rb

@@ -0,0 +1,168 @@
+# frozen_string_literal: true
+
+# WMF object-table lifecycle and playback-DC depth rules over the public record
+# sequence (MS-WMF 3.1.4.1 WMF Object Table, 2.3.4 object records, 2.3.5.10
+# META_RESTOREDC). One walk replays the table exactly as the spec describes it:
+# a created object takes the lowest free index below header NumberOfObjects,
+# META_DELETEOBJECT frees it, and later records must refer to live indexes of the
+# right object type. Records the model keeps opaque (UnknownRecord) are skipped.
+return if Emf::Conformance::Registry.loaded_elsewhere?(__FILE__)
+
+module Emf
+  module Conformance
+    module WmfObjectRules
+      WMF = %i[wmf].freeze
+      R = Emf::Model::Wmf::Records
+      STOCK_FLAG = 0x8000
+      GDI_IGNORES = "GDI skips a record that names an unusable object instead of rejecting the metafile"
+
+      CREATORS = {
+        R::CreatePenIndirect => :pen, R::CreateBrushIndirect => :brush, R::CreatePatternBrush => :brush,
+        R::DibCreatePatternBrush => :brush, R::CreateFontIndirect => :font, R::CreatePalette => :palette,
+        R::CreateRegion => :region
+      }.freeze
+      REGION_USERS = [R::FillRegion, R::FrameRegion, R::InvertRegion, R::PaintRegion, R::SelectClipRegion].freeze
+      BRUSH_USERS = [R::FillRegion, R::FrameRegion].freeze
+
+      # id => [citation, tolerant_reason, kind]
+      RULES = {
+        "wmf.object.capacity" => ["MS-WMF 3.1.4.1 WMF Object Table, 2.3.2.2 META_HEADER (NumberOfObjects)", nil, :object_capacity],
+        "wmf.object.select_reference" => ["MS-WMF 2.3.4.10 META_SELECTOBJECT (ObjectIndex), 3.1.4.1; stock-object selectors " \
+                                          "(high bit 0x8000) are an implementation rule, MS-WMF defines no selector encoding",
+                                          GDI_IGNORES, :object_reference],
+        "wmf.object.delete_reference" => ["MS-WMF 2.3.4.7 META_DELETEOBJECT (ObjectIndex), 3.1.4.1; stock objects are never " \
+                                          "deleted (1.1 Glossary), the 0x8000 selector bit is an implementation rule",
+                                          GDI_IGNORES, :object_reference],
+        "wmf.object.palette_reference" => ["MS-WMF 2.3.4.11 META_SELECTPALETTE (Palette), 3.1.4.1", GDI_IGNORES, :object_type],
+        "wmf.object.region_reference" => [
+          "MS-WMF 2.3.3.6 META_FILLREGION, 2.3.3.8 META_FRAMEREGION, 2.3.3.9 META_INVERTREGION, " \
+          "2.3.3.11 META_PAINTREGION, 2.3.4.9 META_SELECTCLIPREGION (Region), 3.1.4.1", GDI_IGNORES, :object_type
+        ],
+        "wmf.object.brush_reference" => [
+          "MS-WMF 2.3.3.6 META_FILLREGION, 2.3.3.8 META_FRAMEREGION (Brush), 3.1.4.1", GDI_IGNORES, :object_type
+        ],
+        "wmf.dc.restore_depth" => ["MS-WMF 2.3.5.10 META_RESTOREDC (nSavedDC), 2.3.5.11 META_SAVEDC, 3.1.5; the outcome " \
+                                   "of an nSavedDC that names no saved context is an implementation rule, MS-WMF defines " \
+                                   "none", GDI_IGNORES, :dc_stack]
+      }.freeze
+
+      module_function
+
+      # Replays the record sequence and returns [rule_id, record, index, message] findings.
+      def walk(context)
+        table = Table.new(context.header.number_of_objects.to_i)
+        found = []
+        context.records.each_with_index do |record, index|
+          table.step(record) { |id, message| found << [id, record, index + 1, message] }
+        end
+        found
+      end
+
+      def findings(context, id)
+        walk(context).filter_map do |rule_id, record, index, message|
+          next unless rule_id == id
+
+          { message: message, offset: record.offset, record_index: index, record_type: record.type_id.to_i }
+        end
+      end
+
+      # The conceptual WMF Object Table of MS-WMF 3.1.4.1 plus the SaveDC depth.
+      class Table
+        def initialize(capacity)
+          @capacity = capacity
+          @slots = []
+          @next_free = 0
+          @saved = 0
+        end
+
+        def step(record, &)
+          kind = CREATORS.find { |klass, _| record.is_a?(klass) }&.last
+          return create(kind, &) if kind
+
+          case record
+          when R::SelectObject then select_object(record, &)
+          when R::DeleteObject then delete_object(record, &)
+          when R::SelectPalette then expect(record.object_index, :palette, "palette", "wmf.object.palette_reference", &)
+          when R::FillRegion, R::FrameRegion then fill_region(record, &)
+          when *REGION_USERS then expect(record.object_index, :region, "region", "wmf.object.region_reference", &)
+          when R::SaveDc, R::RestoreDc then device_context(record, &)
+          end
+        end
+
+        private
+
+        def live(index) = index.negative? ? nil : @slots[index]
+
+        def create(kind)
+          @next_free += 1 while @next_free < @capacity && @slots[@next_free]
+          if @next_free < @capacity
+            @slots[@next_free] = kind
+            @next_free += 1
+          else
+            yield "wmf.object.capacity", "#{kind} object has no free WMF Object Table index; " \
+                                         "NumberOfObjects is #{@capacity} and every index is in use"
+          end
+        end
+
+        def select_object(record)
+          index = record.object_index.to_i
+          return if index.anybits?(STOCK_FLAG) # stock objects live outside the metafile table
+          return if live(index)
+
+          yield "wmf.object.select_reference", "SelectObject index #{index} names no live object in the WMF Object Table"
+        end
+
+        def delete_object(record)
+          index = record.object_index.to_i
+          if index.anybits?(STOCK_FLAG)
+            yield "wmf.object.delete_reference", "DeleteObject index 0x#{index.to_s(16).upcase} is a stock object, which cannot be deleted"
+          elsif live(index)
+            @slots[index] = nil
+            @next_free = index if index < @next_free
+          else
+            yield "wmf.object.delete_reference", "DeleteObject index #{index} names no live object in the WMF Object Table"
+          end
+        end
+
+        def fill_region(record, &)
+          expect(record.region_index, :region, "region", "wmf.object.region_reference", &)
+          expect(record.brush_index, :brush, "brush", "wmf.object.brush_reference", &)
+        end
+
+        def expect(index, kind, label, id)
+          index = index.to_i
+          found = live(index)
+          if found.nil?
+            yield id, "#{label} index #{index} names no live object in the WMF Object Table"
+          elsif found != kind
+            yield id, "#{label} index #{index} refers to a #{found} object, MUST refer to a #{kind} object"
+          end
+        end
+
+        def device_context(record, &)
+          return @saved += 1 if record.is_a?(R::SaveDc)
+
+          restore(record.saved_dc.to_i, &)
+        end
+
+        def restore(saved_dc)
+          depth = if saved_dc.negative? then @saved + saved_dc
+                  elsif saved_dc.positive? && saved_dc <= @saved then saved_dc - 1
+                  end
+          if depth&.>=(0)
+            @saved = depth
+          else
+            yield "wmf.dc.restore_depth", "RestoreDc nSavedDC #{saved_dc} names no saved device context (#{@saved} saved)"
+          end
+        end
+      end
+    end
+
+    registry = Registry.loading
+    WmfObjectRules::RULES.each do |id, (citation, reason, kind)|
+      registry.register(id: id, formats: WmfObjectRules::WMF, citation: citation, kind: kind, tolerant_reason: reason) do |context|
+        WmfObjectRules.findings(context, id)
+      end
+    end
+  end
+end

data/lib/emf/conformance/rules/wmf_records.rb

@@ -0,0 +1,191 @@
+# frozen_string_literal: true
+
+# WMF fixed-field, enum and point-array rules over typed public records
+# (MS-WMF 2.3.3 drawing, 2.3.4 object, 2.3.5 state records). Records the model
+# keeps opaque (UnknownRecord) are never judged here.
+return if Emf::Conformance::Registry.loaded_elsewhere?(__FILE__)
+
+module Emf
+  module Conformance
+    module WmfRecordRules
+      WMF = %i[wmf].freeze
+      R = Emf::Model::Wmf::Records
+      IGNORED = "GDI ignores an out-of-range value instead of rejecting the record"
+
+      # id => [record class, field, valid values (Range/Array), citation, name of the enumeration]
+      ENUMS = {
+        "wmf.enum.bk_mode" => [R::SetBkMode, :mode, [1, 2], "MS-WMF 2.1.1.20 MixMode Enumeration; " \
+                                                            "2.3.5.15 META_SETBKMODE (BkMode)", "MixMode"],
+        "wmf.enum.map_mode" => [R::SetMapMode, :mode, (1..8), "MS-WMF 2.1.1.16 MapMode Enumeration; " \
+                                                              "2.3.5.17 META_SETMAPMODE (MapMode)", "MapMode"],
+        "wmf.enum.poly_fill_mode" => [R::SetPolyFillMode, :mode, [1, 2], "MS-WMF 2.1.1.25 PolyFillMode Enumeration; " \
+                                                                         "2.3.5.20 META_SETPOLYFILLMODE (PolyFillMode)",
+                                      "PolyFillMode"],
+        "wmf.enum.rop2" => [R::SetRop2, :mode, (1..16), "MS-WMF 2.1.1.2 BinaryRasterOperation Enumeration; " \
+                                                        "2.3.5.22 META_SETROP2 (DrawMode)", "BinaryRasterOperation"],
+        "wmf.enum.stretch_blt_mode" => [R::SetStretchBltMode, :mode, (1..4), "MS-WMF 2.1.1.30 StretchMode Enumeration; " \
+                                                                             "2.3.5.23 META_SETSTRETCHBLTMODE (StretchMode)",
+                                        "StretchMode"],
+        "wmf.enum.ext_flood_fill_mode" => [R::ExtFloodFill, :mode, [0, 1], "MS-WMF 2.1.1.9 FloodFill Enumeration; " \
+                                                                           "2.3.3.4 META_EXTFLOODFILL (Mode)", "FloodFill"],
+        "wmf.enum.brush_style" => [R::CreateBrushIndirect, :brush_style, (0..9), "MS-WMF 2.1.1.4 BrushStyle Enumeration; " \
+                                                                                 "2.3.4.1 META_CREATEBRUSHINDIRECT, " \
+                                                                                 "2.2.2.10 LogBrush Object (BrushStyle)",
+                                   "BrushStyle"]
+      }.freeze
+
+      BS_PATTERN = 3
+      COLOR_USAGE = [R::DibCreatePatternBrush, R::SetDibToDev, R::StretchDib].freeze
+      TEXT_ALIGN_MASK = 0x011F
+      HORIZONTAL_ALIGN = [0x0, 0x2, 0x6].freeze # TA_LEFT, TA_RIGHT, TA_CENTER (bit 0x4 alone is no value)
+      VERTICAL_ALIGN = [0x0, 0x8, 0x18].freeze  # TA_TOP, TA_BOTTOM, TA_BASELINE (bit 0x10 alone is no value)
+      LAYOUT_MASK = 0x0009 # LAYOUT_RTL | LAYOUT_BITMAPORIENTATIONPRESERVED; LAYOUT_LTR is 0
+      PEN_CAPS = [0x0000, 0x0100, 0x0200].freeze
+      PEN_JOINS = [0x0000, 0x1000, 0x2000].freeze
+
+      module_function
+
+      def enum(context, klass, field, domain, name)
+        each_of(context, klass) do |record|
+          value = record.public_send(field)
+          next if domain.include?(value)
+
+          "#{klass.name.split('::').last} #{field} is #{value.inspect}, not a #{name} value"
+        end
+      end
+
+      def color_usage(context)
+        each_of(context, *COLOR_USAGE) do |record|
+          value = record.color_usage
+          # META_DIBCREATEPATTERNBRUSH: with Style BS_PATTERN, DIB_RGB_COLORS is used regardless of this field.
+          next if record.is_a?(R::DibCreatePatternBrush) && record.style == BS_PATTERN
+          next if [0, 1, 2].include?(value)
+
+          "color usage is #{value.inspect}, MUST be DIB_RGB_COLORS, DIB_PAL_COLORS or DIB_PAL_INDICES"
+        end
+      end
+
+      def hatch_style(context)
+        each_of(context, R::CreateBrushIndirect) do |record|
+          next unless record.brush_style == 2 && !(0..5).cover?(record.brush_hatch)
+
+          "BS_HATCHED brush has HatchStyle #{record.brush_hatch.inspect}, MUST be 0..5"
+        end
+      end
+
+      def pen_style(context)
+        each_of(context, R::CreatePenIndirect) do |record|
+          style = record.pen_style.to_i
+          next if (style & 0xF) <= 8 && PEN_CAPS.include?(style & 0x0F00) && PEN_JOINS.include?(style & 0xF000)
+
+          format("pen style 0x%04X is not a PenStyle style, end-cap and join combination", style)
+        end
+      end
+
+      def text_align(context)
+        each_of(context, R::SetTextAlign) do |record|
+          value = record.alignment.to_i
+          if value.anybits?(~TEXT_ALIGN_MASK)
+            format("text alignment 0x%04X sets bits outside the TextAlignmentMode flags", value)
+          elsif !HORIZONTAL_ALIGN.include?(value & 0x6)
+            "text alignment 0x#{hex(value, 4)} has horizontal bits 0x#{(value & 0x6).to_s(16).upcase}, " \
+              "MUST be TA_LEFT, TA_RIGHT or TA_CENTER"
+          elsif !VERTICAL_ALIGN.include?(value & 0x18)
+            "text alignment 0x#{hex(value, 4)} has vertical bits 0x#{hex(value & 0x18, 2)}, " \
+              "MUST be TA_TOP, TA_BOTTOM or TA_BASELINE"
+          end
+        end
+      end
+
+      def hex(value, width) = value.to_s(16).upcase.rjust(width, "0")
+
+      def layout(context)
+        each_of(context, R::SetLayout) do |record|
+          next if record.layout.to_i.nobits?(~LAYOUT_MASK)
+
+          format("layout 0x%04X sets bits outside the Layout flags", record.layout.to_i)
+        end
+      end
+
+      def point_count(context)
+        each_of(context, R::Polygon, R::Polyline) do |record|
+          count = record.points.size
+          if count > 0x7FFF
+            "#{count} points do not fit the signed 16-bit NumberOfPoints"
+          elsif record.is_a?(R::Polygon) && count == 1
+            "polygon has #{count} point(s), MUST have at least 2"
+          end
+        end
+      end
+
+      # NumberOfPoints 0 is the one count below 2 the parser keeps (Wmf::Recovery); it draws nothing.
+      def polygon_empty(context)
+        each_of(context, R::Polygon) { |record| "polygon has no points, MUST have at least 2" if record.points.empty? }
+      end
+
+      def polypolygon_counts(context)
+        each_of(context, R::PolyPolygon) do |record|
+          counts = record.points_per_polygon
+          if counts.size > 0xFFFF
+            "#{counts.size} polygons do not fit the unsigned 16-bit NumberOfPolygons"
+          elsif counts.sum != record.points.size
+            "PolyPolygon counts add up to #{counts.sum} points but the record holds #{record.points.size}"
+          elsif counts.any? { |count| count > 0xFFFF }
+            "a PolyPolygon polygon count exceeds the unsigned 16-bit range"
+          end
+        end
+      end
+
+      def point_range(context)
+        each_of(context, R::Polygon, R::Polyline, R::PolyPolygon) do |record|
+          bad = record.points.find { |point| !(-0x8000..0x7FFF).cover?(point.x) || !(-0x8000..0x7FFF).cover?(point.y) }
+          "point (#{bad.x}, #{bad.y}) is outside the signed 16-bit coordinate range" if bad
+        end
+      end
+
+      def each_of(context, *classes)
+        context.records.each_with_index.filter_map do |record, index|
+          next unless classes.any? { |klass| record.is_a?(klass) }
+
+          message = yield record
+          next unless message
+
+          { message: message, offset: record.offset, record_index: index + 1, record_type: record.type_id.to_i }
+        end
+      end
+    end
+
+    registry = Registry.loading
+    WmfRecordRules::ENUMS.each do |id, (klass, field, domain, citation, name)|
+      registry.register(id: id, formats: WmfRecordRules::WMF, citation: citation, kind: :enum_domain,
+                        tolerant_reason: WmfRecordRules::IGNORED) do |context|
+        WmfRecordRules.enum(context, klass, field, domain, name)
+      end
+    end
+    [
+      ["wmf.enum.color_usage", :color_usage,
+       "MS-WMF 2.1.1.6 ColorUsage Enumeration; " \
+       "2.3.4.8 META_DIBCREATEPATTERNBRUSH, 2.3.1.4 META_SETDIBTODEV, 2.3.1.6 META_STRETCHDIB (ColorUsage)",
+       :enum_domain, WmfRecordRules::IGNORED],
+      ["wmf.enum.hatch_style", :hatch_style, "MS-WMF 2.1.1.12 HatchStyle Enumeration; " \
+                                             "2.2.2.10 LogBrush Object (BrushHatch), 2.3.4.1 META_CREATEBRUSHINDIRECT", :enum_domain, WmfRecordRules::IGNORED],
+      ["wmf.enum.pen_style", :pen_style, "MS-WMF 2.1.1.23 PenStyle Enumeration; " \
+                                         "2.2.1.4 Pen Object (PenStyle), 2.3.4.5 META_CREATEPENINDIRECT", :enum_domain, WmfRecordRules::IGNORED],
+      ["wmf.flags.text_align", :text_align, "MS-WMF 2.1.2.3 TextAlignmentMode Flags, 2.1.2.4 VerticalTextAlignmentMode Flags; " \
+                                            "2.3.5.24 META_SETTEXTALIGN (TextAlignmentMode)", :flag_mask, WmfRecordRules::IGNORED],
+      ["wmf.flags.layout", :layout, "MS-WMF 2.1.1.13 Layout Enumeration; " \
+                                    "2.3.5.16 META_SETLAYOUT (Layout)", :flag_mask, WmfRecordRules::IGNORED],
+      ["wmf.array.point_count", :point_count, "MS-WMF 2.3.3.14 META_POLYLINE, 2.3.3.15 META_POLYGON (NumberOfPoints)", :point_count, nil],
+      ["wmf.array.polypolygon_counts", :polypolygon_counts, "MS-WMF 2.2.2.17 PolyPolygon Object (NumberOfPolygons, aPointsPerPolygon); " \
+                                                            "2.3.3.16 META_POLYPOLYGON",
+       :array_counts, nil],
+      ["wmf.array.polygon_empty", :polygon_empty, "MS-WMF 2.3.3.15 META_POLYGON (NumberOfPoints)", :point_count,
+       "PowerPoint writes a polygon with no points (Apache POI empty-polygon-close.wmf); readers draw nothing and import the file"],
+      ["wmf.fixed.point_range", :point_range, "MS-WMF 2.2.2.16 PointS Object", :coordinate_range, nil]
+    ].each do |id, method, citation, kind, reason|
+      registry.register(id: id, formats: WmfRecordRules::WMF, citation: citation, kind: kind, tolerant_reason: reason) do |context|
+        WmfRecordRules.public_send(method, context)
+      end
+    end
+  end
+end

data/lib/emf/conformance/rules/wmf_rejections.rb

@@ -0,0 +1,184 @@
+# frozen_string_literal: true
+
+# WMF rejected-input diagnostics and declared-size rules.
+#
+# Rejections: a WMF the parser refuses never becomes a Metafile, so the lens context is :unparseable and holds the
+# exception. Its neutral Emf::ParseEvidence (check, offset, declared, actual) names the reason; each reason with a
+# `wmf.reject.rNNNN` row becomes one finding citing that row. Rejection is a no-model outcome, so strict and
+# tolerant both report an error (no tolerant_reason), like emf.parse.unparseable. Reasons that cannot surface
+# are left to emf.parse.unparseable: 101 and 401 need a 200 MiB or million-record input, and 301-303 are shadowed by
+# the format detector, which turns such inputs into :unrecognised_signature before any WMF check runs. 305 (header
+# Size) and 1801 (MaxRecord) are not rejections: the parser recovers, keeps the model and records the drift in
+# Metafile#errors, so the declared-size rules below (wmf.header.size_matches_records, wmf.header.max_record) report
+# it, as a warning in the tolerant profile. The same holds for 203 (reported by wmf.placeable.checksum), 406, 701
+# (a font short of its face name) and 801 (an object record with surplus bytes), reported by wmf.record.declared_size,
+# 1003 (wmf.text.negative_length), and 1702 and the clip/paint/invert part of 1704 (the wmf.object.*_reference rules).
+# 701, 801 and 1704 stay rejections for the shapes that cannot be recovered.
+#
+# Declared size: on an accepted model each record carries the rdSize read from the source file
+# (Record#declared_size_words, nil for records built in memory). The rules compare it with the layout and with the
+# header's MaxRecord and Size.
+return if Emf::Conformance::Registry.loaded_elsewhere?(__FILE__)
+
+module Emf
+  module Conformance
+    module WmfRejectionRules
+      WMF = %i[wmf unparseable].freeze
+      SHADOWED = [101, 401, 301, 302, 303].freeze
+      FUNCTION_OFFSET = 4
+      FIRST_RECORD_REASON = 402
+
+      # evidence check => reason code, for every reason that can produce a named finding
+      CHECKS = Emf::Wmf::Evidence::REASONS.except(*SHADOWED, *Emf::Wmf::Evidence::DRIFT_REASONS,
+                                                  *Emf::Wmf::Evidence::RETIRED_REASONS).to_h do |reason, (check, _text)|
+        [check, reason]
+      end.freeze
+
+      module_function
+
+      def id(reason) = format("wmf.reject.r%04d", reason)
+
+      # The reason code a parse failure names, or nil when the failure is not a rejection with a wmf.reject row.
+      def reason_for(failure)
+        CHECKS[failure&.evidence&.check]
+      end
+
+      def findings(context, reason)
+        failure = context.parse_failure
+        return [] unless reason_for(failure) == reason
+
+        evidence = failure.evidence
+        [{ message: message(reason, evidence), offset: evidence.offset, record_type: function(context.bytes, evidence, reason) }]
+      end
+
+      def message(reason, evidence)
+        text = Emf::Wmf::Evidence::REASONS.fetch(reason).last.sub("%d") { evidence.declared.to_s }
+        values = { declared: evidence.declared, actual: evidence.actual }.compact.map { |name, value| "#{name} #{value}" }
+        "#{text} at offset #{evidence.offset}#{" (#{values.join(', ')})" unless values.empty?}"
+      end
+
+      # Record function word of the failing record, for record-level reasons whose bytes are available.
+      def function(bytes, evidence, reason)
+        return if reason < FIRST_RECORD_REASON || bytes.nil? || evidence.offset.nil?
+        return if evidence.offset + FUNCTION_OFFSET + 2 > bytes.bytesize
+
+        bytes.unpack1("v", offset: evidence.offset + FUNCTION_OFFSET)
+      end
+    end
+
+    module WmfDeclaredSizeRules
+      WMF = %i[wmf].freeze
+      R = Emf::Model::Wmf::Records
+      B = Emf::Wmf::Binary
+      MIN_WORDS = 3
+      HEADER_WORDS = 9
+      SIZE_RECOVERY = "the parser recovers by framing the record with its RecordSize: surplus bytes after an EOF or an " \
+                      "object payload are ignored and a font face name shorter than 32 bytes is zero-padded; the " \
+                      "departure is recorded in Metafile#errors (seen in LibreOffice test files)"
+      HEADER_DRIFT = "the parser recovered: the model is built from the records actually present and the header drift " \
+                     "is recorded in Metafile#errors (seen in files from Inkscape and ImageMagick)"
+
+      module_function
+
+      # [exact?, words] the record layout requires, or nil when the layout leaves the size open.
+      def layout(record)
+        case record
+        when R::Eof then [true, MIN_WORDS]
+        when R::CreateFontIndirect, *B::STATE_RECORDS.values then [false, MIN_WORDS + (record.class::PAYLOAD_BYTES / 2)]
+        when *B::FIXED_RECORDS.values then [true, MIN_WORDS + record.class::WIRE_FIELDS.length]
+        when *B::OBJECT_RECORDS.values then [true, MIN_WORDS + (record.class::PAYLOAD_BYTES / 2)]
+        end
+      end
+
+      def declared_size(context)
+        context.records.each_with_index.filter_map do |record, index|
+          words = record.declared_size_words
+          next unless words
+
+          problem = size_problem(record, words)
+          at(record, index, problem) if problem
+        end
+      end
+
+      def size_problem(record, words)
+        return "RecordSize is #{words} words, a record is at least #{MIN_WORDS} words" if words < MIN_WORDS
+
+        exact, expected = layout(record)
+        return unless expected
+
+        name = record.class.name.split("::").last
+        return "RecordSize is #{words} words, the #{name} layout is #{expected} words" if exact && words != expected
+        return unless !exact && words < expected
+
+        "RecordSize is #{words} words, the #{name} layout needs at least #{expected} words"
+      end
+
+      def buffer_declared_size(context)
+        context.records.each_with_index.filter_map do |record, index|
+          words = record.declared_size_words
+          encoded = words && buffer_words(record)
+          next unless encoded && encoded != words
+
+          at(record, index, "RecordSize is #{words} words but the #{record.class.name.split('::').last} buffers occupy #{encoded} words")
+        end
+      end
+
+      def buffer_words(record)
+        return unless B.prefix_codec(record) || record.is_a?(R::TextOut)
+
+        Emf::Wmf::Serializer.serialize_record(record).bytesize / 2
+      rescue Emf::SerializeError
+        nil
+      end
+
+      def max_record(context)
+        sizes = context.records.map(&:declared_size_words)
+        return [] if sizes.empty? || sizes.any?(&:nil?)
+
+        largest = sizes.max
+        declared = context.header.max_record_words.to_i
+        return [] if declared == largest
+
+        [{ message: "WMF header MaxRecord is #{declared} words, the largest record is #{largest} words",
+           offset: context.header.placeable ? 34 : 12 }]
+      end
+
+      def size_matches_records(context)
+        sizes = context.records.map(&:declared_size_words)
+        return [] if sizes.empty? || sizes.any?(&:nil?)
+
+        total = HEADER_WORDS + sizes.sum
+        declared = context.header.size_words.to_i
+        return [] if declared == total
+
+        [{ message: "WMF header Size is #{declared} words, the header and the records add up to #{total} words",
+           offset: context.header.placeable ? 28 : 6 }]
+      end
+
+      def at(record, index, message)
+        { message: message, offset: record.offset, record_index: index + 1, record_type: record.type_id.to_i }
+      end
+    end
+
+    registry = Registry.loading
+    manifest = Manifest.rows.to_h { |row| [row.id, row.citation] }
+    WmfRejectionRules::CHECKS.each do |check, reason|
+      id = WmfRejectionRules.id(reason)
+      registry.register(id: id, formats: WmfRejectionRules::WMF, citation: manifest.fetch(id), kind: check) do |context|
+        WmfRejectionRules.findings(context, reason)
+      end
+    end
+
+    [
+      ["wmf.record.declared_size", :declared_size, :declared_size, WmfDeclaredSizeRules::SIZE_RECOVERY],
+      ["wmf.buffer.declared_size", :buffer_declared_size, :buffer_declared_size],
+      ["wmf.header.max_record", :max_record, :max_record, WmfDeclaredSizeRules::HEADER_DRIFT],
+      ["wmf.header.size_matches_records", :size_matches_records, :size_matches_records, WmfDeclaredSizeRules::HEADER_DRIFT]
+    ].each do |id, method, kind, tolerant_reason|
+      registry.register(id: id, formats: WmfDeclaredSizeRules::WMF, citation: manifest.fetch(id), kind: kind,
+                        tolerant_reason: tolerant_reason) do |context|
+        WmfDeclaredSizeRules.public_send(method, context)
+      end
+    end
+  end
+end

data/lib/emf/conformance/runner.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require "pathname"
+
+module Emf
+  module Conformance
+    # Parses the input through the normal entry point and applies every rule
+    # that matches the metafile's format.
+    class Runner
+      def initialize(profile, registry)
+        @profile = profile
+        @registry = registry
+      end
+
+      def call(input, now:)
+        filename, bytes, metafile = load(input)
+        context = build_context(metafile, bytes)
+        Report.new(filename: filename, profile: @profile.name, timestamp: now, diagnostics: diagnostics(context))
+      end
+
+      private
+
+      def load(input)
+        case input
+        when Model::Metafile then [nil, nil, input]
+        when Pathname then [input.to_s, File.binread(input), nil]
+        when String then path?(input) ? [input, File.binread(input), nil] : [nil, input.b, nil]
+        else raise ArgumentError, "expected a String, Pathname or Emf::Model::Metafile, got #{input.class}"
+        end
+      end
+
+      def path?(input)
+        input.encoding.ascii_compatible? && !input.include?("\0") && input.bytesize < 4096 && File.file?(input)
+      end
+
+      def build_context(metafile, bytes)
+        return Context.new(metafile: metafile, bytes: bytes) if metafile
+
+        Context.new(metafile: Emf.parse(bytes), bytes: bytes)
+      rescue Emf::Native::Unavailable
+        raise
+      rescue Emf::Error => e
+        Context.new(bytes: bytes, parse_failure: e)
+      end
+
+      def diagnostics(context)
+        found = @registry.rules_for(context.format).flat_map do |rule|
+          rule.findings(context).map { |finding| diagnostic(rule, finding) }
+        end
+        found.each_with_index.sort_by { |d, index| [d.offset || -1, d.requirement_id, index] }.map(&:first)
+      end
+
+      def diagnostic(rule, finding)
+        Diagnostic.new(requirement_id: rule.id, spec_citation: rule.citation, severity: @profile.severity_for(rule),
+                       kind: rule.kind, format: rule.formats.first, offset: finding[:offset], record_index: finding[:record_index],
+                       record_type: finding[:record_type], message: finding.fetch(:message),
+                       waiver: @profile.waiver_for(rule))
+      end
+    end
+  end
+end

data/lib/emf/conformance/ternary_raster_operations.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module Emf
+  module Conformance
+    # The TernaryRasterOperation values of MS-WMF 2.1.1.31, keyed by their operation index (bits 16..23).
+    # Extracted from the specification's per-operation "Reverse Polish" entries (all 256), normalising the text's
+    # formatting slips: DPSOAN is printed with nine digits (000570389) and SPDNOX with seven (0390604).
+    module TernaryRasterOperations
+      # rubocop:disable-next Metrics/CollectionLiteralLength -- the specification's table; kept in Ruby so the gem ships it
+      VALUES = [
+        0x0000_0042, 0x0001_0289, 0x0002_0C89, 0x0003_00AA, 0x0004_0C88, 0x0005_00A9, 0x0006_0865, 0x0007_02C5,
+        0x0008_0F08, 0x0009_0245, 0x000A_0329, 0x000B_0B2A, 0x000C_0324, 0x000D_0B25, 0x000E_08A5, 0x000F_0001,
+        0x0010_0C85, 0x0011_00A6, 0x0012_0868, 0x0013_02C8, 0x0014_0869, 0x0015_02C9, 0x0016_5CCA, 0x0017_1D54,
+        0x0018_0D59, 0x0019_1CC8, 0x001A_06C5, 0x001B_0768, 0x001C_06CA, 0x001D_0766, 0x001E_01A5, 0x001F_0385,
+        0x0020_0F09, 0x0021_0248, 0x0022_0326, 0x0023_0B24, 0x0024_0D55, 0x0025_1CC5, 0x0026_06C8, 0x0027_1868,
+        0x0028_0369, 0x0029_16CA, 0x002A_0CC9, 0x002B_1D58, 0x002C_0784, 0x002D_060A, 0x002E_064A, 0x002F_0E2A,
+        0x0030_032A, 0x0031_0B28, 0x0032_0688, 0x0033_0008, 0x0034_06C4, 0x0035_1864, 0x0036_01A8, 0x0037_0388,
+        0x0038_078A, 0x0039_0604, 0x003A_0644, 0x003B_0E24, 0x003C_004A, 0x003D_18A4, 0x003E_1B24, 0x003F_00EA,
+        0x0040_0F0A, 0x0041_0249, 0x0042_0D5D, 0x0043_1CC4, 0x0044_0328, 0x0045_0B29, 0x0046_06C6, 0x0047_076A,
+        0x0048_0368, 0x0049_16C5, 0x004A_0789, 0x004B_0605, 0x004C_0CC8, 0x004D_1954, 0x004E_0645, 0x004F_0E25,
+        0x0050_0325, 0x0051_0B26, 0x0052_06C9, 0x0053_0764, 0x0054_08A9, 0x0055_0009, 0x0056_01A9, 0x0057_0389,
+        0x0058_0785, 0x0059_0609, 0x005A_0049, 0x005B_18A9, 0x005C_0649, 0x005D_0E29, 0x005E_1B29, 0x005F_00E9,
+        0x0060_0365, 0x0061_16C6, 0x0062_0786, 0x0063_0608, 0x0064_0788, 0x0065_0606, 0x0066_0046, 0x0067_18A8,
+        0x0068_58A6, 0x0069_0145, 0x006A_01E9, 0x006B_178A, 0x006C_01E8, 0x006D_1785, 0x006E_1E28, 0x006F_0C65,
+        0x0070_0CC5, 0x0071_1D5C, 0x0072_0648, 0x0073_0E28, 0x0074_0646, 0x0075_0E26, 0x0076_1B28, 0x0077_00E6,
+        0x0078_01E5, 0x0079_1786, 0x007A_1E29, 0x007B_0C68, 0x007C_1E24, 0x007D_0C69, 0x007E_0955, 0x007F_03C9,
+        0x0080_03E9, 0x0081_0975, 0x0082_0C49, 0x0083_1E04, 0x0084_0C48, 0x0085_1E05, 0x0086_17A6, 0x0087_01C5,
+        0x0088_00C6, 0x0089_1B08, 0x008A_0E06, 0x008B_0666, 0x008C_0E08, 0x008D_0668, 0x008E_1D7C, 0x008F_0CE5,
+        0x0090_0C45, 0x0091_1E08, 0x0092_17A9, 0x0093_01C4, 0x0094_17AA, 0x0095_01C9, 0x0096_0169, 0x0097_588A,
+        0x0098_1888, 0x0099_0066, 0x009A_0709, 0x009B_07A8, 0x009C_0704, 0x009D_07A6, 0x009E_16E6, 0x009F_0345,
+        0x00A0_00C9, 0x00A1_1B05, 0x00A2_0E09, 0x00A3_0669, 0x00A4_1885, 0x00A5_0065, 0x00A6_0706, 0x00A7_07A5,
+        0x00A8_03A9, 0x00A9_0189, 0x00AA_0029, 0x00AB_0889, 0x00AC_0744, 0x00AD_06E9, 0x00AE_0B06, 0x00AF_0229,
+        0x00B0_0E05, 0x00B1_0665, 0x00B2_1974, 0x00B3_0CE8, 0x00B4_070A, 0x00B5_07A9, 0x00B6_16E9, 0x00B7_0348,
+        0x00B8_074A, 0x00B9_06E6, 0x00BA_0B09, 0x00BB_0226, 0x00BC_1CE4, 0x00BD_0D7D, 0x00BE_0269, 0x00BF_08C9,
+        0x00C0_00CA, 0x00C1_1B04, 0x00C2_1884, 0x00C3_006A, 0x00C4_0E04, 0x00C5_0664, 0x00C6_0708, 0x00C7_07AA,
+        0x00C8_03A8, 0x00C9_0184, 0x00CA_0749, 0x00CB_06E4, 0x00CC_0020, 0x00CD_0888, 0x00CE_0B08, 0x00CF_0224,
+        0x00D0_0E0A, 0x00D1_066A, 0x00D2_0705, 0x00D3_07A4, 0x00D4_1D78, 0x00D5_0CE9, 0x00D6_16EA, 0x00D7_0349,
+        0x00D8_0745, 0x00D9_06E8, 0x00DA_1CE9, 0x00DB_0D75, 0x00DC_0B04, 0x00DD_0228, 0x00DE_0268, 0x00DF_08C8,
+        0x00E0_03A5, 0x00E1_0185, 0x00E2_0746, 0x00E3_06EA, 0x00E4_0748, 0x00E5_06E5, 0x00E6_1CE8, 0x00E7_0D79,
+        0x00E8_1D74, 0x00E9_5CE6, 0x00EA_02E9, 0x00EB_0849, 0x00EC_02E8, 0x00ED_0848, 0x00EE_0086, 0x00EF_0A08,
+        0x00F0_0021, 0x00F1_0885, 0x00F2_0B05, 0x00F3_022A, 0x00F4_0B0A, 0x00F5_0225, 0x00F6_0265, 0x00F7_08C5,
+        0x00F8_02E5, 0x00F9_0845, 0x00FA_0089, 0x00FB_0A09, 0x00FC_008A, 0x00FD_0A0A, 0x00FE_02A9, 0x00FF_0062
+      ].freeze
+      BY_INDEX = VALUES.to_h { |value| [(value >> 16) & 0xFF, value] }.freeze
+
+      module_function
+
+      # The specified value for this operation index.
+      def expected(value) = BY_INDEX[(value >> 16) & 0xFF]
+    end
+  end
+end