emf 0.1.2 → 0.2.0

data/lib/emf/emr/filled_record.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module Emf
+  module Emr
+    # The lazy source of a fixed-layout or point-array record that is only its
+    # bytes: a WireAdapter over it holds the frozen input and the record's
+    # span, and makes no BinData wire until `#wire` is asked for. `#values`
+    # reads the bytes directly. Materialising reads the span with the same
+    # FastFill the eager parse uses, so the wire is the one a parse makes.
+    class FilledRecord
+      EMPTY_SUFFIX = "".b.freeze
+      private_constant :EMPTY_SUFFIX
+
+      # The source for the record at `offset` of the frozen binary `data`,
+      # or nil when it needs the eager parse: no fixed-layout filler, a span
+      # shorter than the layout, a point count past the span, or a header
+      # disagreeing with the span. The caller has checked the span against
+      # `data`.
+      def self.for(type_id, offset, length, data)
+        filler = Binary::FastFill.for(type_id) || Binary::FastFill.for_points(type_id)
+        return unless filler && length >= filler.size && filler.fits?(data, offset, length)
+
+        new(filler, data, offset, length, type_id)
+      end
+
+      def initialize(filler, data, offset, length, type_id)
+        @filler = filler
+        @data = data
+        @offset = offset
+        @length = length
+        @type_id = type_id
+      end
+
+      attr_reader :length
+
+      # The Ruby parser has always answered a BinData Uint32le here (the wire's
+      # i_type), so a byte-backed record keeps that type.
+      def type_id
+        BinData::Uint32le.new(@type_id)
+      end
+
+      def to_binary_s
+        @data.byteslice(@offset, @length)
+      end
+
+      def append_to(out)
+        out << to_binary_s
+      end
+
+      def wire_class
+        @filler.wire_class
+      end
+
+      # [frozen binary data, record offset, untouched]: the bytes the wire is
+      # filled from, and no wire exists yet.
+      def value_source
+        [@data, @offset, true]
+      end
+
+      def materialize
+        if (wire = @filler.exact_wire(@data, @offset, @length))
+          @suffix = EMPTY_SUFFIX
+          return wire
+        end
+
+        wire, @suffix = @filler.call_at(@data, @offset, @length)
+        raise FormatError, "record disagrees with its bytes" unless wire
+
+        wire
+      end
+
+      def suffix(_wire)
+        @suffix
+      end
+    end
+  end
+end

data/lib/emf/emr/parser.rb

@@ -7,38 +7,71 @@ module Emf
     module Parser
       module_function
 
-      def call(bytes)
-        raise FormatError, "input too large (#{bytes.bytesize} > #{MAX_INPUT_BYTES}); refusing to parse" if bytes.bytesize > MAX_INPUT_BYTES
+      def call(bytes, deferred_admission: nil)
+        ResourceLimits.check!(:input_bytes, MAX_INPUT_BYTES, bytes.bytesize)
         raise FormatError, "not an EMF file (signature mismatch)" unless Emf::Detector.call(bytes) == :emf
 
         io = StringIO.new(bytes, "rb")
         header_wire = read_header(io)
         header = Model::Emr::Header.from_wire(header_wire)
+        data = bytes.b.freeze
+        pos = io.pos
 
         records = []
         errors = []
+        diagnostics = []
         emf_plus_bytes = +""
-        trailing = +""
+        trailing = "".b
+
+        size = data.bytesize
+        while pos < size
+          offset = pos
+          if (source = filled_record_at(data, offset, size))
+            records << Model::Emr::Records::WireAdapter.lazy(source: source, offset: offset)
+            pos = offset + source.length
+            next
+          end
+
+          deferred_admission = admit_deferred(data, offset, deferred_admission)
+
+          wire, suffix = read_record_at(data, offset, errors, diagnostics: diagnostics, record_index: records.length + 1)
+          if wire.nil?
+            trailing << bytes.byteslice(offset..)
+            break
+          end
 
-        until io.eof?
-          offset = io.pos
-          wire = read_record(io, offset, errors)
-          break if wire.nil?
+          pos = offset + data.unpack1("V", offset: offset + 4)
 
-          records << Model::Emr::Records::WireAdapter.new(wire: wire, offset: offset)
-          emf_plus_bytes << extract_emf_plus(wire) if wire.is_a?(Emf::Emr::Binary::Records::Comment)
+          records << Model::Emr::Records::WireAdapter.new(wire: wire, offset: offset, suffix: suffix)
+          emf_plus_bytes << comment_emf_plus(wire)
 
           if wire.is_a?(Emf::Emr::Binary::Records::Eof)
-            trailing << io.read until io.eof?
+            trailing << data.byteslice(pos..) if pos < data.bytesize
             break
           end
         end
 
+        metafile(header, records, errors, emf_plus_bytes, trailing, diagnostics)
+      end
+
+      # PolyText can charge the same bytes repeatedly before rejecting
+      # overlapping descriptors. It has no FilledRecord fast path.
+      def admit_deferred(data, offset, deferred)
+        return unless deferred
+
+        type = data.unpack1("V", offset: offset)
+        return deferred unless [96, 97].include?(type)
+
+        ResourceLimits.preflight(data)
+      end
+
+      def metafile(header, records, errors, emf_plus_bytes, trailing, diagnostics = [])
         Model::Metafile.new(
           format: emf_plus_bytes.empty? ? :emf : :emf_plus,
           header: header,
           records: records,
           errors: errors,
+          diagnostics: diagnostics,
           emf_plus: emf_plus_bytes.empty? ? nil : emf_plus_bytes,
           trailing: trailing
         )
@@ -60,6 +93,8 @@ module Emf
         end
 
         Emf::Emr::Binary::Header.read(full)
+      rescue IOError
+        raise FormatError, "EMF header nSize #{n_size} cannot hold its fields"
       end
 
       # Per-type byte-size validation for records with variable-length arrays.
@@ -67,6 +102,9 @@ module Emf
       # corrupt and we should preserve them as Raw rather than letting bindata
       # allocate a giant array. The element size is bytes per array entry.
       VARIABLE_ARRAY_RECORDS = {
+        Binary::TypeCodes::EXTCREATEPEN => { count_offset: 48, element_size: 4 },
+        Binary::TypeCodes::CREATEPALETTE => { count_offset: 14, count_width: 2, element_size: 4 },
+        Binary::TypeCodes::SETPALETTEENTRIES => { count_offset: 16, element_size: 4 },
         Binary::TypeCodes::POLYGON => { count_offset: 24, element_size: 8 },
         Binary::TypeCodes::POLYLINE => { count_offset: 24, element_size: 8 },
         Binary::TypeCodes::POLYBEZIER => { count_offset: 24, element_size: 8 },
@@ -93,14 +131,39 @@ module Emf
       # Bounds the whole-file parse: a 100 MB EMF is unusual; refuse bigger.
       MAX_INPUT_BYTES = 200 * 1024 * 1024
 
-      def variable_array_sane?(type_id, n_size, head, payload)
+      REGION_DATA_OFFSETS = { 71 => 32, 72 => 40, 73 => 28, 74 => 28, 75 => 16 }.freeze
+
+      # The checks read the record in place: `base` is its offset in `data`
+      # (0 for a record already sliced), `n_size` its length, so no slice or
+      # string is made per checked record.
+      def variable_array_sane?(type_id, n_size, record_bytes)
+        sane_at?(type_id, n_size, record_bytes, 0)
+      end
+
+      def sane_at?(type_id, n_size, data, base)
+        region_data_sane?(type_id, n_size, data, base) &&
+          sized_arrays_sane?(type_id, n_size, data, base) &&
+          ext_text_out_sane?(type_id, n_size, data, base)
+      end
+
+      def region_data_sane?(type_id, n_size, data, base)
+        data_offset = REGION_DATA_OFFSETS[type_id]
+        return true unless data_offset
+
+        length_offset = type_id == 75 ? 8 : 24
+        return false if n_size < length_offset + 4
+
+        data.unpack1(UINT32, offset: base + length_offset) <= n_size - data_offset
+      end
+
+      def sized_arrays_sane?(type_id, n_size, data, base)
         spec = VARIABLE_ARRAY_RECORDS[type_id]
         return true unless spec
 
-        full = head + payload
-        return true if full.bytesize < spec[:count_offset] + 4
+        count_width = spec.fetch(:count_width, 4)
+        return true if n_size < spec[:count_offset] + count_width
 
-        count = read_uint32(full, spec[:count_offset])
+        count = data.unpack1(count_width == 2 ? UINT16 : UINT32, offset: base + spec[:count_offset])
         return false if count > MAX_SANE_ARRAY_LENGTH
 
         # For single-array records, element_size is the per-entry size.
@@ -108,77 +171,203 @@ module Emf
         # are always uint32 (4 bytes); element_size applies only to the
         # second array (aptl/apts).
         first_array_entry_size = spec[:count2_offset] ? 4 : spec[:element_size]
-        bytes_needed = spec[:count_offset] + 4 + (count * first_array_entry_size)
+        bytes_needed = spec[:count_offset] + count_width + (count * first_array_entry_size)
         return false if bytes_needed > n_size
 
         # Multi-array records also need to validate the second count.
         return true unless spec[:count2_offset]
 
-        count2 = read_uint32(full, spec[:count2_offset])
+        count2 = data.unpack1(UINT32, offset: base + spec[:count2_offset])
         return false if count2 > MAX_SANE_ARRAY_LENGTH
 
         bytes_needed + (count2 * spec[:element_size]) <= n_size
       end
 
-      def read_uint32(bytes, offset)
-        bytes.getbyte(offset) |
-          (bytes.getbyte(offset + 1) << 8) |
-          (bytes.getbyte(offset + 2) << 16) |
-          (bytes.getbyte(offset + 3) << 24)
+      UINT32 = "V"
+      UINT16 = "v"
+      ETO_NO_RECT = 0x100
+      ETO_PDY = 0x2000
+      EXT_TEXT_OUT_CHAR_WIDTH = {
+        Binary::TypeCodes::EXTTEXTOUTA => 1,
+        Binary::TypeCodes::EXTTEXTOUTW => 2
+      }.freeze
+
+      # Types whose declared counts or spans are checked against nSize.
+      CHECKED_TYPES = [REGION_DATA_OFFSETS, VARIABLE_ARRAY_RECORDS, EXT_TEXT_OUT_CHAR_WIDTH]
+                      .flat_map(&:keys).to_h { |type_id| [type_id, true] }.freeze
+
+      # Mirrors the native decoder: the string and Dx spans implied by nChars
+      # must lie inside the record, after the fixed fields, and not overlap.
+      def ext_text_out_sane?(type_id, n_size, data, base)
+        width = EXT_TEXT_OUT_CHAR_WIDTH[type_id]
+        return true unless width
+
+        spans, fixed = ext_text_out_spans(n_size, data, base, width)
+        return false unless spans
+
+        spans.all? { |off, len, align| span_inside?(off, len, align, fixed, n_size) } &&
+          (spans.size < 2 || !spans_overlap?(*spans))
+      end
+
+      def ext_text_out_spans(n_size, data, base, width)
+        return if n_size < 60
+
+        count = data.unpack1(UINT32, offset: base + 44)
+        off_string = data.unpack1(UINT32, offset: base + 48)
+        options = data.unpack1(UINT32, offset: base + 52)
+        dx_at = options.anybits?(ETO_NO_RECT) ? 56 : 72
+        return if n_size < dx_at + 4
+
+        off_dx = data.unpack1(UINT32, offset: base + dx_at)
+        dx_entry = options.anybits?(ETO_PDY) ? 8 : 4
+        string = [off_string, count * width, width] unless off_string.zero? && count.zero?
+        dx = [off_dx, count * dx_entry, 4] unless off_dx.zero?
+        [[string, dx].compact, dx_at + 4]
       end
 
+      def span_inside?(off, len, align, fixed, n_size)
+        (off % align).zero? && off >= fixed && off + len <= n_size
+      end
+
+      def spans_overlap?(first, second)
+        first[0] < second[0] + second[1] && second[0] < first[0] + first[1]
+      end
+
+      def short_header?(available, offset, errors)
+        return false if available >= 8
+
+        errors << ParseError.new(offset: offset, record_code: nil,
+                                 message: "truncated record header at offset #{offset} (#{available} bytes)")
+        true
+      end
+
+      # Reads the record at `offset` of the stream and advances past it.
       def read_record(io, offset, errors)
-        head = io.read(8)
-        return nil if head.nil? || head.empty?
+        data = io.string.b
+        result = read_record_at(data, offset, errors)
+        io.seek(offset + data.unpack1("V", offset: offset + 4)) if result
+        result
+      end
 
-        type_id, n_size = head.unpack("VV")
-        if n_size < 8
-          errors << ParseError.new(offset: offset, record_code: type_id,
-                                   message: "record nSize #{n_size} < 8 bytes (offset #{offset})")
-          return nil
-        end
+      # The byte-backed source of the fixed-layout or point-array record at
+      # `offset` of the frozen binary `data`, or nil when the record needs
+      # `read_record_at` (any other type, a short or truncated span, a count
+      # that overruns its record, or an error to report). The wire is made
+      # only when asked for, from the same filler `read_typed` uses.
+      def filled_record_at(data, offset, size)
+        return if size - offset < 8
 
-        payload = io.read(n_size - 8)
-        if payload.nil? || payload.bytesize < n_size - 8
-          errors << ParseError.new(offset: offset, record_code: type_id,
-                                   message: "truncated record at offset #{offset} (claimed #{n_size}, got #{payload&.bytesize || 0})")
-          return nil
-        end
+        type_id = data.unpack1(UINT32, offset: offset)
+        n_size = data.unpack1(UINT32, offset: offset + 4)
+        return if n_size < 8 || size - offset < n_size
+
+        source = Emr::FilledRecord.for(type_id, offset, n_size, data)
+        return unless source
+        return source unless CHECKED_TYPES.key?(type_id)
+
+        source if sane_at?(type_id, n_size, data, offset)
+      end
 
-        unless variable_array_sane?(type_id, n_size, head, payload)
+      # The record starting at `offset` of the binary `data` as [wire, suffix],
+      # or nil when none can be read there (the caller keeps the rest as
+      # trailing bytes).
+      def read_record_at(data, offset, errors, diagnostics: nil, record_index: nil)
+        header = record_header_at(data, offset, errors, diagnostics, record_index)
+        return unless header
+
+        type_id, n_size = header
+        record_bytes = data.byteslice(offset, n_size) if CHECKED_TYPES.key?(type_id)
+        unless record_bytes.nil? || variable_array_sane?(type_id, n_size, record_bytes)
           errors << ParseError.new(
             offset: offset, record_code: type_id,
             message: "variable-array record at offset #{offset} declares " \
                      "more entries than nSize allows; preserving as Raw"
           )
-          return build_raw(head, payload)
+          diagnostic(diagnostics, record_index, type_id, offset, :preserved_raw)
+          return [build_raw(record_bytes), "".b]
         end
 
-        wire_class = Emf::Emr::Binary::Records.lookup(type_id)
-        wire_class.read(head + payload)
+        read_typed(type_id, n_size, data, offset)
+      rescue ResourceLimitError
+        raise
       rescue StandardError => e
+        diagnostic(diagnostics, record_index, type_id, offset, :preserved_raw)
         errors << ParseError.new(offset: offset, record_code: type_id,
                                  message: "#{e.class}: #{e.message}")
-        build_raw(head, payload)
+        [build_raw(record_bytes || data.byteslice(offset, n_size)), "".b]
+      end
+
+      def record_header_at(data, offset, errors, diagnostics, record_index)
+        available = data.bytesize - offset
+        return nil if available.zero?
+
+        if short_header?(available, offset, errors)
+          diagnostic(diagnostics, record_index, data.unpack1("V", offset: offset) || 0, offset, :skipped)
+          return nil
+        end
+
+        type_id = data.unpack1("V", offset: offset)
+        n_size = data.unpack1("V", offset: offset + 4)
+        if n_size < 8
+          diagnostic(diagnostics, record_index, type_id, offset, :skipped)
+          errors << ParseError.new(offset: offset, record_code: type_id,
+                                   message: "record nSize #{n_size} < 8 bytes (offset #{offset})")
+          return nil
+        end
+
+        if available < n_size
+          diagnostic(diagnostics, record_index, type_id, offset, :skipped)
+          errors << ParseError.new(offset: offset, record_code: type_id,
+                                   message: "truncated record at offset #{offset} (claimed #{n_size}, got #{available - 8})")
+          return nil
+        end
+
+        [type_id, n_size]
+      end
+
+      def diagnostic(diagnostics, record_index, type_id, offset, disposition)
+        return unless diagnostics
+
+        diagnostics << Model::Diagnostic.new(record_index: record_index, record_code: type_id,
+                                             byte_offset: offset, disposition: disposition)
       end
 
-      def build_raw(head, payload)
-        Emf::Emr::Binary::Records::Raw.read(head + (payload || +""))
+      def read_typed(type_id, n_size, data, offset)
+        filler = Emf::Emr::Binary::FastFill.for(type_id) || Emf::Emr::Binary::FastFill.for_points(type_id) ||
+                 Emf::Emr::Binary::FastFill.for_text(type_id)
+        if filler && n_size >= filler.size
+          filled = filler.call_at(data, offset, n_size)
+          return filled if filled
+        end
+
+        record_bytes = data.byteslice(offset, n_size)
+        wire = Emf::Emr::Binary::Records.lookup(type_id).read(record_bytes)
+        [wire, Model::Emr::Records::WireAdapter.suffix_of(record_bytes, wire)]
+      end
+
+      # Public API since before the offset-aware checks; kept for callers.
+      def read_uint32(bytes, offset)
+        bytes.unpack1(UINT32, offset: offset)
+      end
+
+      def build_raw(record_bytes)
+        Emf::Emr::Binary::Records::Raw.read(record_bytes)
       end
 
       EMF_PLUS_IDENTIFIER = 0x2B464D45 # "EMF+" little-endian
 
-      def extract_emf_plus(comment_wire)
-        return +"" unless comment_wire.cb_data&.>= 4
+      def comment_emf_plus(wire)
+        wire.is_a?(Emf::Emr::Binary::Records::Comment) ? extract_emf_plus(wire) : ""
+      end
 
-        identifier = comment_wire.data.getbyte(0) |
-                     (comment_wire.data.getbyte(1) << 8) |
-                     (comment_wire.data.getbyte(2) << 16) |
-                     (comment_wire.data.getbyte(3) << 24)
-        return +"" unless identifier == EMF_PLUS_IDENTIFIER
+      def extract_emf_plus(comment_wire)
+        data = comment_wire.data.to_s.b
+        # cbData can claim more bytes than the record holds; read only what is there.
+        return +"" unless comment_wire.cb_data&.>=(4) && data.bytesize >= 4
+        return +"" unless data.unpack1("V") == EMF_PLUS_IDENTIFIER
 
         # Payload after the 4-byte identifier is the EMF+ record(s).
-        comment_wire.data.bytes[4..].pack("C*")
+        data.byteslice(4..)
       end
     end
   end

data/lib/emf/emr/serializer.rb

@@ -6,15 +6,14 @@ module Emf
       module_function
 
       def call(metafile)
-        bytes = +""
+        bytes = String.new(encoding: Encoding::BINARY)
         bytes << metafile.header.to_wire.to_binary_s
         metafile.records.each do |record|
-          case record
-          when Model::Emr::Records::WireAdapter
-            bytes << record.wire.to_binary_s
-          else
+          unless record.is_a?(Model::Emr::Records::WireAdapter)
             raise SerializeError, "cannot serialize #{record.class} (TODO 10 lands domain to_wire)"
           end
+
+          record.append_to(bytes)
         end
         bytes << metafile.trailing
         bytes

data/lib/emf/emr.rb

@@ -3,6 +3,7 @@
 module Emf
   module Emr
     autoload :Parser, "emf/emr/parser"
+    autoload :FilledRecord, "emf/emr/filled_record"
     autoload :Serializer, "emf/emr/serializer"
     autoload :PathAssociation, "emf/emr/path_association"
     autoload :Binary, "emf/emr/binary"

data/lib/emf/error.rb

@@ -1,7 +1,15 @@
 # frozen_string_literal: true
 
 module Emf
-  class Error < StandardError; end
+  class Error < StandardError
+    # Backend-neutral ParseEvidence for a failed header or framing check, or nil when none is available.
+    attr_reader :evidence
+
+    def with_evidence(evidence)
+      @evidence ||= evidence
+      self
+    end
+  end
 
   class FormatError < Error; end
 
@@ -15,5 +23,20 @@ module Emf
     end
   end
 
+  class ResourceLimitError < Error
+    attr_reader :resource, :limit, :actual
+
+    def initialize(resource:, limit:, actual:)
+      @resource = resource
+      @limit = limit
+      @actual = actual
+      super("#{resource} limit exceeded (#{actual} > #{limit})")
+    end
+  end
+
   class SerializeError < Error; end
+
+  module EmfPlus
+    class StaleStreamError < Error; end
+  end
 end

data/lib/emf/model/diagnostic.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Emf
+  module Model
+    class Diagnostic
+      TYPE_NAMES = Emf::Emr::Binary::TypeCodes.constants.to_h do |name|
+        [Emf::Emr::Binary::TypeCodes.const_get(name), "EMR_#{name}".freeze]
+      end.freeze
+
+      attr_reader :record_index, :record_code, :record_type, :byte_offset, :disposition
+
+      def initialize(record_index:, record_code:, byte_offset:, disposition:)
+        raise ArgumentError, "invalid diagnostic disposition" unless %i[skipped preserved_raw].include?(disposition)
+        unless [record_index, record_code, byte_offset].all? { |value| value.is_a?(Integer) && value >= 0 }
+          raise ArgumentError, "diagnostic positions and code must be nonnegative integers"
+        end
+
+        @record_index = record_index
+        @record_code = record_code
+        @record_type = TYPE_NAMES.fetch(record_code) { format("UNKNOWN(0x%08X)", record_code).freeze }
+        @byte_offset = byte_offset
+        @disposition = disposition
+        freeze
+      end
+
+      def to_h
+        { record_index: record_index, record_code: record_code, record_type: record_type,
+          byte_offset: byte_offset, disposition: disposition }
+      end
+
+      def ==(other)
+        other.is_a?(self.class) && to_h == other.to_h
+      end
+      alias eql? ==
+
+      def hash
+        to_h.hash
+      end
+    end
+  end
+end

data/lib/emf/model/emr/header.rb

@@ -37,7 +37,31 @@ module Emf
                     :n_handles, :s_reserved, :n_description, :off_description,
                     :n_pal_entries, :device_pixels, :device_mm, :cb_pixel_format,
                     :off_pixel_format, :b_open_gl, :szl_micrometers, :n_size,
-                    :trailing, :description
+                    :trailing
+
+        # The description as UTF-8 (UTF-16LE nDescription chars at offDescription,
+        # trailing NULs dropped), or nil when absent or outside the header record.
+        # An explicit `description:` given at construction wins.
+        def description
+          return @description if @description
+
+          bytes = description_bytes
+          return unless bytes
+
+          bytes.dup.force_encoding(Encoding::UTF_16LE).encode(Encoding::UTF_8, invalid: :replace, undef: :replace).sub(/\0+\z/, "")
+        end
+
+        # Raw description bytes (2 * nDescription at offDescription from record
+        # start), or nil when nDescription is 0 or the range leaves the record.
+        def description_bytes
+          slice_of_record(off_description, n_description * 2)
+        end
+
+        # Raw PIXELFORMATDESCRIPTOR bytes (cbPixelFormat at offPixelFormat), or
+        # nil when cbPixelFormat is 0/absent or the range leaves the record.
+        def pixel_format_bytes
+          slice_of_record(off_pixel_format, cb_pixel_format)
+        end
 
         def self.from_wire(wire)
           new(
@@ -63,6 +87,12 @@ module Emf
           )
         end
 
+        # The header record bytes as #to_wire writes them now (equal to the source bytes until an edit).
+        # Not cached: the fields and `trailing` stay mutable, and the buffers must follow them.
+        def record_bytes
+          to_wire.to_binary_s
+        end
+
         def to_wire
           Emf::Emr::Binary::Header.new(
             i_type: 1,
@@ -87,6 +117,15 @@ module Emf
             trailing: trailing
           )
         end
+
+        private
+
+        def slice_of_record(offset, length)
+          return unless offset&.positive? && length&.positive?
+
+          bytes = record_bytes
+          bytes.byteslice(offset, length) if offset + length <= bytes.bytesize
+        end
       end
     end
   end