emf 0.1.2 → 0.2.0

data/lib/emf/native/wmf_region_fields.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+module Emf
+  module Native
+    class WmfRegionFields
+      def initialize(record, raw)
+        @record = record
+        @raw = raw
+        @type = record.fetch(:type)
+        @offset = record.fetch(:offset)
+        @payload = record.fetch(:payload)
+      end
+
+      def call
+        validate(@record.fetch(:family) == 9 && @raw.bytesize >= 6 && @raw.bytesize.even?)
+        klass = Wmf::RegionCodec::RECORDS.fetch(@type & 0xFF)
+        fields = klass == Model::Wmf::Records::CreateRegion ? region : scalar(klass)
+        record = klass.new(**fields, type_id: @type, offset: @offset)
+        prefix = Wmf::RegionCodec.encode_payload(record)
+        validate(@raw.bytesize >= prefix.bytesize + 6 && @raw.byteslice(6, prefix.bytesize) == prefix)
+        record.suffix = @raw.byteslice((6 + prefix.bytesize)..)
+        record
+      rescue SerializeError
+        validate(false)
+      end
+
+      private
+
+      def scalar(klass)
+        validate(@payload.bytesize == klass::WIRE_FIELDS.length * 4)
+        values = @payload.unpack("V*").zip(klass::WIRE_TYPES).map do |value, type|
+          if type == :int16
+            value -= 0x100000000 if value >= 0x80000000
+            validate(value.between?(-0x8000, 0x7FFF))
+          else
+            validate(value <= 0xFFFF)
+          end
+          value
+        end
+        klass::WIRE_FIELDS.zip(values).to_h
+      end
+
+      def region
+        validate(@payload.bytesize >= 28)
+        next_in_chain, object_count = @payload.unpack("V2")
+        bounds = @payload.byteslice(8, 16).unpack("l<4")
+        count = @payload.byteslice(24, 4).unpack1("V")
+        validate(next_in_chain <= 0xFFFF && bounds.all? { |value| value.between?(-0x8000, 0x7FFF) })
+        validate(count <= 0x7FFF && count <= (@payload.bytesize - 28) / 12)
+        preflight_scans(count)
+        { next_in_chain: next_in_chain, object_count: object_count,
+          bounds: Model::Wmf::Records::RegionBounds.new(**Wmf::RegionCodec::BOUNDS_FIELDS.zip(bounds).to_h),
+          scans: scans(count) }
+      end
+
+      def preflight_scans(count)
+        cursor = 28
+        source_size = 22
+        count.times do
+          validate(@payload.bytesize - cursor >= 12)
+          top, bottom, lines = @payload.byteslice(cursor, 12).unpack("V3")
+          validate(top <= 0xFFFF && bottom <= 0xFFFF && lines <= 0x3FFF && lines <= (@payload.bytesize - cursor - 12) / 8)
+          source_size += 8 + (lines * 4)
+          validate(source_size <= 0x7FFF)
+          (lines * 2).times do |index|
+            validate(@payload.byteslice(cursor + 12 + (index * 4), 4).unpack1("V") <= 0xFFFF)
+          end
+          cursor += 12 + (lines * 8)
+        end
+        validate(cursor == @payload.bytesize && @raw.bytesize >= source_size + 6)
+      end
+
+      def scans(count)
+        cursor = 28
+        Array.new(count) do
+          top, bottom, count_lines = @payload.byteslice(cursor, 12).unpack("V3")
+          lines = @payload.byteslice(cursor + 12, count_lines * 8).unpack("V*").each_slice(2).map do |left, right|
+            Model::Wmf::Records::RegionScanLine.new(left: left, right: right)
+          end
+          cursor += 12 + (count_lines * 8)
+          Model::Wmf::Records::RegionScan.new(top: top, bottom: bottom, lines: lines)
+        end
+      end
+
+      def validate(condition)
+        return if condition
+
+        raise ParseError.new(offset: @offset, record_code: @type, message: "invalid native WMF region record at offset #{@offset}")
+      end
+    end
+  end
+end

data/lib/emf/native/wmf_rejection.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module Emf
+  module Native
+    # Maps the native WMFR answer (codec, reason, offset, function, detail) to the exact error the Ruby contract
+    # raises: its class, message, offset and record code. Rust names the first failing phase; this table owns
+    # only the wording. Reason codes are codec * 100 + n and are never renumbered.
+    module WmfRejection
+      Found = Struct.new(:codec, :reason, :offset, :function, :detail)
+
+      # Whole-input failures: FormatError with the message as is. 203 (placeable checksum), 305 (Size), 406 (EOF
+      # length), 1003 (negative text length), 1702 (no live object) and 1801 (MaxRecord) are recovered, not
+      # rejected, and 404 is retired with them. 701, 801 and 1704 are rejected only for the shapes Wmf::Recovery
+      # cannot keep.
+      INPUT = {
+        201 => "truncated WMF placeable header",
+        202 => "WMF placeable reserved field must be zero",
+        301 => "truncated WMF standard header",
+        302 => "invalid WMF Type",
+        303 => "invalid WMF HeaderSize",
+        304 => "invalid WMF Version",
+        306 => "WMF on-disk placeable handle must be zero"
+      }.freeze
+
+      # Record failures: ParseError "WMF <text> at offset <offset>". `%d` takes the numeric detail.
+      RECORD = {
+        402 => "truncated record header", 403 => "invalid record length %d",
+        405 => "missing EOF record",
+        501 => "invalid fixed record length", 601 => "invalid state record length", 701 => "invalid font record length",
+        801 => "invalid object record length",
+        901 => "missing point array count", 902 => "truncated polygon counts", 903 => "invalid point count",
+        904 => "point array length mismatch",
+        1001 => "truncated text record", 1002 => "truncated text rectangle",
+        1004 => "truncated text string", 1005 => "truncated text spacing array",
+        1101 => "truncated palette prefix", 1102 => "truncated palette entries",
+        1201 => "truncated region/clipping prefix", 1202 => "truncated region header", 1203 => "invalid region header",
+        1204 => "truncated region scan", 1205 => "invalid region scan", 1206 => "invalid region scan size or maximum",
+        1301 => "truncated pattern brush prefix", 1302 => "invalid pattern brush extent",
+        1303 => "truncated DIB brush prefix", 1304 => "invalid DIB brush color usage",
+        1401 => "truncated bitmap transfer prefix", 1402 => "empty bitmap transfer source",
+        1501 => "truncated geometry prefix", 1502 => "invalid extended flood fill mode",
+        1601 => "truncated RestoreDc prefix", 1602 => "truncated Escape prefix", 1603 => "truncated Escape data or padding",
+        1701 => "object table capacity exceeded",
+        1703 => "object reference %d is not a palette", 1704 => "object reference %d is not a region",
+        1705 => "invalid region reference %d", 1706 => "invalid brush reference %d",
+        1707 => "object reference %d is not a brush"
+      }.freeze
+
+      LAYOUT = "a4V7Q<2"
+      LENGTH = 48
+
+      module_function
+
+      # Returns nil when the contract accepts the input.
+      def read(bytes)
+        magic, version, present, codec, reason, has_offset, has_function, function, offset, detail =
+          bytes.unpack(LAYOUT)
+        raise FormatError, "invalid native WMF rejection" unless bytes.bytesize == LENGTH && magic == "WMFR" && version == 1
+
+        return if present.zero?
+
+        Found.new(codec, reason, has_offset == 1 ? offset : nil, has_function == 1 ? function : nil, detail)
+      end
+
+      def error(found, input)
+        evidence = Wmf::Evidence.build(found.reason, input, found.offset, found.detail)
+        if found.reason == 101
+          return ResourceLimitError.new(resource: :input_bytes, limit: Wmf::Binary::MAX_INPUT_BYTES,
+                                        actual: input.bytesize).with_evidence(evidence)
+        end
+        if found.reason == 401
+          return ResourceLimitError.new(resource: :record_count, limit: Wmf::Binary::MAX_RECORDS,
+                                        actual: Wmf::Binary::MAX_RECORDS + 1).with_evidence(evidence)
+        end
+        return FormatError.new(INPUT.fetch(found.reason)).with_evidence(evidence) if INPUT.key?(found.reason)
+
+        template = RECORD.fetch(found.reason) { raise FormatError, "unknown native WMF rejection #{found.reason}" }
+        text = template.sub("%d", found.detail.to_s)
+        ParseError.new(offset: found.offset, record_code: found.function, message: "WMF #{text} at offset #{found.offset}")
+                  .with_evidence(evidence)
+      end
+    end
+  end
+end

data/lib/emf/native/wmf_remaining_fields.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module Emf
+  module Native
+    class WmfRemainingFields
+      def initialize(record, raw)
+        @record = record
+        @raw = raw
+        @type = record.fetch(:type)
+        @offset = record.fetch(:offset)
+        @payload = record.fetch(:payload)
+      end
+
+      def call
+        validate(@raw.bytesize >= 6 && @raw.bytesize.even? && @payload.bytesize <= Wmf::Binary::MAX_INPUT_BYTES)
+        validate(@raw.unpack("Vv") == [@raw.bytesize / 2, @type])
+        geometry = Wmf::GeometryCodec::RECORDS.key?(@type & 0xFF)
+        codec = geometry ? Wmf::GeometryCodec : Wmf::DcEscapeCodec
+        validate(@record.fetch(:family) == (geometry ? 12 : 13))
+        klass = codec::RECORDS.fetch(@type & 0xFF)
+        fields = if geometry
+                   scalar_fields(klass)
+                 elsif @type & 0xFF == 0x26
+                   escape_fields
+                 else
+                   dc_fields
+                 end
+        model = klass.new(**fields, type_id: @type, offset: @offset)
+        validate(codec.encode(model) == @raw)
+        model
+      rescue SerializeError
+        validate(false)
+      end
+
+      private
+
+      def scalar_fields(klass)
+        validate(@payload.bytesize == klass::WIRE_FIELDS.length * 4 && @raw.bytesize >= 6 + klass::PAYLOAD_BYTES)
+        values = klass::WIRE_TYPES.each_with_index.map do |type, index|
+          @payload.byteslice(index * 4, 4).unpack1(type == :int16 ? "l<" : "V")
+        end
+        klass::WIRE_FIELDS.zip(values).to_h.merge(suffix: @raw.byteslice((6 + klass::PAYLOAD_BYTES)..))
+      end
+
+      def dc_fields
+        restore = @type & 0xFF == 0x27
+        validate(@payload.bytesize == (restore ? 4 : 0) && @raw.bytesize >= (restore ? 8 : 6))
+        fields = { suffix: @raw.byteslice((restore ? 8 : 6)..) }
+        fields[:saved_dc] = @payload.unpack1("l<") if restore
+        fields
+      end
+
+      def escape_fields
+        validate(@payload.bytesize >= 12)
+        function, length = @payload.unpack("VQ<")
+        validate(length <= 0xFFFF && @payload.bytesize == 12 + length)
+        prefix = 10 + length + (length % 2)
+        validate(@raw.bytesize >= prefix)
+        { escape_function: function, data: @payload.byteslice(12, length),
+          padding: length.odd? ? @raw.getbyte(10 + length) : nil, suffix: @raw.byteslice(prefix..) }
+      end
+
+      def validate(condition)
+        return if condition
+
+        raise ParseError.new(offset: @offset, record_code: @type, message: "invalid native WMF typed record at offset #{@offset}")
+      end
+    end
+  end
+end

data/lib/emf/native/wmf_snapshot.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Emf
+  module Native
+    class WmfSnapshot
+      attr_reader :header, :placeable, :records, :diagnostics, :trailing, :source_length
+
+      def initialize(bytes)
+        @bytes = bytes
+        @position = 0
+        raise FormatError, "invalid native WMF snapshot schema" unless take(4) == "WMFS" && u32 == 1
+        raise FormatError, "invalid native WMF snapshot length" unless u64 == bytes.bytesize
+
+        record_count, diagnostic_count, trailing_length, @source_length = Array.new(4) { u64 }
+        if record_count > bytes.bytesize / 40 || diagnostic_count > bytes.bytesize / 40
+          raise FormatError, "invalid native WMF snapshot counts"
+        end
+
+        @header = Array.new(10) { u32 }
+        @placeable = take(32).unpack("Vl<4V3")
+        @records = Array.new(record_count) { read_record }
+        @diagnostics = Array.new(diagnostic_count) { take(40).unpack("V4Q<3") }
+        @trailing = take(trailing_length)
+        raise FormatError, "unconsumed native WMF snapshot bytes" unless @position == bytes.bytesize
+      end
+
+      def take(length)
+        raise FormatError, "truncated native WMF snapshot" if length.negative? || length > @bytes.bytesize - @position
+
+        result = @bytes.byteslice(@position, length)
+        @position += length
+        result
+      end
+
+      def u32
+        take(4).unpack1("V")
+      end
+
+      def u64
+        take(8).unpack1("Q<")
+      end
+
+      private
+
+      def read_record
+        index, offset, length, type, family, payload_length = take(40).unpack("Q<3V2Q<")
+        { index: index, offset: offset, length: length, type: type, family: family, payload: take(payload_length) }
+      end
+    end
+  end
+end

data/lib/emf/native/wmf_text_fields.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module Emf
+  module Native
+    class WmfTextFields
+      def initialize(record, raw)
+        @record = record
+        @raw = raw
+      end
+
+      def call
+        payload = @record.fetch(:payload)
+        validate(@record.fetch(:family) == 5 && payload.bytesize >= 72)
+        x, y, options, has_rect, count, padding_length, dx_length, suffix_length, has_dx, reserved = payload.unpack("l<2V2Q<4V2")
+        rectangle = payload.byteslice(56, 16).unpack("l<4")
+        extended = @record.fetch(:type) & 0xFF == 0x32
+        validate_lengths(payload, count, padding_length, dx_length, suffix_length, has_rect, has_dx, reserved)
+        fields = {
+          x: x, y: y, text: payload.byteslice(72, count), padding: payload.byteslice(72 + count, padding_length),
+          type_id: @record.fetch(:type), offset: @record.fetch(:offset)
+        }
+        return text_out(fields, options, has_rect, has_dx, suffix_length) unless extended
+
+        validate(has_rect == (options.anybits?(6) ? 1 : 0) && padding_length <= 1)
+        expected = 14 + (has_rect * 8) + count + padding_length + (dx_length * 2) + suffix_length
+        validate(@raw.bytesize == expected)
+        fields[:rectangle] = Model::Wmf::Records::TextRectangle.new(**%i[left top right bottom].zip(rectangle).to_h) if has_rect == 1
+        fields[:options] = options
+        fields[:dx] = payload.byteslice(72 + count + padding_length, dx_length * 4).unpack("l<*") if has_dx == 1
+        fields[:suffix] = payload.byteslice(72 + count + padding_length + (dx_length * 4), suffix_length)
+        Model::Wmf::Records::ExtTextOut.new(**fields)
+      end
+
+      private
+
+      def validate_lengths(payload, count, padding_length, dx_length, suffix_length, rectangle, spacing, reserved)
+        validate(reserved.zero? && count <= 0x7FFF && [0, 1].include?(rectangle) && [0, 1].include?(spacing))
+        validate(payload.bytesize == 72 + count + padding_length + (dx_length * 4) + suffix_length)
+        validate(dx_length == (spacing == 1 ? count : 0))
+        validate(padding_length % 2 == count % 2)
+      end
+
+      def text_out(fields, options, rectangle, spacing, suffix_length)
+        validate(options.zero? && rectangle.zero? && spacing.zero? && suffix_length.zero?)
+        validate(@raw.bytesize >= 12 && @raw.bytesize == 12 + fields.fetch(:text).bytesize + fields.fetch(:padding).bytesize)
+        Model::Wmf::Records::TextOut.new(**fields)
+      end
+
+      def validate(condition)
+        return if condition
+
+        raise ParseError.new(offset: @record.fetch(:offset), record_code: @record.fetch(:type), message: "invalid native WMF text record")
+      end
+    end
+  end
+end

data/lib/emf/native.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module Emf
+  module Native
+    class Unavailable < Error; end
+
+    def self.backend
+      require_relative "native/library_path"
+      path = LibraryPath.new.call
+      raise Unavailable, "native backend is not installed (set EMF_NATIVE_LIBRARY)" if path.nil? || path.empty?
+
+      require_relative "native/loader"
+      require_relative "native/snapshot"
+      require_relative "native/header"
+      require_relative "native/hydrator"
+      require_relative "native/header_errors"
+      require_relative "native/diagnostic_contract"
+      Adapter.new(Loader.new(path))
+    rescue LoadError => e
+      raise Unavailable, "native backend dependencies could not load: #{e.message}"
+    end
+
+    class Adapter
+      def initialize(loader)
+        @loader = loader
+      end
+
+      def parse(bytes)
+        input = bytes.b
+        ResourceLimits.preflight(input)
+        return parse_wmf(input) if %i[wmf_apm wmf_standard].include?(Detector.call(input))
+
+        parse_emf(input)
+      rescue FormatError, ParseError => e
+        raise ParseEvidenceBuilder.attach(e, input)
+      end
+
+      def parse_emf(input)
+        @loader.document(input) do |document|
+          snapshot = Snapshot.new(@loader.snapshot(document))
+          DiagnosticContract.new(snapshot, input).call(Hydrator.new(snapshot, input).call)
+        end
+      rescue FormatError => e
+        raise HeaderErrors.translate(e, input)
+      end
+
+      def parse_wmf(input)
+        require_relative "native/wmf_hydrator"
+        WmfHydrator.parse(@loader, input)
+      end
+
+      def serialize(metafile)
+        case metafile.format
+        when :emf, :emf_plus then Emr::Serializer.call(metafile)
+        when :wmf then Wmf::Serializer.call(metafile)
+        else raise SerializeError, "native backend cannot serialize #{metafile.format.inspect}"
+        end
+      end
+    end
+  end
+end

data/lib/emf/parse_evidence.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module Emf
+  # Backend-neutral account of the check that rejected an input before a metafile model existed.
+  #
+  #   check    - Symbol naming the failed check (stable vocabulary; see Detector, Emr and Wmf::Evidence)
+  #   offset   - byte offset in the input where the failing field or record starts
+  #   declared - what the input states (a size, count, checksum, type), nil when it states nothing comparable
+  #   actual   - what was found or required instead (bytes available, computed checksum, minimum size), nil when
+  #              the check is a domain test with no single comparable value
+  #
+  # Units are bytes unless the check name says words. Reachable as `error.evidence` on Emf::FormatError and
+  # Emf::ParseError raised by either backend; nil when a rejection has no neutral description.
+  ParseEvidence = Struct.new(:check, :offset, :declared, :actual, keyword_init: true)
+
+  module ParseEvidenceBuilder
+    EMF_MAGIC_OFFSET = Detector::EMF_MAGIC_OFFSET
+
+    module_function
+
+    # Returns `error` with evidence attached when it can be derived from its message and the input.
+    def attach(error, bytes)
+      return error if error.evidence
+
+      error.with_evidence(derive(error, bytes))
+    end
+
+    def derive(error, bytes)
+      from_detector(error.message, bytes) || from_emf_header(error.message, bytes) || Wmf::Evidence.from_error(error, bytes)
+    end
+
+    def from_detector(message, bytes)
+      case message
+      when /\Ainput too short/
+        ParseEvidence.new(check: :input_too_short, offset: 0, declared: 4, actual: bytes.bytesize)
+      when /\Aunrecognised format \(signature=1/
+        ParseEvidence.new(check: :emf_magic_missing, offset: EMF_MAGIC_OFFSET, declared: Detector::EMF_MAGIC,
+                          actual: bytes.bytesize >= EMF_MAGIC_OFFSET + 4 ? bytes.unpack1("V", offset: EMF_MAGIC_OFFSET) : nil)
+      when /\Aunrecognised format/
+        ParseEvidence.new(check: :unrecognised_signature, offset: 0, declared: bytes.unpack1("V"), actual: nil)
+      end
+    end
+
+    def from_emf_header(message, bytes)
+      case message
+      when /\Ainput too large/
+        ParseEvidence.new(check: :emf_input_too_large, offset: 0, declared: Emr::Parser::MAX_INPUT_BYTES, actual: bytes.bytesize)
+      when /\AEMF header nSize too small/
+        ParseEvidence.new(check: :emf_header_size_too_small, offset: 4, declared: bytes.unpack1("V", offset: 4), actual: 8)
+      when /\Atruncated EMF header \(claimed/
+        ParseEvidence.new(check: :emf_header_truncated, offset: 0, declared: bytes.unpack1("V", offset: 4), actual: bytes.bytesize)
+      when /\AEMF header nSize \d+ cannot hold its fields/
+        ParseEvidence.new(check: :emf_header_cannot_hold_fields, offset: 4, declared: bytes.unpack1("V", offset: 4), actual: nil)
+      end
+    end
+  end
+end

data/lib/emf/resource_budget/bitmap.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+module Emf
+  class ResourceBudget
+    # Mirror bitmap.rs range validation before charging each copied buffer.
+    module Bitmap
+      SHAPES = {
+        76 => [100, 84, nil], 77 => [108, 84, nil],
+        78 => [128, 84, 112], 79 => [140, 96, 124],
+        80 => [76, 48, nil], 81 => [80, 48, nil],
+        93 => [32, 16, nil], 94 => [32, 16, nil],
+        114 => [108, 84, nil], 116 => [108, 84, nil]
+      }.freeze
+      KINDS = SHAPES.keys.freeze
+
+      module_function
+
+      def fixed_payload_len(kind)
+        SHAPES.fetch(kind).first - 8
+      end
+
+      def decode(kind, payload, budget) # rubocop:disable Naming/PredicateMethod
+        fixed, source, mask = SHAPES.fetch(kind)
+        fixed -= 8
+        return false if payload.length < fixed
+
+        spans = buffer_spans(payload, fixed, source, mask)
+        return false unless spans
+
+        cursor = fixed
+        spans.each do |start, stop|
+          return false if start < cursor
+
+          cursor = stop
+        end
+        cursor = fixed
+        spans.each do |start, stop|
+          [start - cursor, stop - start].each do |length|
+            budget.charge_alloc(length)
+            budget.charge_work((length + 15) / 16)
+          end
+          cursor = stop
+        end
+        true
+      end
+
+      def buffer_spans(payload, fixed, source, mask)
+        mask_bits = mask + 8 if mask
+        spans = [source, source + 8, mask, mask_bits].filter_map do |at|
+          next unless at
+
+          offset = payload.u32(at - 8)
+          length = payload.u32(at - 4)
+          next if offset.zero? && length.zero?
+
+          start = offset - 8
+          stop = start + length
+          return nil if start < fixed || stop > payload.length
+
+          [start, stop]
+        end
+        spans.sort_by! { |start, stop| [start, stop - start] }
+      end
+    end
+  end
+end

data/lib/emf/resource_budget/gradient.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Emf
+  class ResourceBudget
+    module Gradient
+      module_function
+
+      def decode(_kind, payload, budget) # rubocop:disable Naming/PredicateMethod
+        return false if payload.length < 28
+
+        vertices = payload.u32(16)
+        meshes = payload.u32(20)
+        mode = payload.u32(24)
+        element = mode == 2 ? 12 : 8
+        indexed = 28 + (vertices * 16) + (meshes * element)
+        return false if mode > 2 || indexed > payload.length
+
+        # Native reserves work even when an invalid index later recovers as Raw.
+        budget.charge_work(vertices + meshes)
+        index_start = 28 + (vertices * 16)
+        (meshes * element / 4).times do |index|
+          return false if payload.u32(index_start + (index * 4)) >= vertices
+        end
+        # Native charges twelve bytes per rectangle even when padding is absent.
+        budget.charge_alloc((vertices * budget.layout(:tri_vertex)) + (meshes * 12))
+        true
+      end
+    end
+  end
+end

data/lib/emf/resource_budget/poly_text.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module Emf
+  class ResourceBudget
+    module PolyText
+      module_function
+
+      def decode(kind, payload, budget) # rubocop:disable Naming/PredicateMethod
+        return false if payload.length < 32
+
+        count = payload.u32(28)
+        return false if count > (payload.length - 32) / 24
+
+        budget.charge_work(count)
+        fixed = table_end(payload, count)
+        return false unless fixed
+
+        width = kind == 96 ? 1 : 2
+        budget.vector(count, budget.layout(width == 1 ? :poly_text_entry_a : :poly_text_entry_w))
+        budget.vector(count * 2, budget.layout(:poly_text_span))
+        spans = []
+        cursor = 32
+        count.times do |index|
+          entry = entry_spans(payload, budget, cursor, fixed, width, index)
+          return false unless entry
+
+          cursor, ranges = entry
+          spans.concat(ranges)
+        end
+        budget.charge_work(spans.length * spans.length.bit_length)
+        cursor = fixed
+        spans.sort!.each do |start, stop, _index, _is_dx|
+          return false if start < cursor
+
+          unused = start - cursor
+          budget.charge_work((unused + 15) / 16)
+          budget.vector(unused, 1)
+          cursor = stop
+        end
+        true
+      end
+
+      def entry_spans(payload, budget, cursor, fixed, width, index)
+        chars = payload.u32(cursor + 8)
+        string = payload.u32(cursor + 12)
+        options = payload.u32(cursor + 16)
+        descriptor_size = options.anybits?(0x100) ? 24 : 40
+        dx = payload.u32(cursor + descriptor_size - 4)
+        dx_count = chars * (options.anybits?(0x2000) ? 2 : 1)
+        spans = []
+        unless string.zero? && chars.zero?
+          range = budget.span(payload.length, string, chars * width, width, fixed)
+          return unless range
+
+          spans << [*range, index, 0]
+        end
+        unless dx.zero?
+          range = budget.span(payload.length, dx, dx_count * 4, 4, fixed)
+          return unless range
+
+          spans << [*range, index, 1]
+        end
+        budget.charge_work(chars)
+        budget.vector(chars, width)
+        unless dx.zero?
+          budget.charge_work(dx_count)
+          budget.vector(dx_count, 4)
+        end
+        [cursor + descriptor_size, spans]
+      end
+
+      def table_end(payload, count)
+        cursor = 32
+        count.times do
+          return if payload.length - cursor < 24
+
+          options = payload.u32(cursor + 16)
+          cursor += options.anybits?(0x100) ? 24 : 40
+          return if cursor > payload.length
+        end
+        cursor
+      end
+    end
+  end
+end