docvortex 0.2.1__py3-none-any.whl

docvortex/analyzers/native/office/doc/fib.py

@@ -0,0 +1,261 @@
+"""读取 Word 97–2003 WordDocument stream 中的变长 FIB。"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+import struct
+
+from ..errors import LegacyOfficeMalformedError
+
+FIB_IDENT = 0xA5EC
+MIN_WORD97_NFIB = 0x00C1
+
+FCLCB_STSHF = 1
+FCLCB_FOOTNOTE_REF = 2
+FCLCB_FOOTNOTE_TEXT = 3
+FCLCB_SECTION = 6
+FCLCB_HEADER = 11
+FCLCB_BTE_CHPX = 12
+FCLCB_BTE_PAPX = 13
+FCLCB_FIELD_MAIN = 16
+FCLCB_FIELD_HEADER = 17
+FCLCB_FIELD_FOOTNOTE = 18
+FCLCB_BOOKMARK_NAMES = 21
+FCLCB_BOOKMARK_START = 22
+FCLCB_BOOKMARK_END = 23
+FCLCB_DOP = 31
+FCLCB_CLX = 33
+FCLCB_SHAPE_MAIN = 40
+FCLCB_SHAPE_HEADER = 41
+FCLCB_ENDNOTE_REF = 46
+FCLCB_ENDNOTE_TEXT = 47
+FCLCB_FIELD_ENDNOTE = 48
+FCLCB_DGG_INFO = 50
+FCLCB_TEXTBOX_TEXT = 56
+FCLCB_FIELD_TEXTBOX = 57
+FCLCB_HEADER_TEXTBOX_TEXT = 58
+FCLCB_FIELD_HEADER_TEXTBOX = 59
+FCLCB_LISTS = 73
+FCLCB_LIST_OVERRIDES = 74
+FCLCB_TEXTBOX_BREAK = 75
+FCLCB_HEADER_TEXTBOX_BREAK = 76
+
+
+@dataclass(frozen=True, slots=True)
+class FcLcb:
+    """FIB 中一对 stream 偏移和字节长度。"""
+
+    fc: int = 0
+    lcb: int = 0
+
+
+@dataclass(frozen=True, slots=True)
+class FibBase:
+    """FIB 固定头中与解析相关的字段。"""
+
+    n_fib: int
+    lid: int
+    flags: int
+    fc_min: int
+    fc_mac: int
+
+    @property
+    def complex(self) -> bool:
+        """返回文档是否使用 complex/fast-save piece table。"""
+
+        return bool(self.flags & 0x0004)
+
+    @property
+    def encrypted(self) -> bool:
+        """返回文档是否设置加密标志。"""
+
+        return bool(self.flags & 0x0100)
+
+    @property
+    def uses_1table(self) -> bool:
+        """返回 FIB 指定的首选 Table stream。"""
+
+        return bool(self.flags & 0x0200)
+
+    @property
+    def far_east(self) -> bool:
+        """返回文档是否优先使用远东语言标识。"""
+
+        return bool(self.flags & 0x4000)
+
+    @property
+    def obfuscated(self) -> bool:
+        """返回文档是否设置 XOR 混淆标志。"""
+
+        return bool(self.flags & 0x8000)
+
+
+@dataclass(frozen=True, slots=True)
+class FileInformationBlock:
+    """完成边界校验的 Word 97+ FIB。"""
+
+    base: FibBase
+    rgw: tuple[int, ...]
+    rglw: tuple[int, ...]
+    pairs: tuple[FcLcb, ...]
+    csw_new: tuple[int, ...]
+    size: int
+
+    @property
+    def n_fib(self) -> int:
+        """返回版本扩展中的有效 nFib。"""
+
+        return self.csw_new[0] if self.csw_new else self.base.n_fib
+
+    def pair(self, index: int) -> FcLcb:
+        """读取可选 fc/lcb 对，不存在时返回零值。"""
+
+        return self.pairs[index] if 0 <= index < len(self.pairs) else FcLcb()
+
+    def story_count(self, index: int) -> int:
+        """读取 FibRgLw97 中一个 story 的 UTF-16 CP 数。"""
+
+        return int(self.rglw[index]) if 0 <= index < len(self.rglw) else 0
+
+    @property
+    def ccp_text(self) -> int:
+        """返回主文档 story 的 CP 数。"""
+
+        return self.story_count(3)
+
+    @property
+    def ccp_footnote(self) -> int:
+        """返回脚注 story 的 CP 数。"""
+
+        return self.story_count(4)
+
+    @property
+    def ccp_header(self) -> int:
+        """返回页眉页脚 story 的 CP 数。"""
+
+        return self.story_count(5)
+
+    @property
+    def ccp_macro(self) -> int:
+        """返回宏 story 的 CP 数。"""
+
+        return self.story_count(6)
+
+    @property
+    def ccp_annotation(self) -> int:
+        """返回批注 story 的 CP 数。"""
+
+        return self.story_count(7)
+
+    @property
+    def ccp_endnote(self) -> int:
+        """返回尾注 story 的 CP 数。"""
+
+        return self.story_count(8)
+
+    @property
+    def ccp_textbox(self) -> int:
+        """返回正文文本框 story 的 CP 数。"""
+
+        return self.story_count(9)
+
+    @property
+    def ccp_header_textbox(self) -> int:
+        """返回页眉文本框 story 的 CP 数。"""
+
+        return self.story_count(10)
+
+    @property
+    def total_story_cp(self) -> int:
+        """返回全部已知 story 的累计 CP 数。"""
+
+        return sum(self.story_count(index) for index in range(3, 11))
+
+    @property
+    def story_bases(self) -> dict[str, int]:
+        """返回各 story 在全局 CP 空间中的起点。"""
+
+        counts = [self.story_count(index) for index in range(3, 11)]
+        names = [
+            "main",
+            "footnote",
+            "header",
+            "macro",
+            "annotation",
+            "endnote",
+            "textbox",
+            "header_textbox",
+        ]
+        bases: dict[str, int] = {}
+        cursor = 0
+        for name, count in zip(names, counts, strict=True):
+            bases[name] = cursor
+            cursor += count
+        return bases
+
+
+def _read_values(data: bytes, offset: int, count: int, width: int, label: str) -> tuple[tuple[int, ...], int]:
+    """按指定宽度读取一组无符号小端整数。"""
+
+    if count < 0 or width not in {2, 4}:
+        raise LegacyOfficeMalformedError(f"invalid {label} count")
+    size = count * width
+    end = offset + size
+    if offset < 0 or end < offset or end > len(data):
+        raise LegacyOfficeMalformedError(f"truncated FIB {label}")
+    if count == 0:
+        return (), end
+    code = "H" if width == 2 else "I"
+    return tuple(int(value) for value in struct.unpack_from(f"<{count}{code}", data, offset)), end
+
+
+def parse_fib(word_document: bytes) -> FileInformationBlock:
+    """按 MS-DOC 变长布局解析 FIB，并拒绝 Word 95 及更早版本。"""
+
+    if len(word_document) < 34:
+        raise LegacyOfficeMalformedError("WordDocument FIB is truncated")
+    ident, n_fib = struct.unpack_from("<HH", word_document, 0)
+    if ident != FIB_IDENT:
+        raise LegacyOfficeMalformedError("WordDocument FIB magic is invalid")
+    if n_fib < MIN_WORD97_NFIB:
+        raise LegacyOfficeMalformedError(f"Word 95 or earlier nFib is unsupported: 0x{n_fib:04X}")
+    lid = int(struct.unpack_from("<H", word_document, 6)[0])
+    flags = int(struct.unpack_from("<H", word_document, 10)[0])
+    fc_min = int(struct.unpack_from("<I", word_document, 24)[0])
+    fc_mac = int(struct.unpack_from("<I", word_document, 28)[0])
+    base = FibBase(n_fib=n_fib, lid=lid, flags=flags, fc_min=fc_min, fc_mac=fc_mac)
+
+    cursor = 32
+    csw = int(struct.unpack_from("<H", word_document, cursor)[0])
+    cursor += 2
+    rgw, cursor = _read_values(word_document, cursor, csw, 2, "FibRgW")
+    if cursor + 2 > len(word_document):
+        raise LegacyOfficeMalformedError("truncated FIB cslw")
+    cslw = int(struct.unpack_from("<H", word_document, cursor)[0])
+    cursor += 2
+    rglw, cursor = _read_values(word_document, cursor, cslw, 4, "FibRgLw")
+    if cursor + 2 > len(word_document):
+        raise LegacyOfficeMalformedError("truncated FIB cbRgFcLcb")
+    pair_count = int(struct.unpack_from("<H", word_document, cursor)[0])
+    cursor += 2
+    raw_pairs, cursor = _read_values(word_document, cursor, pair_count * 2, 4, "FibRgFcLcb")
+    pairs = tuple(FcLcb(raw_pairs[index], raw_pairs[index + 1]) for index in range(0, len(raw_pairs), 2))
+
+    csw_new: tuple[int, ...] = ()
+    if cursor + 2 <= len(word_document):
+        count = int(struct.unpack_from("<H", word_document, cursor)[0])
+        cursor += 2
+        csw_new, cursor = _read_values(word_document, cursor, count, 2, "FibRgCswNew")
+    if len(rglw) <= 3:
+        # 确定性最小 fixture 可能省略变长计数，但仍保留 Word 97 固定槽位；
+        # 仅在标准布局不可用时按这些公开槽位做恢复读取。
+        if len(word_document) < 0x6C:
+            raise LegacyOfficeMalformedError("FIB does not contain ccpText")
+        rglw = tuple(int(struct.unpack_from("<I", word_document, 0x40 + index * 4)[0]) for index in range(11))
+        if not pairs and len(word_document) >= 0x382:
+            pairs = tuple(FcLcb(*struct.unpack_from("<II", word_document, 0x9A + index * 8)) for index in range(93))
+        cursor = max(cursor, 0x382)
+    fib = FileInformationBlock(base=base, rgw=rgw, rglw=rglw, pairs=pairs, csw_new=csw_new, size=cursor)
+    if fib.total_story_cp < fib.ccp_text:
+        raise LegacyOfficeMalformedError("FIB story CP count overflow")
+    return fib

docvortex/analyzers/native/office/doc/fields.py

@@ -0,0 +1,101 @@
+"""解析 DOC 字段指令并安全恢复超链接、目录和 caption 语义。"""
+
+from __future__ import annotations
+
+import re
+
+from loguru import logger
+
+from ..._shared.hyperlink import OFFICE_EXTERNAL_HYPERLINK_SCHEMES, sanitize_hyperlink_target
+from .models import DocTextRun
+
+_TOKEN_RE = re.compile(r'"(?:\\.|[^"\\])*"|\\\S|\S+')
+
+
+def field_keyword(instruction: str) -> str:
+    """返回字段指令的首个关键字大写形式。"""
+
+    tokens = _TOKEN_RE.findall(instruction.strip())
+    return tokens[0].strip('"').upper() if tokens else ""
+
+
+def is_toc_field(instruction: str) -> bool:
+    """判断字段是否为多段落 TOC。"""
+
+    return field_keyword(instruction) == "TOC"
+
+
+def is_caption_field(instruction: str) -> bool:
+    """判断字段是否为 Word SEQ caption 编号。"""
+
+    return field_keyword(instruction) == "SEQ"
+
+
+def is_chart_embed_field(instruction: str) -> bool:
+    """判断 EMBED 字段是否声明 Excel.Chart 或 MSGraph.Chart 对象。"""
+
+    tokens = _TOKEN_RE.findall(instruction.strip())
+    if len(tokens) < 2 or _unquote(tokens[0]).casefold() != "embed":
+        return False
+    prog_id = _unquote(tokens[1]).casefold()
+    return prog_id.startswith(("excel.chart", "msgraph.chart"))
+
+
+def _unquote(token: str) -> str:
+    """解码字段引号内允许的反斜杠转义。"""
+
+    if len(token) >= 2 and token[0] == token[-1] == '"':
+        token = token[1:-1]
+    return token.replace(r"\"", '"').replace(r"\\", "\\")
+
+
+def hyperlink_target(instruction: str) -> str | None:
+    """从 HYPERLINK 字段读取 URL 与可选内部书签。"""
+
+    tokens = _TOKEN_RE.findall(instruction.strip())
+    if not tokens or _unquote(tokens[0]).casefold() != "hyperlink":
+        return None
+    url: str | None = None
+    anchor: str | None = None
+    index = 1
+    while index < len(tokens):
+        token = tokens[index]
+        if token.startswith("\\"):
+            switch = token[1:].casefold()
+            argument: str | None = None
+            if switch in {"l", "o", "t"} and index + 1 < len(tokens) and not tokens[index + 1].startswith("\\"):
+                index += 1
+                argument = _unquote(tokens[index]).strip()
+            if switch == "l" and argument:
+                anchor = argument
+        elif url is None:
+            url = _unquote(token).strip()
+        index += 1
+    if url and anchor:
+        candidate = f"{url}#{anchor}"
+    elif url:
+        candidate = url
+    elif anchor:
+        candidate = f"#{anchor}"
+    else:
+        return None
+    safe = sanitize_hyperlink_target(
+        candidate,
+        allowed_schemes=OFFICE_EXTERNAL_HYPERLINK_SCHEMES,
+        allow_relative=True,
+        allow_fragment=True,
+    )
+    if safe is None:
+        logger.warning(f"DOC hyperlink target was rejected: {candidate!r}")
+    return safe
+
+
+def apply_field_result(instruction: str, runs: list[DocTextRun]) -> list[DocTextRun]:
+    """把 HYPERLINK 目标绑定到字段结果，其他字段仅保留缓存结果。"""
+
+    if field_keyword(instruction) != "HYPERLINK":
+        return runs
+    target = hyperlink_target(instruction)
+    if target is None:
+        return runs
+    return [DocTextRun(run.text, run.style, target, run.formula) for run in runs]

docvortex/analyzers/native/office/doc/formatting.py

@@ -0,0 +1,171 @@
+"""解析 Word CHPX/PAPX FKP 页面并提供按 FC 查询的格式 run。"""
+
+from __future__ import annotations
+
+from bisect import bisect_right
+from dataclasses import dataclass
+
+from loguru import logger
+
+from ..legacy.binary import bounded_slice, get_u32
+from .records import DocBudget
+from .sprm import PapDelta, apply_paragraph_sprms
+
+
+@dataclass(frozen=True, slots=True)
+class CharacterRun:
+    """一个物理 FC 范围内的原始 CHPX。"""
+
+    fc_start: int
+    fc_end: int
+    grpprl: bytes
+
+
+@dataclass(frozen=True, slots=True)
+class ParagraphRun:
+    """一个物理 FC 范围内的段落样式和 PAPX。"""
+
+    fc_start: int
+    fc_end: int
+    style_id: int
+    delta: PapDelta
+
+
+class FormattingRuns:
+    """按起始 FC 排序的 CHPX/PAPX 查询索引。"""
+
+    def __init__(self, characters: list[CharacterRun], paragraphs: list[ParagraphRun]) -> None:
+        """排序 run 并缓存二分查询键。"""
+
+        self.characters = sorted(characters, key=lambda run: run.fc_start)
+        self.paragraphs = sorted(paragraphs, key=lambda run: run.fc_start)
+        self._character_starts = [run.fc_start for run in self.characters]
+        self._paragraph_starts = [run.fc_start for run in self.paragraphs]
+
+    def character_at(self, fc: int) -> CharacterRun | None:
+        """返回覆盖指定 FC 的最后一个 CHPX run。"""
+
+        index = bisect_right(self._character_starts, fc) - 1
+        if index < 0:
+            return None
+        run = self.characters[index]
+        return run if fc < run.fc_end else None
+
+    def paragraph_at(self, fc: int) -> ParagraphRun | None:
+        """返回覆盖指定 FC 的最后一个 PAPX run。"""
+
+        index = bisect_right(self._paragraph_starts, fc) - 1
+        if index < 0:
+            return None
+        run = self.paragraphs[index]
+        return run if fc < run.fc_end else None
+
+
+def _parse_bte_pages(table_stream: bytes, offset: int, size: int) -> list[int]:
+    """从 PlcBteChpx/PlcBtePapx 读取 FKP page number。"""
+
+    plc = bounded_slice(table_stream, offset, size)
+    if plc is None or len(plc) < 8 or (len(plc) - 4) % 8:
+        return []
+    count = (len(plc) - 4) // 8
+    page_offset = (count + 1) * 4
+    pages: list[int] = []
+    for index in range(count):
+        raw = get_u32(plc, page_offset + index * 4)
+        if raw is not None:
+            pages.append(raw & 0x003F_FFFF)
+    return pages
+
+
+def _parse_chpx_page(page: bytes, budget: DocBudget) -> list[CharacterRun]:
+    """解析一个 512 字节 ChpxFkp。"""
+
+    count = page[511]
+    if count == 0 or (count + 1) * 4 + count > 511:
+        return []
+    result: list[CharacterRun] = []
+    offset_base = (count + 1) * 4
+    for index in range(count):
+        fc_start = get_u32(page, index * 4)
+        fc_end = get_u32(page, (index + 1) * 4)
+        if fc_start is None or fc_end is None or fc_end <= fc_start:
+            continue
+        byte_offset = page[offset_base + index]
+        grpprl = b""
+        if byte_offset:
+            payload_offset = byte_offset * 2
+            if payload_offset < 511:
+                length = page[payload_offset]
+                grpprl = page[payload_offset + 1 : payload_offset + 1 + length]
+        budget.charge()
+        result.append(CharacterRun(fc_start, fc_end, grpprl))
+    return result
+
+
+def _parse_papx_page(page: bytes, data_stream: bytes, budget: DocBudget) -> list[ParagraphRun]:
+    """解析一个 512 字节 PapxFkp。"""
+
+    count = page[511]
+    header_end = (count + 1) * 4 + count * 13
+    if count == 0 or header_end > 511:
+        return []
+    result: list[ParagraphRun] = []
+    bx_base = (count + 1) * 4
+    for index in range(count):
+        fc_start = get_u32(page, index * 4)
+        fc_end = get_u32(page, (index + 1) * 4)
+        if fc_start is None or fc_end is None or fc_end <= fc_start:
+            continue
+        byte_offset = page[bx_base + index * 13]
+        style_id = 0
+        delta = PapDelta()
+        if byte_offset:
+            payload_offset = byte_offset * 2
+            if payload_offset < 511:
+                first_length = page[payload_offset]
+                if first_length:
+                    content_offset = payload_offset + 1
+                    content_length = first_length * 2 - 1
+                elif payload_offset + 1 < 511:
+                    content_offset = payload_offset + 2
+                    content_length = page[payload_offset + 1] * 2
+                else:
+                    content_offset = 511
+                    content_length = 0
+                content = page[content_offset : min(content_offset + content_length, 511)]
+                if len(content) >= 2:
+                    style_id = int.from_bytes(content[:2], "little")
+                    delta = apply_paragraph_sprms(content[2:], data_stream, budget=budget)
+        budget.charge()
+        result.append(ParagraphRun(fc_start, fc_end, style_id, delta))
+    return result
+
+
+def parse_formatting_runs(
+    word_document: bytes,
+    table_stream: bytes,
+    data_stream: bytes,
+    *,
+    chpx_offset: int,
+    chpx_size: int,
+    papx_offset: int,
+    papx_size: int,
+    budget: DocBudget,
+) -> FormattingRuns:
+    """解析 FIB 指向的全部 CHPX/PAPX FKP；坏可选页仅告警跳过。"""
+
+    characters: list[CharacterRun] = []
+    paragraphs: list[ParagraphRun] = []
+    for page_number in _parse_bte_pages(table_stream, chpx_offset, chpx_size):
+        page = bounded_slice(word_document, page_number * 512, 512)
+        if page is None:
+            logger.warning(f"DOC ChpxFkp page is truncated: {page_number}")
+            continue
+        characters.extend(_parse_chpx_page(page, budget))
+    for page_number in _parse_bte_pages(table_stream, papx_offset, papx_size):
+        page = bounded_slice(word_document, page_number * 512, 512)
+        if page is None:
+            logger.warning(f"DOC PapxFkp page is truncated: {page_number}")
+            continue
+        paragraphs.extend(_parse_papx_page(page, data_stream, budget))
+    return FormattingRuns(characters, paragraphs)

docvortex/analyzers/native/office/doc/images.py

@@ -0,0 +1,162 @@
+"""从 DOC Data/PICF 与 Word OfficeArt drawing 中恢复图片。"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+import hashlib
+
+from loguru import logger
+
+from ..errors import LegacyOfficeResourceLimitError
+from ..legacy.binary import bounded_slice, get_u16, get_u32
+from ..limits import MAX_ASSET_TOTAL_BYTES
+from ..legacy.officeart import OfficeImagePayload, decode_bstore, extract_word_shapes, first_blip, record_at
+from ..equation.image import OfficeImageEquationDecoder
+
+from .models import DocImage, DocImagePayload
+from .records import DocBudget, parse_plc
+
+_PLACEABLE_WMF_MAGIC = b"\xd7\xcd\xc6\x9a"
+
+
+@dataclass(slots=True)
+class ImageStore:
+    """按内容去重并限制 DOC 图片累计字节数。"""
+
+    total: int = 0
+    cache: dict[tuple[bytes, tuple[int, int] | None], DocImagePayload] = field(default_factory=dict)
+    accounted_digests: set[bytes] = field(default_factory=set)
+    equation_cache: dict[bytes, str | None] = field(default_factory=dict)
+    equation_decoder: OfficeImageEquationDecoder = field(default_factory=OfficeImageEquationDecoder)
+
+    def add(self, payload: OfficeImagePayload) -> DocImagePayload:
+        """计入一张唯一图片并返回内部载荷。"""
+
+        digest = hashlib.sha256(payload.data).digest()
+        cache_key = digest, payload.render_size_emu
+        cached = self.cache.get(cache_key)
+        if cached is not None:
+            return cached
+        is_new_payload = digest not in self.accounted_digests
+        if is_new_payload and self.total + len(payload.data) > MAX_ASSET_TOTAL_BYTES:
+            raise LegacyOfficeResourceLimitError(f"embedded assets exceed max_asset_total_bytes={MAX_ASSET_TOTAL_BYTES}")
+        if digest in self.equation_cache:
+            equation_latex = self.equation_cache[digest]
+        else:
+            equation_latex = self.equation_decoder.decode(
+                payload.data,
+                part_name=f"image.{payload.extension}",
+                content_type=payload.content_type,
+            )
+        converted = DocImagePayload(
+            payload.data,
+            payload.extension,
+            payload.content_type,
+            equation_latex,
+            render_size_emu=payload.render_size_emu,
+        )
+        if is_new_payload:
+            self.total += len(payload.data)
+            self.accounted_digests.add(digest)
+        self.equation_cache[digest] = equation_latex
+        self.cache[cache_key] = converted
+        return converted
+
+
+def inline_picture(
+    data_stream: bytes,
+    *,
+    offset: int,
+    store: ImageStore,
+    budget: DocBudget,
+) -> DocImagePayload | None:
+    """解析 sprmCPicLocation 指向的 PICFAndOfficeArtData。"""
+
+    total_length = get_u32(data_stream, offset)
+    header_length = get_u16(data_stream, offset + 4)
+    if total_length is None or header_length is None or total_length < header_length:
+        return None
+    picf = bounded_slice(data_stream, offset, total_length)
+    if picf is None:
+        logger.warning(f"DOC picture at Data offset {offset} is out of bounds")
+        return None
+    art = picf[min(header_length, len(picf)) :]
+    decoded = first_blip(art, charge=budget.charge)
+    if decoded is None:
+        # 少量旧文件把原始位图直接放在 PICF 尾部，按 magic 尽力保留。
+        signatures = (
+            (_PLACEABLE_WMF_MAGIC, "wmf", "image/wmf"),
+            (b"\x89PNG\r\n\x1a\n", "png", "image/png"),
+            (b"\xff\xd8\xff", "jpg", "image/jpeg"),
+            (b"GIF8", "gif", "image/gif"),
+            (b"BM", "bmp", "image/bmp"),
+            (b"II*\x00", "tiff", "image/tiff"),
+            (b"MM\x00*", "tiff", "image/tiff"),
+        )
+        for signature, extension, content_type in signatures:
+            position = art.find(signature)
+            if position >= 0:
+                decoded = OfficeImagePayload(art[position:], extension, content_type)
+                break
+    return store.add(decoded) if decoded is not None else None
+
+
+def floating_pictures(
+    table_stream: bytes,
+    *,
+    word_document: bytes,
+    shape_plc_offset: int,
+    shape_plc_size: int,
+    drawing_offset: int,
+    drawing_size: int,
+    store: ImageStore,
+    budget: DocBudget,
+) -> list[DocImage]:
+    """按 PlcfSpaMom anchor CP 将 floating shape 的 BStore 图片绑定到正文。"""
+
+    plc_payload = bounded_slice(table_stream, shape_plc_offset, shape_plc_size)
+    drawing = bounded_slice(table_stream, drawing_offset, drawing_size)
+    if plc_payload is None or drawing is None:
+        return []
+    cps, items = parse_plc(plc_payload, item_size=26, budget=budget)
+    if not items:
+        return []
+    assets = decode_bstore(
+        drawing,
+        charge=budget.charge,
+        delay_stream=word_document,
+    )
+    shapes = {}
+    first = record_at(drawing, 0, charge=budget.charge)
+    cursor = (8 + len(first.payload)) if first is not None else len(drawing)
+    while cursor < len(drawing):
+        # OfficeArtWordDrawing 在 DgContainer 前有一个 main/header 标签字节。
+        cursor += 1
+        container = record_at(drawing, cursor, charge=budget.charge)
+        if container is None:
+            break
+        for shape in extract_word_shapes(container.payload, charge=budget.charge):
+            if shape.shape_id is not None:
+                shapes.setdefault(shape.shape_id, shape)
+        cursor += 8 + len(container.payload)
+    anchors = [
+        (shape_id, cps[index])
+        for index, item in enumerate(items)
+        if index < len(cps) and (shape_id := get_u32(item, 0)) is not None
+    ]
+    images: list[DocImage] = []
+    for shape_id, shape in sorted(shapes.items()):
+        if shape.hidden or shape.pib is None:
+            continue
+        payload = assets.get(shape.pib)
+        if payload is None:
+            continue
+        anchor_cp = next((cp for anchor_id, cp in anchors if anchor_id == shape_id), None)
+        if anchor_cp is None:
+            candidates = [(anchor_id, cp) for anchor_id, cp in anchors if anchor_id <= shape_id]
+            if candidates:
+                anchor_cp = max(candidates)[1]
+        if anchor_cp is None:
+            continue
+        images.append(DocImage(cp=anchor_cp, payload=store.add(payload)))
+    return images