emf 0.1.2 → 0.2.0

data/lib/emf/wmf/embedded_emf.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+
+module Emf
+  module Wmf
+    # META_ESCAPE_ENHANCED_METAFILE (Escape 0x000F): an EMF stream split across consecutive
+    # Escape records. Segment bytes stay inert; assembly concatenates them and does not
+    # parse the EMF (use Emf.parse on the result). Records are never modified.
+    #
+    # ByteCount is checked as 34 plus CurrentRecordSize. The literal MS-WMF text says
+    # "34 plus EnhancedMetafileDataSize", which cannot hold for a stream split into
+    # 8,192-byte segments; the two agree for a single segment.
+    module EmbeddedEmf
+      ESCAPE = 0x000F
+      METADATA_BYTES = 34
+      MAX_SEGMENT_BYTES = 8192
+      COMMENT_IDENTIFIER = 0x43464D57
+      COMMENT_TYPE = 1
+
+      # Raised for an invalid segment or sequence; reason is a Symbol such as
+      # :comment_identifier, :segment_too_large, :remaining_mismatch or :incomplete.
+      class Invalid < Emf::Error
+        def initialize(reason)
+          @reason = reason
+          super("invalid embedded EMF escape: #{reason}")
+        end
+
+        attr_reader :reason
+      end
+
+      Segment = Struct.new(:version, :checksum, :flags, :record_count, :current_size, :remaining_bytes, :total_size, :data,
+                           keyword_init: true)
+      # checksum_valid is the one's complement of the XOR of the stream's 16-bit words
+      # compared with the first segment's Checksum; a mismatch is reported, not rejected.
+      Stream = Struct.new(:version, :checksum, :checksum_valid, :bytes, keyword_init: true)
+      # error is nil when the run assembled into stream.
+      Sequence = Struct.new(:first_record, :segment_count, :stream, :error, keyword_init: true)
+
+      module_function
+
+      def escape?(record)
+        record.is_a?(Model::Wmf::Records::Escape) && record.escape_function == ESCAPE
+      end
+
+      # Validates one segment against the record's own fields. Raises Invalid.
+      def segment(record)
+        raise Invalid, :not_embedded_emf unless escape?(record) && record.type_id & 0xFF == 0x26
+
+        data = record.data
+        raise Invalid, :transport unless record.padding.nil? != data.bytesize.odd? && data.bytesize <= 0xFFFF
+        raise Invalid, :metadata if data.bytesize < METADATA_BYTES
+
+        identifier, type, version, checksum, flags, count, current, remaining, total = data.unpack("V3vV5")
+        validate_metadata(identifier, type, flags, count, current, remaining, total)
+        raise Invalid, :metadata unless data.bytesize == METADATA_BYTES + current
+
+        Segment.new(version: version, checksum: checksum, flags: flags, record_count: count, current_size: current,
+                    remaining_bytes: remaining, total_size: total, data: data.byteslice(METADATA_BYTES..))
+      end
+
+      def validate_metadata(identifier, type, flags, count, current, remaining, total)
+        raise Invalid, :comment_identifier unless identifier == COMMENT_IDENTIFIER
+        raise Invalid, :comment_type unless type == COMMENT_TYPE
+        raise Invalid, :non_zero_flags unless flags.zero?
+        raise Invalid, :zero_record_count if count.zero?
+        raise Invalid, :segment_too_large if current > MAX_SEGMENT_BYTES
+        raise Invalid, :inconsistent_sizes if current + remaining > total
+      end
+
+      def checksum(bytes)
+        bytes = bytes.b
+        bytes += "\0".b if bytes.bytesize.odd?
+        ~bytes.unpack("v*").reduce(0, :^) & 0xFFFF
+      end
+
+      # Assembles escapes that must form exactly one complete sequence, in order.
+      # Raises Invalid; max_bytes bounds the declared total before any copying.
+      def assemble(records, max_bytes: Wmf::Binary::MAX_INPUT_BYTES)
+        head = nil
+        bytes = "".b
+        seen = 0
+        complete = false
+        records.each do |record|
+          raise Invalid, :record_count_mismatch if complete
+
+          segment = segment(record)
+          head ||= segment
+          check_against(head, segment, bytes.bytesize, max_bytes)
+          bytes << segment.data
+          seen += 1
+          complete = segment.remaining_bytes.zero?
+          raise Invalid, :record_count_mismatch unless complete == (seen == head.record_count)
+        end
+        raise Invalid, :incomplete unless complete
+
+        Stream.new(version: head.version, checksum: head.checksum, checksum_valid: checksum(bytes) == head.checksum, bytes: bytes)
+      end
+
+      def check_against(head, segment, consumed, max_bytes)
+        same = segment.record_count == head.record_count && segment.total_size == head.total_size
+        raise Invalid, :sequence_mismatch unless same
+        raise Invalid, :limit_exceeded if head.total_size > max_bytes
+        raise Invalid, :remaining_mismatch unless head.total_size - consumed - segment.current_size == segment.remaining_bytes
+      end
+
+      # Groups consecutive 0x000F escapes in a record list into Sequences. A run ends when it
+      # completes, fails validation (the failing segment is included) or another record follows.
+      def sequences(records, max_bytes: Wmf::Binary::MAX_INPUT_BYTES)
+        result = []
+        index = 0
+        while index < records.length
+          (index += 1 and next) unless escape?(records[index])
+
+          stop, outcome = scan_run(records, index, max_bytes)
+          result << Sequence.new(first_record: index, segment_count: stop - index, stream: outcome.is_a?(Stream) ? outcome : nil,
+                                 error: outcome.is_a?(Stream) ? nil : outcome)
+          index = stop
+        end
+        result
+      end
+
+      def scan_run(records, first, max_bytes)
+        stop = first
+        outcome = :incomplete
+        while stop < records.length && escape?(records[stop])
+          stop += 1
+          outcome = begin
+            assemble(records[first...stop], max_bytes: max_bytes)
+          rescue Invalid => e
+            e.reason
+          end
+          break unless outcome == :incomplete
+        end
+        [stop, outcome]
+      end
+    end
+  end
+end

data/lib/emf/wmf/escape_views.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module Emf
+  module Wmf
+    # Read-only views of recognized Escape subtypes. Data stays inert: nothing is
+    # executed, interpreted or decoded, and the record's raw fields remain the source
+    # of truth, so serialization is unaffected by taking a view.
+    module EscapeViews
+      # kind is the subtype name; fields holds the raw numeric fields (empty for empty subtypes).
+      Payload = Struct.new(:kind, :fields, keyword_init: true)
+      # kind names a counted subtype; data is the exact counted bytes.
+      CountedPayload = Struct.new(:kind, :data, keyword_init: true)
+      SpecialPassthrough2 = Struct.new(:reserved, :data, keyword_init: true)
+
+      EMPTY = {
+        0x0002 => :abort_doc, 0x1000 => :begin_path, 0x1010 => :close_channel, 0x0202 => :download_face,
+        0x100F => :download_header, 0x1002 => :end_path, 0x000B => :end_doc, 0x0200 => :ext_text_out,
+        0x002A => :get_device_units, 0x0100 => :get_extended_text_metrics, 0x0201 => :get_face_name,
+        0x0102 => :get_pair_kern_table, 0x000C => :get_phys_page_size, 0x000D => :get_printing_offset,
+        0x000E => :get_scaling_factor, 0x0801 => :metafile_driver, 0x0001 => :new_frame, 0x0003 => :next_band,
+        0x0026 => :postscript_ignore, 0x100E => :open_channel, 0x0C01 => :query_dib_support
+      }.freeze
+
+      # [kind, byte length, unpack format, value names] keyed by escape function.
+      FIXED = {
+        0x1001 => [:clip_to_path, 4, "v2", %i[clip_function reserved1]],
+        0x0019 => [:draw_pattern_rect, 20, "l<4v2", %i[position_x position_y size_width size_height style pattern]],
+        0x0021 => [:eps_printing, 2, "v", %i[set_eps_printing]],
+        0x1019 => [:get_ps_feature_setting, 4, "l<", %i[feature]],
+        0x0008 => [:query_esc_support, 2, "v", %i[query]],
+        0x0011 => [:set_copy_count, 2, "v", %i[copy_count]],
+        0x0015 => [:set_line_cap, 4, "l<", %i[cap]],
+        0x0016 => [:set_line_join, 4, "l<", %i[join]],
+        0x0017 => [:set_miter_limit, 4, "l<", %i[miter_limit]]
+      }.freeze
+
+      COUNTED = {
+        0x0013 => :passthrough, 0x0025 => :postscript_data, 0x1013 => :postscript_passthrough, 0x000A => :start_doc,
+        0x1017 => :check_jpeg_format, 0x1018 => :check_png_format, 0x0004 => :set_color_table
+      }.freeze
+      START_DOC_LIMIT = 260
+      SPCLPASSTHROUGH2 = 0x11D8
+
+      module_function
+
+      # Empty or fixed-size payload; nil for unknown subtypes, unexpected sizes or padding.
+      def typed_payload(record)
+        return unless dc_escape?(record) && record.padding.nil?
+
+        data = record.data
+        return (kind = EMPTY[record.escape_function]) && Payload.new(kind: kind, fields: {}) if data.empty?
+
+        kind, length, format, names = FIXED[record.escape_function]
+        return unless kind && data.bytesize == length
+
+        Payload.new(kind: kind, fields: names.zip(data.unpack(format)).to_h)
+      end
+
+      # The complete counted payload; nil for other subtypes, invalid alignment or oversized STARTDOC.
+      def typed_counted_payload(record)
+        return unless dc_escape?(record) && aligned?(record)
+
+        kind = COUNTED[record.escape_function] or return
+        return if kind == :start_doc && record.data.bytesize >= START_DOC_LIMIT
+
+        CountedPayload.new(kind: kind, data: record.data)
+      end
+
+      # SPCLPASSTHROUGH2 only when its inner size consumes the exact payload.
+      def typed_special_passthrough2_payload(record)
+        return unless dc_escape?(record) && record.escape_function == SPCLPASSTHROUGH2 && aligned?(record)
+        return unless record.data.bytesize >= 6
+
+        reserved, size = record.data.unpack("Vv")
+        return unless record.data.bytesize == 6 + size
+
+        SpecialPassthrough2.new(reserved: reserved, data: record.data.byteslice(6..))
+      end
+
+      def dc_escape?(record)
+        record.type_id & 0xFF == 0x26
+      end
+
+      def aligned?(record)
+        record.padding.nil? != record.data.bytesize.odd? && record.data.bytesize <= 0xFFFF
+      end
+    end
+  end
+end

data/lib/emf/wmf/evidence.rb

@@ -0,0 +1,255 @@
+# frozen_string_literal: true
+
+module Emf
+  module Wmf
+    # Neutral evidence for a WMF input the parser rejected, and for the header drifts and record shapes it recovers from. Both
+    # backends choose the failing check (the Ruby parser by its own raise, the native backend by its
+    # first-rejection reason) and the record offset;
+    # the declared and actual values are then read from the input bytes the same way for both.
+    #
+    # REASONS maps the stable rejection reason (codec * 100 + n, never renumbered) to its check name and the
+    # message text the contract raises (`%d` stands for one number; record texts are wrapped as
+    # "WMF <text> at offset <offset>").
+    module Evidence
+      REASONS = {
+        101 => [:input_too_large, "WMF input too large"],
+        201 => [:placeable_truncated, "truncated WMF placeable header"],
+        202 => [:placeable_reserved_nonzero, "WMF placeable reserved field must be zero"],
+        203 => [:placeable_checksum_mismatch, "WMF placeable checksum mismatch"],
+        301 => [:header_truncated, "truncated WMF standard header"],
+        302 => [:header_type_invalid, "invalid WMF Type"],
+        303 => [:header_size_invalid, "invalid WMF HeaderSize"],
+        304 => [:header_version_invalid, "invalid WMF Version"],
+        305 => [:header_file_size_invalid, "invalid WMF file Size"],
+        306 => [:placeable_handle_nonzero, "WMF on-disk placeable handle must be zero"],
+        1801 => [:max_record_mismatch, "WMF MaxRecord does not match largest record"],
+        401 => [:record_limit_exceeded, "record limit exceeded"],
+        402 => [:record_header_truncated, "truncated record header"],
+        403 => [:record_length_invalid, "invalid record length %d"],
+        405 => [:eof_missing, "missing EOF record"],
+        406 => [:eof_length_invalid, "invalid EOF length"],
+        501 => [:fixed_record_length_invalid, "invalid fixed record length"],
+        601 => [:state_record_length_invalid, "invalid state record length"],
+        701 => [:font_record_length_invalid, "invalid font record length"],
+        801 => [:object_record_length_invalid, "invalid object record length"],
+        901 => [:point_count_missing, "missing point array count"],
+        902 => [:polygon_counts_truncated, "truncated polygon counts"],
+        903 => [:point_count_invalid, "invalid point count"],
+        904 => [:point_array_length_mismatch, "point array length mismatch"],
+        1001 => [:text_record_truncated, "truncated text record"],
+        1002 => [:text_rectangle_truncated, "truncated text rectangle"],
+        1003 => [:text_length_negative, "negative text length"],
+        1004 => [:text_string_truncated, "truncated text string"],
+        1005 => [:text_spacing_truncated, "truncated text spacing array"],
+        1101 => [:palette_prefix_truncated, "truncated palette prefix"],
+        1102 => [:palette_entries_truncated, "truncated palette entries"],
+        1201 => [:region_prefix_truncated, "truncated region/clipping prefix"],
+        1202 => [:region_header_truncated, "truncated region header"],
+        1203 => [:region_header_invalid, "invalid region header"],
+        1204 => [:region_scan_truncated, "truncated region scan"],
+        1205 => [:region_scan_invalid, "invalid region scan"],
+        1206 => [:region_scan_size_invalid, "invalid region scan size or maximum"],
+        1301 => [:pattern_brush_prefix_truncated, "truncated pattern brush prefix"],
+        1302 => [:pattern_brush_extent_invalid, "invalid pattern brush extent"],
+        1303 => [:dib_brush_prefix_truncated, "truncated DIB brush prefix"],
+        1304 => [:dib_brush_color_usage_invalid, "invalid DIB brush color usage"],
+        1401 => [:bitmap_prefix_truncated, "truncated bitmap transfer prefix"],
+        1402 => [:bitmap_source_empty, "empty bitmap transfer source"],
+        1501 => [:geometry_prefix_truncated, "truncated geometry prefix"],
+        1502 => [:flood_fill_mode_invalid, "invalid extended flood fill mode"],
+        1601 => [:restore_dc_prefix_truncated, "truncated RestoreDc prefix"],
+        1602 => [:escape_prefix_truncated, "truncated Escape prefix"],
+        1603 => [:escape_data_truncated, "truncated Escape data or padding"],
+        1701 => [:object_table_full, "object table capacity exceeded"],
+        1702 => [:object_reference_invalid, "invalid object reference %d"],
+        1703 => [:object_reference_not_palette, "object reference %d is not a palette"],
+        1704 => [:object_reference_not_region, "object reference %d is not a region"],
+        1705 => [:region_reference_invalid, "invalid region reference %d"],
+        1706 => [:brush_reference_invalid, "invalid brush reference %d"],
+        1707 => [:object_reference_not_brush, "object reference %d is not a brush"]
+      }.freeze
+
+      # Recovered, not rejected: the header's Size (305) or MaxRecord (1801) disagrees with the record stream. Both
+      # backends keep the model and add a ParseError carrying this evidence to Metafile#errors (see .drift_errors).
+      DRIFT_REASONS = [305, 1801].freeze
+      DRIFT_MESSAGES = {
+        305 => "WMF header Size is %<declared>d words but the records end at %<actual>d words",
+        1801 => "WMF header MaxRecord is %<declared>d words but the largest record is %<actual>d words"
+      }.freeze
+
+      # Recovered by Wmf::Recovery, the placeable reader and Binary.validate_objects: the model is kept and the
+      # evidence is a ParseError on Metafile#errors. RETIRED_REASONS can no longer be raised at all; 701 (font), 801
+      # (object record) and 1704 (a fill or frame region naming a non-region) are still raised for the shapes that
+      # cannot be recovered. Reference reasons are 1702 (no live object) and 1704 (a non-region for a clip, paint or
+      # invert record).
+      RETIRED_REASONS = [203, 406, 1003, 1702].freeze
+
+      INPUT_REASONS = [101, 201, 202, 203, 301, 302, 303, 304, 305, 306, 1801].freeze
+      REFERENCE_REASONS = (1702..1707).to_a.freeze
+      WORD_BYTES = 2
+
+      MESSAGE_PATTERNS = REASONS.except(*DRIFT_REASONS, *RETIRED_REASONS).to_h do |reason, (_check, text)|
+        pattern = Regexp.escape(text).sub("%d", "(\\d+)")
+        [reason, INPUT_REASONS.include?(reason) ? /\A#{pattern}\z/ : /\AWMF #{pattern} at offset (\d+)\z/]
+      end.freeze
+      private_constant :MESSAGE_PATTERNS
+
+      module_function
+
+      # Evidence for a FormatError or ParseError raised by the Ruby parser, or nil when it is not a contract rejection.
+      def from_error(error, bytes)
+        reason, pattern = MESSAGE_PATTERNS.find { |_code, candidate| candidate.match?(error.message) }
+        return unless reason
+
+        detail = REFERENCE_REASONS.include?(reason) ? pattern.match(error.message)[1].to_i : nil
+        build(reason, bytes, error.respond_to?(:offset) ? error.offset : nil, detail)
+      end
+
+      # ParseErrors (with evidence) for each header field that disagrees with the record stream of `bytes`, which
+      # the parser has already accepted. Both backends call this, so their errors are identical.
+      def drift_errors(bytes)
+        DRIFT_REASONS.filter_map do |reason|
+          evidence = build(reason, bytes, nil)
+          next if evidence.declared == evidence.actual
+
+          ParseError.new(offset: evidence.offset, record_code: nil,
+                         message: format(DRIFT_MESSAGES.fetch(reason), declared: evidence.declared, actual: evidence.actual))
+                    .with_evidence(evidence)
+        end
+      end
+
+      # The ParseError (with evidence) for a recovered `reason`. A whole-input reason (203) carries the evidence
+      # offset and no record; a record reason carries the record's offset and function.
+      def recovered_error(reason, bytes, offset, function = nil, detail = nil)
+        evidence = build(reason, bytes, offset, detail)
+        text = REASONS.fetch(reason).last.sub("%d") { detail.to_s }
+        message = INPUT_REASONS.include?(reason) ? text : "WMF #{text} at offset #{offset}"
+        ParseError.new(offset: evidence.offset, record_code: function, message: message).with_evidence(evidence)
+      end
+
+      # Callback for Binary.validate_objects: appends the recovered reference errors to `errors`.
+      def reference_recovery(bytes, errors)
+        lambda do |record, reason, index|
+          errors << recovered_error(reason, bytes, record.offset, record.type_id, index)
+        end
+      end
+
+      # Recovered errors in input order (stable for equal offsets), so both backends list them identically.
+      def ordered(errors)
+        errors.each_with_index.sort_by { |error, index| [error.offset.to_i, index] }.map(&:first)
+      end
+
+      # The one evidence builder both backends use once they know the reason and (for record failures) the offset.
+      def build(reason, bytes, offset, detail = nil)
+        check = REASONS.fetch(reason).first
+        values = INPUT_REASONS.include?(reason) ? input_values(reason, bytes) : record_values(reason, bytes, offset, detail)
+        offset, declared, actual = values
+        ParseEvidence.new(check: check, offset: offset, declared: declared, actual: actual)
+      end
+
+      def input_values(reason, bytes)
+        view = View.new(bytes)
+        case reason
+        when 101 then [0, Binary::MAX_INPUT_BYTES, bytes.bytesize]
+        when 201 then [0, Binary::PLACEABLE_BYTES, bytes.bytesize]
+        when 202 then [16, 0, bytes.unpack1("V", offset: 16)]
+        when 203 then [20, bytes.unpack1("v", offset: 20), Binary.checksum(bytes.byteslice(0, 20))]
+        when 306 then [4, bytes.unpack1("v", offset: 4), 0]
+        else header_values(reason, bytes, view)
+        end
+      end
+
+      def header_values(reason, bytes, view)
+        case reason
+        when 301 then [view.start, Binary::HEADER_BYTES, bytes.bytesize - view.start]
+        when 302 then [view.start, view.u16(0), nil]
+        when 303 then [view.start + 2, view.u16(2), 9]
+        when 304 then [view.start + 4, view.u16(4), nil]
+        when 305 then [view.start + 6, view.u32(6), view.stream_words]
+        else [view.start + 12, view.u32(12), view.largest_record_words]
+        end
+      end
+
+      def record_values(reason, bytes, offset, detail)
+        view = View.new(bytes)
+        words = view.u32_at(offset)
+        declared, actual = record_pair(reason, view, offset, words, detail)
+        [offset, declared, actual]
+      end
+
+      def record_pair(reason, view, offset, words, detail)
+        case reason
+        when 401 then [Binary::MAX_RECORDS, Binary::MAX_RECORDS]
+        when 402 then [6, view.limit - offset]
+        when 403 then [words, (view.limit - offset) / WORD_BYTES]
+        when 405 then [view.limit, offset]
+        when 406 then [words, 3]
+        when 501, 601, 701, 801 then [words, view.required_words(reason, offset)]
+        when 1701 then [view.u16(10), nil]
+        when *REFERENCE_REASONS then [detail, view.u16(10)]
+        else [words, nil]
+        end
+      end
+
+      # Reads fields of an input that already passed the checks before the one being described.
+      class View
+        def initialize(bytes)
+          @bytes = bytes
+          @start = bytes.bytesize >= 4 && bytes.unpack1("V") == Binary::PLACEABLE_KEY ? Binary::PLACEABLE_BYTES : 0
+        end
+
+        attr_reader :start
+
+        def u16(offset)
+          @bytes.unpack1("v", offset: @start + offset)
+        end
+
+        def u32(offset)
+          @bytes.unpack1("V", offset: @start + offset)
+        end
+
+        def u32_at(offset)
+          @bytes.unpack1("V", offset: offset) if offset && offset + 4 <= @bytes.bytesize
+        end
+
+        def limit
+          @bytes.bytesize
+        end
+
+        # Words from the standard header to the end of the first EOF record (or of the input without one).
+        def stream_words
+          (record_walk.last - @start) / WORD_BYTES
+        end
+
+        def largest_record_words
+          record_walk.first
+        end
+
+        # [largest record in words, offset after the walk]; the walk follows the parser's: it ends after the
+        # first EOF record and never reads past the input, whatever the header declares.
+        def record_walk
+          @record_walk ||= begin
+            offset = @start + Binary::HEADER_BYTES
+            largest = 0
+            while offset + 6 <= limit
+              words = u32_at(offset)
+              break if words < 3
+
+              largest = [largest, words].max
+              offset += words * WORD_BYTES
+              break if @bytes.unpack1("v", offset: offset - (words * WORD_BYTES) + 4).zero?
+            end
+            [largest, [offset, limit].min]
+          end
+        end
+
+        def required_words(reason, offset)
+          function = @bytes.unpack1("v", offset: offset + 4) & 0xFF
+          record_class = { 501 => Binary::FIXED_RECORDS, 601 => Binary::STATE_RECORDS, 701 => nil, 801 => Binary::OBJECT_RECORDS }
+          record_class = reason == 701 ? Model::Wmf::Records::CreateFontIndirect : record_class.fetch(reason).fetch(function)
+          reason == 501 ? 3 + record_class::WIRE_FIELDS.length : 3 + (record_class::PAYLOAD_BYTES / WORD_BYTES)
+        end
+      end
+    end
+  end
+end

data/lib/emf/wmf/geometry_codec.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module Emf
+  module Wmf
+    module GeometryCodec
+      RECORDS = {
+        0x10 => Model::Wmf::Records::ScaleWindowExt,
+        0x12 => Model::Wmf::Records::ScaleViewportExt,
+        0x19 => Model::Wmf::Records::FloodFill,
+        0x1F => Model::Wmf::Records::SetPixel,
+        0x48 => Model::Wmf::Records::ExtFloodFill,
+        0x1D => Model::Wmf::Records::PatBlt
+      }.freeze
+      FUNCTIONS = RECORDS.invert.freeze
+
+      module_function
+
+      def decode(raw, function, offset)
+        klass = RECORDS.fetch(function & 0xFF)
+        prefix = 6 + klass::PAYLOAD_BYTES
+        yield "truncated geometry prefix" if raw.bytesize < prefix
+        fields = klass::WIRE_FIELDS.zip(raw.byteslice(6, klass::PAYLOAD_BYTES).unpack(klass::WIRE_FORMAT)).to_h
+        yield "invalid extended flood fill mode" if klass == Model::Wmf::Records::ExtFloodFill && fields[:mode] > 1
+        klass.new(**fields, type_id: function, offset: offset, suffix: raw.byteslice(prefix..))
+      end
+
+      def byte_size(record)
+        6 + record.class::PAYLOAD_BYTES + record.suffix.bytesize
+      end
+
+      def encode(record)
+        function = Binary.uint16(record.type_id, "RecordFunction")
+        raise SerializeError, "WMF geometry RecordFunction mismatch" unless function & 0xFF == FUNCTIONS[record.class]
+        unless record.suffix.is_a?(String) && record.suffix.bytesize.even?
+          raise SerializeError, "WMF geometry suffix must be a String with even length"
+        end
+        raise SerializeError, "WMF geometry too large" if byte_size(record) > Binary::MAX_INPUT_BYTES
+
+        values = record.class::WIRE_FIELDS.zip(record.class::WIRE_TYPES).map do |field, type|
+          Binary.public_send(type, record.public_send(field), field)
+        end
+        raise SerializeError, "invalid WMF extended flood fill mode" if record.is_a?(Model::Wmf::Records::ExtFloodFill) && record.mode > 1
+
+        payload = values.pack(record.class::WIRE_FORMAT) + record.suffix.b
+        [3 + (payload.bytesize / 2), function].pack("Vv") + payload
+      end
+    end
+  end
+end

data/lib/emf/wmf/palette_codec.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module Emf
+  module Wmf
+    module PaletteCodec
+      RECORDS = {
+        0xF7 => Model::Wmf::Records::CreatePalette,
+        0x37 => Model::Wmf::Records::SetPalEntries,
+        0x36 => Model::Wmf::Records::AnimatePalette,
+        0x34 => Model::Wmf::Records::SelectPalette,
+        0x39 => Model::Wmf::Records::ResizePalette,
+        0x35 => Model::Wmf::Records::RealizePalette
+      }.freeze
+      FUNCTIONS = RECORDS.invert.freeze
+      ENTRY_FIELDS = %i[red green blue flags].freeze
+
+      module_function
+
+      def decode(raw, function, offset)
+        klass = RECORDS.fetch(function & 0xFF)
+        fields = { type_id: function, offset: offset }
+        prefix = 6
+        if klass <= Model::Wmf::Records::PaletteRecord
+          yield "truncated palette prefix" if raw.bytesize < 10
+          start, count = raw.byteslice(6, 4).unpack("v2")
+          prefix = 10 + (count * 4)
+          yield "truncated palette entries" if raw.bytesize < prefix
+          fields[:start] = start
+          fields[:entries] = raw.byteslice(10, count * 4).unpack("C*").each_slice(4).map do |values|
+            Model::Wmf::Records::PaletteEntry.new(**ENTRY_FIELDS.zip(values).to_h)
+          end
+        elsif klass != Model::Wmf::Records::RealizePalette
+          prefix = 8
+          yield "truncated palette prefix" if raw.bytesize < prefix
+          field = klass == Model::Wmf::Records::SelectPalette ? :object_index : :entry_count
+          fields[field] = raw.byteslice(6, 2).unpack1("v")
+        end
+        klass.new(**fields, suffix: raw.byteslice(prefix..))
+      end
+
+      def byte_size(record)
+        prefix = if record.is_a?(Model::Wmf::Records::PaletteRecord)
+                   10 + (record.entries.length * 4)
+                 elsif record.is_a?(Model::Wmf::Records::RealizePalette)
+                   6
+                 else
+                   8
+                 end
+        prefix + record.suffix.bytesize
+      end
+
+      def encode(record)
+        function = Binary.uint16(record.type_id, "RecordFunction")
+        raise SerializeError, "WMF palette RecordFunction mismatch" unless function & 0xFF == FUNCTIONS[record.class]
+        unless record.suffix.is_a?(String) && record.suffix.bytesize.even?
+          raise SerializeError, "WMF palette suffix must be a String with even length"
+        end
+
+        payload = encode_payload(record) + record.suffix.b
+        [3 + (payload.bytesize / 2), function].pack("Vv") + payload
+      end
+
+      def encode_payload(record)
+        case record
+        when Model::Wmf::Records::PaletteRecord
+          raise SerializeError, "WMF palette entries must be an array" unless record.entries.is_a?(Array)
+
+          start = Binary.uint16(record.start, "start")
+          count = Binary.uint16(record.entries.length, "entry count")
+          entries = record.entries.map do |entry|
+            raise SerializeError, "WMF palette entry must be a PaletteEntry" unless entry.is_a?(Model::Wmf::Records::PaletteEntry)
+
+            ENTRY_FIELDS.map { |field| Binary.uint8(entry.public_send(field), field) }.pack("C4")
+          end
+          [start, count].pack("v2") + entries.join
+        when Model::Wmf::Records::SelectPalette
+          [Binary.uint16(record.object_index, "object_index")].pack("v")
+        when Model::Wmf::Records::ResizePalette
+          [Binary.uint16(record.entry_count, "entry_count")].pack("v")
+        else "".b
+        end
+      end
+    end
+  end
+end