emf 0.1.2 → 0.2.0

data/lib/emf/resource_budget.rb

@@ -0,0 +1,382 @@
+# frozen_string_literal: true
+
+module Emf
+  # Replays the native parser's admission charges without materializing decoded
+  # records. Malformed fatal headers return control to the existing parser.
+  class ResourceBudget # rubocop:disable Metrics/ClassLength
+    DEFAULT_LIMITS = {
+      input_bytes: 200 * 1024 * 1024,
+      record_bytes: 128 * 1024 * 1024,
+      record_count: 4 * 1024 * 1024,
+      allocated_bytes: 640 * 1024 * 1024,
+      work_units: 64 * 1024 * 1024
+    }.freeze
+
+    # Native accounting widths, checked by resource_budget_layout.rs. The font
+    # charge conservatively covers both 392- and 400-byte Rust layouts so budget
+    # admission is independent of compiler layout; native has a compile-time guard.
+    LAYOUT = {
+      record_span: 336, diagnostic: 32, font_record: 400,
+      poly_text_entry_a: 136, poly_text_entry_w: 136,
+      poly_text_span: 32, tri_vertex: 16
+    }.freeze
+    RECORD_SPAN_BYTES = LAYOUT.fetch(:record_span)
+    DIAGNOSTIC_BYTES = LAYOUT.fetch(:diagnostic)
+    FONT_RECORD_BYTES = LAYOUT.fetch(:font_record)
+
+    FIXED_PAYLOADS = {
+      9 => 8, 10 => 8, 11 => 8, 12 => 8, 13 => 8, 14 => 12, 15 => 12,
+      16 => 4, 17 => 4, 18 => 4, 19 => 4, 20 => 4, 21 => 4, 22 => 4,
+      24 => 4, 25 => 4, 26 => 8, 27 => 8, 28 => 0, 29 => 16, 30 => 16,
+      31 => 16, 32 => 16, 33 => 0, 34 => 4, 35 => 24, 36 => 28, 37 => 4,
+      38 => 20, 39 => 16, 40 => 4, 41 => 20, 42 => 16, 43 => 16, 44 => 24,
+      45 => 32, 46 => 32, 47 => 32, 48 => 4, 51 => 8, 52 => 0, 53 => 16, 54 => 8,
+      55 => 32, 57 => 4, 58 => 4, 59 => 0, 60 => 0, 61 => 0, 62 => 16,
+      63 => 16, 64 => 16, 65 => 0, 66 => 0, 67 => 4, 68 => 0, 98 => 4,
+      115 => 4, 120 => 8
+    }.freeze
+
+    # A borrowed payload; reading fields must not copy a potentially large body.
+    class Payload
+      attr_reader :length
+      alias bytesize length
+
+      def initialize(bytes, base, length)
+        @bytes = bytes
+        @base = base
+        @length = length
+      end
+
+      def u32(offset)
+        @bytes.unpack1("V", offset: @base + offset)
+      end
+
+      def u16(offset)
+        @bytes.unpack1("v", offset: @base + offset)
+      end
+
+      def slice(offset, length)
+        self.class.new(@bytes, @base + offset, length)
+      end
+    end
+
+    def self.check!(bytes, limits: {}, &admission)
+      new(limits).replay!(bytes, &admission)
+    end
+
+    def initialize(limits = {})
+      @limits = DEFAULT_LIMITS.merge(limits)
+      @totals = { record_count: 0, allocated_bytes: 0, work_units: 0 }
+      @vectors = {}
+    end
+
+    def charge_alloc(bytes)
+      charge(:allocated_bytes, bytes)
+    end
+
+    def charge_work(units)
+      charge(:work_units, units)
+    end
+
+    def layout(name)
+      LAYOUT.fetch(name)
+    end
+
+    def vector(count, width)
+      charge_alloc(count * width)
+    end
+
+    def span(payload_length, offset, length, alignment, fixed, empty_boundary: false)
+      return if offset < 8 || offset % alignment != 0
+
+      start = offset - 8
+      start = [start, fixed].max if empty_boundary && length.zero?
+      finish = start + length
+      [start, finish] if start >= fixed && finish <= payload_length
+    end
+
+    def replay!(bytes, &) # rubocop:disable Naming/PredicateMethod
+      check(:input_bytes, bytes.bytesize)
+      return true unless Detector.call(bytes) == :emf
+
+      input = Payload.new(bytes, 0, bytes.bytesize)
+      header_size = input.u32(4)
+      minimum = if header_size > 100 then 108
+                elsif header_size > 88 then 100
+                else 88
+                end
+      return true if header_size < minimum
+
+      check(:record_bytes, header_size)
+      charge_record(header_size)
+      return true if header_size > input.length
+
+      charge_work(ceil16(input.length))
+      charge_alloc(input.length)
+      replay_records(input, header_size, &)
+      true
+    end
+
+    private
+
+    def check(resource, actual)
+      limit = @limits.fetch(resource)
+      return if actual <= limit
+
+      raise ResourceLimitError.new(resource: resource, limit: limit, actual: actual)
+    end
+
+    def charge(resource, amount)
+      total = @totals.fetch(resource) + amount
+      check(resource, total)
+      @totals[resource] = total
+    end
+
+    def ceil16(bytes)
+      (bytes + 15) / 16
+    end
+
+    def charge_record(size)
+      charge(:record_count, 1)
+      charge_work(1 + ceil16(size))
+    end
+
+    def reserve(name, width)
+      length, capacity = @vectors.fetch(name, [0, 0])
+      if length == capacity
+        capacity = [capacity * 2, 1].max
+        charge_alloc(capacity * width)
+      end
+      @vectors[name] = [length + 1, capacity]
+    end
+
+    def diagnostic
+      reserve(:diagnostics, DIAGNOSTIC_BYTES)
+    end
+
+    def replay_records(input, offset)
+      while offset < input.length
+        remaining = input.length - offset
+        if remaining < 8 || (size = input.u32(offset + 4)) < 8 || size > remaining
+          diagnostic
+          break
+        end
+        kind = input.u32(offset)
+        check(:record_bytes, size)
+        charge_record(size)
+        reserve(:records, RECORD_SPAN_BYTES)
+        payload = input.slice(offset + 8, size - 8)
+        typed = decode(kind, payload)
+        diagnostic if !typed && invalid_when_raw?(kind, payload.length)
+        yield kind, size, offset if block_given?
+        offset += size
+        break if kind == 14 && typed
+      end
+    end
+
+    def invalid_when_raw?(kind, length)
+      prefix = if kind == 118 then 28
+               elsif Bitmap::SHAPES.key?(kind) then Bitmap::SHAPES.fetch(kind).first - 8
+               end
+      return length < prefix if prefix
+      return false if [23, 96, 97].include?(kind)
+      return length < 28 if kind == 108
+
+      (2..68).cover?(kind) || (70..98).cover?(kind) || (114..116).cover?(kind) || kind == 120
+    end
+
+    def decode_delegated(kind, payload)
+      case kind
+      when 96, 97 then PolyText.decode(kind, payload, self)
+      when 118 then Gradient.decode(kind, payload, self)
+      else Bitmap.decode(kind, payload, self)
+      end
+    end
+
+    # Keep native match-arm order visible for charge and recovery parity.
+    def decode(kind, payload) # rubocop:disable Metrics/CyclomaticComplexity
+      case kind
+      when 2..6, 85..89 then decode_poly?(payload, kind < 85 ? 8 : 4)
+      when 7, 8, 90, 91 then decode_multi_poly?(payload, kind < 90 ? 8 : 4)
+      when 56, 92 then decode_poly?(payload, (kind == 56 ? 8 : 4) + 1, 2)
+      when 49, 50 then decode_palette?(kind, payload)
+      when 70 then decode_comment?(payload)
+      when 71..75 then decode_region?(kind, payload)
+      when 82 then decode_font?(payload)
+      when 83, 84 then decode_text?(payload, kind == 83 ? 1 : 2)
+      when 95 then decode_pen?(payload)
+      when 23 then true
+      when 76..81, 93, 94, 96, 97, 114, 116, 118 then decode_delegated(kind, payload)
+      else
+        fixed = FIXED_PAYLOADS[kind]
+        fixed && payload.length >= fixed
+      end
+    end
+
+    def decode_poly?(payload, width, work_multiplier = 1)
+      return false if payload.length < 20
+
+      count = payload.u32(16)
+      bytes = count * width
+      return false if bytes > payload.length - 20
+
+      charge_alloc(bytes)
+      charge_work(count * work_multiplier)
+      true
+    end
+
+    def decode_multi_poly?(payload, width)
+      return false if payload.length < 24
+
+      polygons = payload.u32(16)
+      points = payload.u32(20)
+      bytes = (polygons * 4) + (points * width)
+      return false if bytes > payload.length - 24
+
+      charge_alloc(bytes)
+      charge_work(polygons + points)
+      true
+    end
+
+    def decode_palette?(kind, payload)
+      fixed = kind == 49 ? 8 : 12
+      return false if payload.length < fixed
+
+      count = kind == 49 ? payload.u16(6) : payload.u32(8)
+      return false if count * 4 > payload.length - fixed
+
+      charge_alloc(count * 4)
+      charge_work(count)
+      true
+    end
+
+    def decode_comment?(payload)
+      return false if payload.length < 4
+
+      count = payload.u32(0)
+      return false if count > payload.length - 4
+
+      charge_alloc(count)
+      charge_work(ceil16(count))
+      true
+    end
+
+    def decode_region?(kind, payload)
+      fixed = { 71 => 24, 72 => 32, 73 => 20, 74 => 20, 75 => 8 }.fetch(kind)
+      return false if payload.length < fixed
+
+      count = payload.u32(kind == 75 ? 0 : 16)
+      return false if count > payload.length - fixed
+      return true if count.zero? && kind == 75
+      return false if count < 32
+
+      region = payload.slice(fixed, count)
+      rectangles = region.u32(8)
+      bytes = rectangles * 16
+      return false unless region.u32(0) == 32 && region.u32(12) == bytes && bytes <= count - 32
+
+      extra = count - 32 - bytes
+      charge_alloc(bytes)
+      charge_alloc(extra)
+      charge_work(rectangles)
+      charge_work(ceil16(extra))
+      true
+    end
+
+    def decode_font?(payload)
+      return false if payload.length < 96
+
+      size = payload.length - 4
+      if size > 320
+        return false if size < 356
+
+        count = payload.u32(356)
+        return false unless payload.u32(352) == 0x08007664 && count <= 16 && count * 4 <= payload.length - 360
+
+        charge_alloc(count * 4)
+        charge_work(count)
+      end
+      charge_alloc(FONT_RECORD_BYTES)
+      true
+    end
+
+    # Span validation and charging follow native decode_text in order.
+    def decode_text?(payload, width) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+      return false if payload.length < 52
+
+      count = payload.u32(36)
+      options = payload.u32(44)
+      fixed = options.nobits?(0x100) ? 68 : 52
+      return false if payload.length < fixed
+
+      string_len = count * width
+      dx_count = count * (options.nobits?(0x2000) ? 1 : 2)
+      string_offset = payload.u32(40)
+      dx_offset = payload.u32(fixed - 4)
+      string = span(payload.length, string_offset, string_len, width, fixed) unless string_offset.zero? && count.zero?
+      dx = span(payload.length, dx_offset, dx_count * 4, 4, fixed) unless dx_offset.zero?
+      return false if (!string_offset.zero? || !count.zero?) && !string
+      return false if !dx_offset.zero? && !dx
+      return false if string && dx && string[0] < dx[1] && dx[0] < string[1]
+
+      ranges = [string, dx].compact.sort_by(&:first)
+      cursor = fixed
+      ranges.each do |start, finish|
+        return false if start < cursor
+
+        charge_work(ceil16(start - cursor))
+        charge_alloc(start - cursor)
+        cursor = finish
+      end
+      charge_work(count)
+      charge_alloc(string_len)
+      if dx
+        charge_work(dx_count)
+        charge_alloc(dx_count * 4)
+      end
+      true
+    end
+
+    # Validate all spans before the first native pen allocation charge.
+    def decode_pen?(payload) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+      return false if payload.length < 44
+
+      count = payload.u32(40)
+      fixed = 44 + (count * 4)
+      return false if fixed > payload.length
+
+      ranges = [[payload.u32(4), payload.u32(8)], [payload.u32(12), payload.u32(16)]].map do |offset, length|
+        next if offset.zero? && length.zero?
+
+        range = span(payload.length, offset, length, 4, fixed, empty_boundary: true)
+        return false unless range
+
+        range
+      end
+      info, bits = ranges
+      bits_first = bits && (!info || bits[0] < info[0] || (bits[0] == info[0] && bits[0] == bits[1]))
+      ranges = (bits_first ? [bits, info] : [info, bits]).compact
+      cursor = fixed
+      ranges.each do |start, finish|
+        return false if start < cursor
+
+        cursor = finish
+      end
+      charge_alloc(count * 4)
+      charge_work(count)
+      cursor = fixed
+      ranges.each do |start, finish|
+        [start - cursor, finish - start].each do |length|
+          charge_alloc(length)
+          charge_work(ceil16(length))
+        end
+        cursor = finish
+      end
+      true
+    end
+  end
+end
+
+require_relative "resource_budget/bitmap"
+require_relative "resource_budget/poly_text"
+require_relative "resource_budget/gradient"

data/lib/emf/resource_limits/emf_records.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+module Emf
+  module ResourceLimits
+    # Admission follows the native framing rules without decoding a Ruby model.
+    # Corrupt spans are left to the selected parser's existing recovery path.
+    module EmfRecords
+      MAX_RECORD_BYTES = 128 * 1024 * 1024
+      MAX_RECORDS = 4 * 1024 * 1024
+      POINT_WIDTHS = { 2 => 8, 3 => 8, 4 => 8, 5 => 8, 6 => 8,
+                       85 => 4, 86 => 4, 87 => 4, 88 => 4, 89 => 4,
+                       56 => 9, 92 => 5 }.freeze
+      MULTI_WIDTHS = { 7 => 8, 8 => 8, 90 => 4, 91 => 4 }.freeze
+      REGION_OFFSETS = { 71 => 32, 72 => 40, 73 => 28, 74 => 28, 75 => 16 }.freeze
+
+      module_function
+
+      def check(bytes)
+        count = 0
+        each(bytes) do |type, size, base|
+          ResourceLimits.check!(:record_bytes, MAX_RECORD_BYTES, size)
+          count += 1
+          ResourceLimits.check!(:record_count, MAX_RECORDS, count)
+          check_arrays(bytes, type, size, base) if base.positive?
+        end
+      end
+
+      def each(bytes)
+        return if bytes.bytesize < 8
+
+        size = bytes.unpack1("V", offset: 4)
+        minimum = if size > 100
+                    108
+                  else
+                    size > 88 ? 100 : 88
+                  end
+        return if size < minimum
+
+        # The native header checks its claimed size before reading its body.
+        yield 1, size, 0
+        base = size
+        while bytes.bytesize - base >= 8
+          type = bytes.unpack1("V", offset: base)
+          size = bytes.unpack1("V", offset: base + 4)
+          return if size < 8 || size > bytes.bytesize - base
+
+          yield type, size, base
+          return if type == 14 && size >= 20
+
+          base += size
+        end
+      end
+
+      def check_arrays(bytes, type, size, base)
+        if (width = POINT_WIDTHS[type])
+          check_single(bytes, size, base, 24, 28, width)
+        elsif (width = MULTI_WIDTHS[type])
+          check_multi(bytes, size, base, width)
+        elsif type == 50
+          check_single(bytes, size, base, 16, 20, 4)
+        elsif type == 95
+          check_pen(bytes, size, base)
+        elsif REGION_OFFSETS.key?(type)
+          check_region(bytes, type, size, base)
+        end
+      end
+
+      def check_single(bytes, size, base, count_at, fixed, width)
+        return if size < fixed
+
+        count = bytes.unpack1("V", offset: base + count_at)
+        check_count(count) if fixed + (count * width) <= size
+      end
+
+      def check_multi(bytes, size, base, width)
+        return if size < 32
+
+        polys, points = bytes.unpack("V2", offset: base + 24)
+        return if 32 + (polys * 4) + (points * width) > size
+
+        check_count(polys)
+        check_count(points)
+      end
+
+      def check_pen(bytes, size, base)
+        return if size < 52
+
+        count = bytes.unpack1("V", offset: base + 48)
+        fixed = 52 + (count * 4)
+        return if fixed > size
+
+        info, info_length, bits, bits_length = bytes.unpack("V4", offset: base + 12)
+        spans = [[info, info_length], [bits, bits_length]].map { |offset, length| pen_span(offset, length, fixed, size) }
+        return if spans.any?(&:nil?)
+
+        spans.sort_by! { |start, length| [start, length.zero? ? 0 : 1] }
+        return if spans.size == 2 && spans[0].sum > spans[1][0]
+
+        check_count(count)
+      end
+
+      def pen_span(offset, length, fixed, size)
+        return [fixed, 0] if offset.zero? && length.zero?
+
+        start = length.zero? ? [offset, fixed].max : offset
+        return unless offset >= 8 && (offset % 4).zero? && start >= fixed && start + length <= size
+
+        [start, length]
+      end
+
+      def check_region(bytes, type, size, base)
+        fixed = REGION_OFFSETS.fetch(type)
+        return if size < fixed
+
+        length = bytes.unpack1("V", offset: base + (type == 75 ? 8 : 24))
+        return if length < 32 || fixed + length > size
+
+        header, _kind, count, rectangle_bytes = bytes.unpack("V4", offset: base + fixed)
+        return unless header == 32 && count * 16 == rectangle_bytes && 32 + rectangle_bytes <= length
+
+        check_count(count)
+      end
+
+      def check_count(count, record_bytes: 0)
+        ResourceLimits.check!(:array_elements, Emr::Parser::MAX_SANE_ARRAY_LENGTH, count)
+        ResourceLimits.check!(:record_bytes, 0xFFFFFFFF, record_bytes)
+      end
+    end
+  end
+end

data/lib/emf/resource_limits.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require_relative "resource_limits/emf_records"
+require_relative "resource_budget"
+
+module Emf
+  # Shared admission checks run before either parser allocates its input model.
+  module ResourceLimits
+    module_function
+
+    def check!(resource, limit, actual)
+      return if actual <= limit
+
+      error = ResourceLimitError.new(resource: resource, limit: limit, actual: actual)
+      error.with_evidence(yield) if block_given?
+      raise error
+    end
+
+    def preflight(bytes, defer: false)
+      format = Detector.call(bytes)
+      limit = case format
+              when :wmf_apm, :wmf_standard then Wmf::Binary::MAX_INPUT_BYTES
+              when :emf then Emr::Parser::MAX_INPUT_BYTES
+              end
+      check!(:input_bytes, limit, bytes.bytesize) do
+        check = format == :emf ? :emf_input_too_large : :input_too_large
+        ParseEvidence.new(check: check, offset: 0, declared: limit, actual: bytes.bytesize)
+      end
+      return unless format == :emf
+      return :deferred if defer && bounded_emf?(bytes)
+
+      ResourceBudget.check!(bytes, limits: { input_bytes: limit,
+                                             record_bytes: EmfRecords::MAX_RECORD_BYTES,
+                                             record_count: EmfRecords::MAX_RECORDS }) do |type, size, base|
+        EmfRecords.check_arrays(bytes, type, size, base)
+      end
+      nil
+    end
+
+    # Except for PolyText's potentially overlapping descriptors, native charges
+    # are bounded by input length. Geometric record/diagnostic reservations cost
+    # less than 184 bytes per input byte; input, font and payload copies fit in
+    # the remaining 72. Framing and payload work fit within four units per byte.
+    # The Ruby parser must request exact admission if it encounters PolyText.
+    def bounded_emf?(bytes)
+      size = bytes.bytesize
+      header = bytes.unpack1("V", offset: 4)
+      return false unless header <= size && (header == 88 || header == 100 || header >= 108)
+
+      limits = ResourceBudget::DEFAULT_LIMITS
+      size <= EmfRecords::MAX_RECORD_BYTES &&
+        size / 8 <= EmfRecords::MAX_RECORDS &&
+        size / 4 <= Emr::Parser::MAX_SANE_ARRAY_LENGTH &&
+        size * 256 <= limits.fetch(:allocated_bytes) &&
+        size * 4 <= limits.fetch(:work_units)
+    end
+  end
+end

data/lib/emf/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Emf
-  VERSION = "0.1.2"
+  VERSION = "0.2.0"
 end

data/lib/emf/visitors/dump.rb

@@ -35,6 +35,10 @@ module Emf
         @lines << "  rec[#{adapter.offset}] type_id=#{adapter.type_id} #{wire.class.name&.split('::')&.last}"
       end
 
+      def visit_wmf_record(record)
+        @lines << "  rec[#{record.offset}] type_id=#{record.type_id} #{record.class.name&.split('::')&.last}"
+      end
+
       def method_missing(name, *args)
         return super unless name.to_s.start_with?("visit_")
 

data/lib/emf/visitors/stats.rb

@@ -5,11 +5,8 @@ module Emf
     # Produces a record-class histogram for a Metafile. Used by spec assertions
     # (TODO 16) and as a quick sanity-check dump via `emf stats` (TODO 19).
     #
-    # The base Visitor auto-registers `visit_*` methods as no-ops. Stats
-    # overrides the generic dispatch to tally every record by its class name.
-    # Subclasses that override specific visit_* methods for richer behaviour
-    # still get tallied here because the record's accept calls the visit_*
-    # method, which (if not overridden) calls method_missing -> tally.
+    # Registered record families have explicit handlers; unregistered visit_*
+    # methods fall back to tallying the record's class name.
     class Stats < Emf::Model::Visitor
       def initialize
         @counts = Hash.new(0)
@@ -48,6 +45,10 @@ module Emf
         @counts["WireAdapter(#{wire_class})"] += 1
       end
 
+      def visit_wmf_record(record)
+        @counts[record.class.name&.split("::")&.last || record.class.to_s] += 1
+      end
+
       def method_missing(name, *args)
         return super unless name.to_s.start_with?("visit_")