Please note that most of this format (everything except the first 8 bytes of region_header) is documented in MS-EMFPLUS section 2.2.1.8: http://msdn.microsoft.com/en-us/library/cc230724.aspx
+ switch (path_header->flags & FLAGS_INTPATH)
You should check for other flags here, namely 0x1000 which indicates RLE compression of point types and 0x0400 which indicates that points are relative to the previous point. (Not saying we need to support them initially, but please check so we know if they appear. Also, the lower 16 bits other than those flags are supposed to always be 0, so maybe we should check them for unknown values as well.)
+ if (!region_header || region_header->magic != VERSION_MAGIC) + return InvalidParameter;
This should also accept 0xdbc01002, for GDI+ version 1.1.
+ if (i == 1) continue; /* data[1] never matches */
If that's the case, shouldn't you have a test that it doesn't match?