emf 0.1.2 → 0.2.0

data/lib/emf/conformance/manifest.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require "yaml"
+
+module Emf
+  module Conformance
+    # The requirement manifest: one row per rule (implemented) or per known
+    # constraint the lens cannot check yet (blocked:model, not_checkable, deferred).
+    # Rows live in manifest/<family>.yml, so adding a family means adding a file.
+    #
+    #   - id: emf.restoredc.saved_dc   # the registered rule id when implemented
+    #     format: emf                  # emf | emf_plus | wmf
+    #     record_types: [EMR_RESTOREDC] # [] when the rule is not tied to one record type
+    #     citation: "MS-EMF 2.3.11.6"
+    #     status: implemented          # implemented | blocked:model | not_checkable | deferred
+    #     reason: null                 # required unless implemented
+    #
+    # Statuses: implemented (a registered rule), blocked:model (needs a public model
+    # accessor that does not exist), not_checkable (no input can violate it, or the
+    # bytes are ignored on receipt), deferred (readable from the public model today,
+    # no rule written yet).
+    module Manifest
+      DIR = File.join(__dir__, "manifest")
+      FORMATS = %w[emf emf_plus wmf].freeze
+      STATUSES = %w[implemented blocked:model not_checkable deferred].freeze
+      KEYS = %w[id format record_types citation status reason].freeze
+
+      Row = Struct.new(:id, :format, :record_types, :citation, :status, :reason, :source, keyword_init: true) do
+        def implemented? = status == "implemented"
+      end
+
+      module_function
+
+      # Every row of every manifest file, in file-name then file order.
+      # @param directory [String] folder of family files
+      # @return [Array<Row>] frozen rows; each carries its `source` file name
+      def rows(directory = DIR)
+        Dir[File.join(directory, "*.yml")].flat_map { |path| load_file(path) }.freeze
+      end
+
+      # Problems that make a row unusable, as strings. Empty when well formed.
+      def problems(row)
+        [
+          ("id must be a non-empty string" unless row.id.is_a?(String) && !row.id.empty?),
+          ("format #{row.format.inspect} is not one of #{FORMATS.join(', ')}" unless FORMATS.include?(row.format)),
+          ("record_types must be an Array of record names or numeric codes" unless record_types?(row.record_types)),
+          ("citation must be a non-empty string" unless row.citation.is_a?(String) && !row.citation.empty?),
+          ("status #{row.status.inspect} is not one of #{STATUSES.join(', ')}" unless STATUSES.include?(row.status)),
+          reason_problem(row)
+        ].compact
+      end
+
+      def load_file(path)
+        entries = YAML.safe_load_file(path)
+        raise ArgumentError, "#{path}: expected an Array of rows" unless entries.is_a?(Array)
+
+        entries.map { |entry| row(entry, File.basename(path)) }
+      end
+
+      def row(entry, source)
+        raise ArgumentError, "#{source}: row is not a mapping: #{entry.inspect}" unless entry.is_a?(Hash)
+
+        unknown = entry.keys - KEYS
+        raise ArgumentError, "#{source}: unknown keys #{unknown.inspect} in row #{entry['id'].inspect}" unless unknown.empty?
+
+        Row.new(**entry.transform_keys(&:to_sym), source: source).freeze
+      end
+
+      # Names (EMR_RESTOREDC) or numeric record-function codes (WMF's 0x0102 as 258).
+      def record_types?(value) = value.is_a?(Array) && value.all? { |type| type.is_a?(String) || type.is_a?(Integer) }
+
+      def reason_problem(row)
+        return if row.implemented? ? row.reason.nil? : row.reason.is_a?(String) && !row.reason.strip.empty?
+
+        row.implemented? ? "an implemented row must not carry a reason" : "#{row.status} row needs a reason"
+      end
+    end
+  end
+end

data/lib/emf/conformance/profile.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Emf
+  module Conformance
+    # Decides severity. strict: every rule at its declared severity.
+    # tolerant: a rule that carries a `tolerant_reason` is downgraded to a warning.
+    class Profile
+      attr_reader :name
+
+      def initialize(name, downgrade:)
+        @name = name
+        @downgrade = downgrade
+        freeze
+      end
+
+      def severity_for(rule)
+        @downgrade && rule.tolerant_reason ? :warning : rule.severity
+      end
+
+      def waiver_for(rule)
+        rule.tolerant_reason if @downgrade
+      end
+
+      STRICT = new(:strict, downgrade: false)
+      TOLERANT = new(:tolerant, downgrade: true)
+      ALL = { strict: STRICT, tolerant: TOLERANT }.freeze
+
+      def self.fetch(name)
+        return name if name.is_a?(Profile)
+
+        ALL.fetch(name.to_sym) { raise ArgumentError, "unknown conformance profile: #{name.inspect} (expected strict or tolerant)" }
+      end
+    end
+  end
+end

data/lib/emf/conformance/record_types.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Emf
+  module Conformance
+    # EMF record type codes of MS-EMF 2.1.1 (RecordType enumeration): 1..122
+    # except 69, 107 and 117, which the enumeration does not define.
+    module RecordTypes
+      UNDEFINED = [69, 107, 117].freeze
+      DEFINED = ((1..122).to_a - UNDEFINED).freeze
+      HEADER = 1
+      EOF_RECORD = 14
+      COMMENT = 70
+
+      module_function
+
+      def defined?(type) = DEFINED.include?(type)
+
+      def name(type)
+        Emf::Emr::Binary::TypeCodes.constants.find { |c| Emf::Emr::Binary::TypeCodes.const_get(c) == type }&.to_s ||
+          format("0x%04X", type)
+      end
+    end
+  end
+end

data/lib/emf/conformance/registry.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require "monitor"
+
+module Emf
+  module Conformance
+    # Ordered rule set. Rule files under conformance/rules/*.rb register
+    # themselves on load:
+    #
+    #   Emf::Conformance::Registry.loading.register(
+    #     id: "wmf.header.size", formats: [:wmf], citation: "MS-WMF 2.3.2.2",
+    #     kind: :header_size, severity: :error, tolerant_reason: nil
+    #   ) { |context| [{ message: "...", offset: 0 }] }
+    class Registry
+      RULES_DIR = File.join(__dir__, "rules")
+
+      include Enumerable
+
+      DEFAULT_LOCK = Monitor.new
+
+      def initialize
+        @rules = {}
+        @loaded_files = []
+      end
+
+      def register(id:, formats:, citation:, kind:, severity: :error, tolerant_reason: nil, &check)
+        raise ArgumentError, "rule #{id} needs a check block" unless check
+        raise ArgumentError, "rule #{id} already registered" if @rules.key?(id)
+
+        @rules[id] = Rule.new(id: id, formats: Array(formats), citation: citation, kind: kind,
+                              severity: severity, tolerant_reason: tolerant_reason, check: check)
+      end
+
+      def each(&) = @rules.each_value(&)
+
+      def loaded(file) = @loaded_files << File.expand_path(file)
+
+      def loaded?(file) = @loaded_files.include?(File.expand_path(file))
+
+      def [](id) = @rules[id]
+
+      def rules_for(format) = select { |rule| rule.applies_to?(format) }
+
+      # The rule's `formats.first` names its family in diagnostics (:emf, :emf_plus, :wmf).
+      # Process-wide registry. Loading it requires every rules/*.rb file, so a
+      # new family file is picked up without editing any list.
+      def self.default = @default || DEFAULT_LOCK.synchronize { @default ||= load_from(RULES_DIR) }
+
+      # A new registry holding every rule file found directly in `directory`.
+      def self.load_from(directory)
+        new.tap do |registry|
+          Thread.current[:emf_conformance_registry] = registry
+          Dir[File.join(directory, "*.rb")].each do |file|
+            load file
+            registry.loaded(file)
+            # Mark it loaded, so a later `require` of the same file does not run it a second time.
+            $LOADED_FEATURES << File.expand_path(file) if directory == RULES_DIR
+          end
+        ensure
+          Thread.current[:emf_conformance_registry] = nil
+        end
+      end
+
+      # The registry rule files register into while they load.
+      def self.loading = Thread.current[:emf_conformance_registry] || default
+
+      # Every rule file starts with `return if Registry.loaded_elsewhere?(__FILE__)`. Inside load_from it is false and the
+      # file runs. Required directly, the default registry loads it (once) and the direct run stops before registering.
+      def self.loaded_elsewhere?(file)
+        return false if Thread.current[:emf_conformance_registry]
+
+        default.loaded?(file)
+      end
+    end
+  end
+end

data/lib/emf/conformance/report.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require "time"
+require "yaml"
+
+module Emf
+  module Conformance
+    # svg_conform's ConformanceReport shape (filename, profile, tool, version,
+    # timestamp, valid, errors, warnings). Issue keys follow svg_conform's with
+    # `offset` (byte offset in the file) in place of line/column/xpath, which
+    # have no meaning in a binary format.
+    #
+    # Issue keys: `kind` is the diagnostic kind and `spec_citation` the cited section (issue #37 AC2).
+    # `category` (same value as `kind`) and `context.spec_citation` (same value as `spec_citation`) are
+    # kept for svg_conform shape compatibility and for reports already consumed.
+    #
+    # Contract (pinned by spec/emf/conformance/report_spec.rb):
+    # - `issues` keep the diagnostics' order (file offset ascending, offset-less
+    #   findings first, then requirement id); `by_requirement` is ordered by id.
+    # - Every value in `to_h` is a String, Integer, true/false or nil; keys are Strings.
+    # - The only time-dependent key is "timestamp", from the `now:` given to
+    #   Emf::Conformance.check. To compare two runs (for example forced backends),
+    #   pass the same `now:` to both, or compare `to_h(timestamp: false)`.
+    class Report
+      TOOL = "emf"
+
+      attr_reader :filename, :profile, :timestamp, :diagnostics
+
+      def initialize(filename:, profile:, timestamp:, diagnostics:)
+        @filename = filename
+        @profile = profile
+        @timestamp = timestamp
+        @diagnostics = diagnostics.dup.freeze
+      end
+
+      def errors = diagnostics.select(&:error?)
+
+      def warnings = diagnostics.select(&:warning?)
+
+      def valid? = errors.empty?
+
+      # @param timestamp [Boolean] false drops the "timestamp" key, giving a report
+      #   that depends only on the input and profile
+      def to_h(timestamp: true)
+        head = { "filename" => filename, "profile" => profile.to_s, "tool" => TOOL, "version" => Emf::VERSION }
+        head["timestamp"] = self.timestamp.getutc.iso8601 if timestamp
+        head.merge("valid" => valid?, "errors" => summary(errors, "error"), "warnings" => summary(warnings, "warning"))
+      end
+
+      def to_yaml(*options, timestamp: true) = to_h(timestamp: timestamp).to_yaml(*options)
+
+      private
+
+      def summary(list, type)
+        { "total_count" => list.size,
+          "by_requirement" => list.map(&:requirement_id).tally.sort.to_h,
+          "issues" => list.map { |diagnostic| issue(diagnostic, type) } }
+      end
+
+      def issue(diagnostic, type)
+        { "type" => type, "requirement_id" => diagnostic.requirement_id, "message" => diagnostic.message,
+          "element" => element(diagnostic), "attribute" => nil, "value" => nil, "offset" => diagnostic.offset,
+          "severity" => type, "kind" => diagnostic.kind.to_s, "category" => diagnostic.kind.to_s,
+          "spec_citation" => diagnostic.spec_citation, "remediation_available" => false,
+          "context" => context(diagnostic) }
+      end
+
+      def element(diagnostic)
+        diagnostic.record_type && "#{diagnostic.format}:#{record_name(diagnostic)}"
+      end
+
+      def record_name(diagnostic)
+        diagnostic.format == :emf ? RecordTypes.name(diagnostic.record_type) : format("0x%04X", diagnostic.record_type)
+      end
+
+      def context(diagnostic)
+        { "spec_citation" => diagnostic.spec_citation, "format" => diagnostic.format.to_s,
+          "record_index" => diagnostic.record_index, "record_type" => diagnostic.record_type,
+          "waiver" => diagnostic.waiver }.compact
+      end
+    end
+  end
+end

data/lib/emf/conformance/rule.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Emf
+  module Conformance
+    # A named check. `check` is called with a Context and returns an Array of
+    # findings (Hash with :message and optional :offset, :record_index, :record_type).
+    Rule = Struct.new(:id, :formats, :citation, :kind, :severity, :tolerant_reason, :check, keyword_init: true) do
+      def applies_to?(format) = formats.include?(format)
+
+      def findings(context)
+        found = check.call(context)
+        found.is_a?(Hash) ? [found] : Array(found)
+      end
+    end
+  end
+end

data/lib/emf/conformance/rules/emf_bitmap.rb

@@ -0,0 +1,357 @@
+# frozen_string_literal: true
+
+# Bitmap record rules (MS-EMF 2.3.1.x, MS-WMF 2.2.2.3 / 2.2.2.9). The BMI and bits
+# bytes are read from the record's own bytes: only offsets, lengths and the fixed
+# BITMAPINFOHEADER fields, never the pixels.
+return if Emf::Conformance::Registry.loaded_elsewhere?(__FILE__)
+
+module Emf
+  module Conformance
+    module BitmapRules
+      PALETTE_COLORS = "GDI writes PALETTEINDEX and PALETTERGB colors with 0x01 or 0x02 in the Reserved byte, and readers resolve them"
+      EMF = %i[emf emf_plus].freeze
+      Slot = Struct.new(:name, :usage, :off_bmi, :cb_bmi, :off_bits, :cb_bits)
+      SOURCE = Slot.new("source", 80, 84, 88, 92, 96)
+      DIB_SOURCE = Slot.new("source", 64, 48, 52, 56, 60)
+      MASK = Slot.new("mask", 108, 112, 116, 120, 124)
+      PLG_SOURCE = Slot.new("source", 92, 96, 100, 104, 108)
+      PLG_MASK = Slot.new("mask", 120, 124, 128, 132, 136)
+      GAMUT_INTENTS = [1, 2, 4, 8].freeze
+      V5_HEADER_SIZE = 124
+
+      # type => fixed size, bitmap slots and the offsets of the type's other checked fields.
+      LAYOUTS = {
+        76 => { name: "EMR_BITBLT", size: 100, slots: [SOURCE], rop: 40, colorrefs: [76] },
+        77 => { name: "EMR_STRETCHBLT", size: 108, slots: [SOURCE], rop: 40, colorrefs: [76] },
+        78 => { name: "EMR_MASKBLT", size: 128, slots: [SOURCE, MASK], rop4: 40, colorrefs: [76] },
+        79 => { name: "EMR_PLGBLT", size: 140, slots: [PLG_SOURCE, PLG_MASK], colorrefs: [88] },
+        80 => { name: "EMR_SETDIBITSTODEVICE", size: 76, slots: [DIB_SOURCE], scans: 72 },
+        81 => { name: "EMR_STRETCHDIBITS", size: 80, slots: [DIB_SOURCE], rop: 68 },
+        114 => { name: "EMR_ALPHABLEND", size: 108, slots: [SOURCE], blend: 40, extents: [32, 36, 100, 104], colorrefs: [76] },
+        116 => { name: "EMR_TRANSPARENTBLT", size: 108, slots: [SOURCE], colorrefs: [40, 76] }
+      }.freeze
+
+      BIT_COUNTS = [0, 1, 4, 8, 16, 24, 32].freeze
+      COMPRESSIONS = [0, 1, 2, 3, 4, 5, 0xB, 0xC, 0xD].freeze
+      RLE = [1, 2, 0xC, 0xD].freeze
+      STRIDE_BASED = [0, 3, 0xB].freeze
+
+      UNLOCATABLE = "the record Size still delimits the stream, so a bitmap that cannot be located is skipped by readers"
+
+      # id => [citation, kind, severity, tolerant_reason]
+      RULES = {
+        "emf.bitmap.record_size" => ["MS-EMF 2.3.1", :bitmap_size, :error, "the parser recovers a short bitmap record as raw bytes"],
+        "emf.bitmap.usage" => ["MS-EMF 2.1.9", :bitmap_usage, :error, nil],
+        "emf.bitmap.bmi_range" => ["MS-EMF 2.3.1", :bmi_range, :error, UNLOCATABLE],
+        "emf.bitmap.bits_range" => ["MS-EMF 2.3.1", :bits_range, :error, UNLOCATABLE],
+        "emf.bitmap.buffer_fixed_overlap" => ["MS-EMF 2.3.1", :buffer_fixed_overlap, :error, nil],
+        "emf.bitmap.buffer_overlap" => ["MS-EMF 2.3.1", :buffer_overlap, :error, nil],
+        "emf.bitmap.bmi_header_size" => ["MS-WMF 2.2.2.9", :bmi_header_size, :error, UNLOCATABLE],
+        "emf.bitmap.bmi_extent" => ["MS-WMF 2.2.2.3", :bmi_extent, :error, nil],
+        "emf.bitmap.bmi_planes" => ["MS-WMF 2.2.2.3", :bmi_planes, :error, nil],
+        "emf.bitmap.bmi_bitcount" => ["MS-WMF 2.1.1.3", :bmi_bitcount, :error, nil],
+        "emf.bitmap.bmi_compression" => ["MS-WMF 2.1.1.7", :bmi_compression, :error, nil],
+        "emf.bitmap.bits_length" => ["MS-WMF 2.2.2.9", :bits_length, :error, nil],
+        "emf.bitmap.color_table" => ["MS-WMF 2.2.2.3", :color_table, :error,
+                                     "readers cap an oversized ColorUsed to the colour table BitCount allows (note under ColorUsed), " \
+                                     "so the corrupted fixtures still decode"],
+        "emf.bitmap.color_table_length" => ["MS-WMF 2.2.2.9", :color_table_length, :warning, nil],
+        "emf.bitmap.bmi_v5_intent" => ["MS-WMF 2.2.2.5", :bmi_v5_intent, :error, nil],
+        "emf.bitmap.colorref_reserved" => ["MS-WMF 2.2.2.8", :colorref_reserved, :error, nil],
+        "emf.bitmap.colorref_palette" => ["MS-WMF 2.2.2.8", :colorref_reserved, :error, PALETTE_COLORS],
+        "emf.bitmap.mask_monochrome" => ["MS-EMF 2.3.1.2", :mask_monochrome, :error, nil],
+        "emf.bitmap.raster_operation" => ["MS-EMF 2.3.1.1", :raster_operation, :error, nil],
+        "emf.bitmap.rop4_reserved" => ["MS-EMF 2.3.1.2", :rop4_reserved, :warning, nil],
+        "emf.bitmap.blend_operation" => ["MS-EMF 2.3.1.4", :blend_operation, :error, nil],
+        "emf.bitmap.alpha_format" => ["MS-EMF 2.3.1.4", :alpha_format, :error, nil],
+        "emf.bitmap.positive_extent" => ["MS-EMF 2.3.1.4", :positive_extent, :error, nil]
+      }.freeze
+
+      # Findings of one metafile, grouped by rule id; computed once and shared by all rules.
+      CACHE = ObjectSpace::WeakMap.new
+
+      module_function
+
+      def findings(context, id)
+        # The WeakMap holds its values weakly: keep a strong reference until the lookup is done.
+        grouped = CACHE[context] || (CACHE[context] = analyze(context))
+        grouped.fetch(id, [])
+      end
+
+      def analyze(context)
+        out = Hash.new { |hash, id| hash[id] = [] }
+        context.records.each_with_index do |record, index|
+          layout = LAYOUTS[context.record_type(record)]
+          Scan.new(record, index, layout, context.record_size(record), out).run if layout
+        end
+        out
+      end
+
+      # BITMAPINFOHEADER / BITMAPCOREHEADER checks and the bits-length arithmetic; mixed into Scan.
+      module HeaderChecks
+        private
+
+        def header_fields(bmi)
+          count = bmi[2] - bmi[1]
+          size = count >= 4 ? u32(bmi[1]) : nil
+          unless size && (size == 12 || size >= 40) && size <= count
+            add("emf.bitmap.bmi_header_size", "#{bmi[0]} header size #{size.inspect} is not 12 or 40+ within its #{count} bytes")
+            return
+          end
+          size == 12 ? core_header(bmi[1]) : info_header(bmi[1])
+        end
+
+        def core_header(pos)
+          fields = { planes: @bytes.unpack1("v", offset: pos + 8), bit_count: @bytes.unpack1("v", offset: pos + 10),
+                     width: @bytes.unpack1("v", offset: pos + 4), height: @bytes.unpack1("v", offset: pos + 6) }
+          check_depth(fields)
+          fields.merge(compression: 0, image_size: 0, header_size: 12, color_used: 0)
+        end
+
+        def info_header(pos)
+          fields = { width: s32(pos + 4), height: s32(pos + 8), planes: @bytes.unpack1("v", offset: pos + 12),
+                     bit_count: @bytes.unpack1("v", offset: pos + 14), compression: u32(pos + 16), image_size: u32(pos + 20),
+                     color_used: u32(pos + 32), header_size: u32(pos) }
+          v5_intent(pos) if fields[:header_size] == V5_HEADER_SIZE
+          add("emf.bitmap.bmi_extent", "BMI Width #{fields[:width]} MUST be positive") unless fields[:width].positive?
+          add("emf.bitmap.bmi_extent", "BMI Height MUST NOT be zero") if fields[:height].zero?
+          check_depth(fields)
+          compression(fields)
+          fields
+        end
+
+        def check_depth(fields)
+          add("emf.bitmap.bmi_planes", "BMI Planes #{fields[:planes]} MUST be 1") unless fields[:planes] == 1
+          return if BIT_COUNTS.include?(fields[:bit_count])
+
+          add("emf.bitmap.bmi_bitcount",
+              "BMI BitCount #{fields[:bit_count]} is not in the BitCount enumeration")
+        end
+
+        def compression(fields)
+          code = fields[:compression]
+          unless COMPRESSIONS.include?(code)
+            add("emf.bitmap.bmi_compression",
+                "BMI Compression #{code} is not in the Compression enumeration")
+          end
+          return unless fields[:height].negative? && RLE.include?(code)
+
+          add("emf.bitmap.bmi_compression", "top-down BMI (negative Height) MUST NOT use compression #{code}")
+        end
+
+        # Uncompressed: at least the stride formula's length; compressed: exactly the BMI ImageSize.
+        def bits_length(slot, header)
+          count = u32(slot.cb_bits)
+          return if count.zero?
+
+          if STRIDE_BASED.include?(header[:compression])
+            expected = stride_bytes(header)
+            if count < expected
+              add("emf.bitmap.bits_length",
+                  "#{slot.name} cbBits #{count} is shorter than the #{expected} bytes the BMI stride needs")
+            end
+          elsif count != header[:image_size]
+            add("emf.bitmap.bits_length", "#{slot.name} cbBits #{count} MUST equal the BMI ImageSize #{header[:image_size]}")
+          end
+        end
+
+        def v5_intent(pos)
+          intent = u32(pos + 108)
+          return if GAMUT_INTENTS.include?(intent)
+
+          add("emf.bitmap.bmi_v5_intent", "BitmapV5Header Intent #{intent} is not in the GamutMappingIntent enumeration")
+        end
+
+        # The colour table is whatever the BMI buffer holds after the header: RGBQuads, or 16-bit palette
+        # indexes under DIB_PAL_COLORS; a BI_BITFIELDS BitmapInfoHeader also keeps its three masks there.
+        def color_table(slot, bmi, header, packed)
+          size = header[:header_size]
+          usage = u32(slot.usage)
+          return if size < 40 || usage > 1 || [4, 5].include?(header[:compression]) || bmi[2] - bmi[1] < size
+
+          entry = usage.zero? ? 4 : 2
+          held = bmi[2] - bmi[1] - size
+          held -= 12 if header[:compression] == 3 && size == 40 && held >= 12
+          check_tables(slot, header, held, entry, packed)
+        end
+
+        # A packed bitmap with a ColorUsed is judged by emf.bitmap.color_table (MUST, error) on this same shortfall, so
+        # the table-length rule stays silent for it.
+        def check_tables(slot, header, held, entry, packed)
+          if packed
+            check_color_used(slot, header, held, entry)
+            return unless header[:color_used].zero?
+          end
+          check_color_table_length(slot, header, held, entry)
+        end
+
+        def table_entries(header)
+          limit = header[:bit_count] < 16 ? 1 << header[:bit_count] : nil
+          used = header[:color_used]
+          return limit.to_i if used.zero?
+
+          limit ? [used, limit].min : used
+        end
+
+        # "In a packed bitmap, the ColorUsed value MUST be either 0 or the actual size of the color table."
+        # Only a ColorUsed that outruns the buffer is certain: real producers (test-164/165) pad the BMI buffer.
+        def check_color_used(slot, header, held, entry)
+          return if header[:color_used].zero?
+
+          want = table_entries(header)
+          return if held >= want * entry
+
+          add("emf.bitmap.color_table",
+              "#{slot.name} packed bitmap ColorUsed #{header[:color_used]} needs #{want * entry} colour table bytes, " \
+              "the BMI buffer holds only #{held} after its header")
+        end
+
+        def check_color_table_length(slot, header, held, entry)
+          return unless [1, 4, 8].include?(header[:bit_count])
+
+          need = table_entries(header) * entry
+          return if held >= need
+
+          add("emf.bitmap.color_table_length",
+              "#{slot.name} BMI holds #{held} colour table bytes, BitCount #{header[:bit_count]} / ColorUsed " \
+              "#{header[:color_used]} SHOULD give #{need}")
+        end
+
+        def stride_bytes(header)
+          lines = header[:height].abs
+          lines = [lines, u32(@layout[:scans])].min if @layout[:scans]
+          return 0 unless header[:width].positive?
+
+          (((header[:width] * header[:planes] * header[:bit_count]) + 31) & ~31) / 8 * lines
+        end
+      end
+
+      # One record's checks; every method adds to `out[rule id]`.
+      class Scan
+        include HeaderChecks
+
+        def initialize(record, index, layout, size, out)
+          @record = record
+          @index = index
+          @layout = layout
+          @size = size
+          @out = out
+          @bytes = record.to_binary_s
+        end
+
+        def run
+          if @size < @layout[:size]
+            return add("emf.bitmap.record_size",
+                       "#{@layout[:name]} Size #{@size} is smaller than its #{@layout[:size]}-byte fixed part")
+          end
+          return if @bytes.bytesize < @layout[:size]
+
+          ranges = @layout[:slots].flat_map { |slot| slot_checks(slot) }
+          overlaps(ranges.compact)
+          other_fields
+        end
+
+        private
+
+        def add(id, message)
+          @out[id] << { message: message, offset: @record.offset, record_index: @index + 1, record_type: @record.type_id.to_i }
+        end
+
+        def u32(pos) = @bytes.unpack1("V", offset: pos)
+        def s32(pos) = @bytes.unpack1("l<", offset: pos)
+
+        def slot_checks(slot)
+          usage = u32(slot.usage)
+          add("emf.bitmap.usage", "#{@layout[:name]} #{slot.name} UsageSrc/UsageMask #{usage} is not a DIBColors value") if usage > 2
+          bmi = range(slot, "#{slot.name} BMI", slot.off_bmi, slot.cb_bmi, "emf.bitmap.bmi_range")
+          bits = range(slot, "#{slot.name} bits", slot.off_bits, slot.cb_bits, "emf.bitmap.bits_range")
+          header = bmi && header_fields(bmi)
+          header_checks(slot, bmi, bits, header) if header
+          @header ||= header if slot.name == "source"
+          [bmi, bits]
+        end
+
+        def header_checks(slot, bmi, bits, header)
+          bits_length(slot, header)
+          color_table(slot, bmi, header, bits && bits[1] == bmi[2])
+          return unless slot.name == "mask" && header[:bit_count] != 1
+
+          add("emf.bitmap.mask_monochrome", "mask bitmap BitCount #{header[:bit_count]} is not monochrome (1)")
+        end
+
+        # [label, from, to] of a non-empty buffer range, or nil when empty or out of the record.
+        def range(slot, label, off_at, cb_at, id)
+          offset = u32(off_at)
+          count = u32(cb_at)
+          return if count.zero?
+
+          if offset + count > @size
+            add(id, "#{label} range #{offset}+#{count} runs past the #{@size}-byte record")
+            return
+          end
+          if offset < @layout[:size]
+            add("emf.bitmap.buffer_fixed_overlap",
+                "#{label} offset #{offset} lies inside the #{@layout[:size]}-byte fixed part")
+          end
+          [label, offset, offset + count, slot]
+        end
+
+        def overlaps(ranges)
+          reach = nil
+          ranges.sort_by { |range| range[1] }.each do |range|
+            add("emf.bitmap.buffer_overlap", "#{range[0]} overlaps #{reach[0]}") if reach && range[1] < reach[2]
+            reach = range if reach.nil? || range[2] > reach[2]
+          end
+        end
+
+        def other_fields
+          rop = @layout[:rop]
+          if rop && u32(rop) >> 24 != 0
+            add("emf.bitmap.raster_operation",
+                "raster operation 0x#{u32(rop).to_s(16)} has bits set above the 24-bit ternary code")
+          end
+          rop4 = @layout[:rop4]
+          if rop4 && @bytes.unpack1(
+            "v", offset: rop4
+          ) != 0
+            add("emf.bitmap.rop4_reserved",
+                "ROP4 reserved word 0x#{@bytes.unpack1('v', offset: rop4).to_s(16)} SHOULD be 0")
+          end
+          colorrefs
+          blend if @layout[:blend]
+          @layout[:extents]&.each do |pos|
+            add("emf.bitmap.positive_extent", "extent at offset #{pos} is #{s32(pos)}, MUST be greater than zero") unless s32(pos).positive?
+          end
+        end
+
+        def colorrefs
+          @layout[:colorrefs]&.each do |pos|
+            reserved = @bytes.getbyte(pos + 3)
+            next if reserved.zero?
+
+            id = [1, 2].include?(reserved) ? "emf.bitmap.colorref_palette" : "emf.bitmap.colorref_reserved"
+            add(id, "ColorRef at offset #{pos} has Reserved byte #{reserved}, MUST be 0")
+          end
+        end
+
+        def blend
+          pos = @layout[:blend]
+          operation, _flags, _alpha, format = @bytes.byteslice(pos, 4).unpack("C4")
+          unless operation.zero?
+            add("emf.bitmap.blend_operation",
+                "BlendOperation #{operation} is not 0 (AC_SRC_OVER, the only defined value)")
+          end
+          add("emf.bitmap.alpha_format", "AlphaFormat #{format} is neither 0 nor AC_SRC_ALPHA (1)") unless [0, 1].include?(format)
+          return unless format == 1 && @header && @header[:bit_count] != 32
+
+          add("emf.bitmap.alpha_format", "AC_SRC_ALPHA needs a 32 bits-per-pixel source, BMI says #{@header[:bit_count]}")
+        end
+      end
+    end
+
+    BitmapRules::RULES.each do |id, (citation, kind, severity, reason)|
+      Registry.loading.register(id: id, formats: BitmapRules::EMF, citation: citation, kind: kind, severity: severity,
+                                tolerant_reason: reason) { |context| BitmapRules.findings(context, id) }
+    end
+  end
+end