RtlStringCbCatExA - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
#ifndef _NTSTRSAFE_H_INCLUDED_
#ifndef NTSTRSAFE_LIB_IMPL
#ifndef NTSTRSAFE_NO_CB_FUNCTIONS

/*++

  NTSTATUS
  RtlStringCbCatEx(
  _Inout_updates_bytes_(cbDest) _Always_(_Post_z_) LPTSTR  pszDest         OPTIONAL,
  _In_     size_t  cbDest,
  _In_     LPCTSTR pszSrc          OPTIONAL,
  _Outptr_opt_result_bytebuffer_(*pcbRemaining)    LPTSTR* ppszDestEnd     OPTIONAL,
  _Out_opt_    size_t* pcbRemaining    OPTIONAL,
  _In_     DWORD   dwFlags
  );

  Routine Description:

  This routine is a safer version of the C built-in function 'strcat' with
  some additional parameters.  In addition to functionality provided by
  RtlStringCbCat, this routine also returns a pointer to the end of the
  destination string and the number of bytes left in the destination string
  including the null terminator. The flags parameter allows additional controls.

Arguments:

pszDest         -   destination string which must be null terminated

cbDest          -   size of destination buffer in bytes.
length must be ((_tcslen(pszDest) + _tcslen(pszSrc) + 1) * sizeof(TCHAR)
to hold all of the combine string plus the null
terminator.

pszSrc          -   source string which must be null terminated

ppszDestEnd     -   if ppszDestEnd is non-null, the function will return a
pointer to the end of the destination string.  If the
function appended any data, the result will point to the
null termination character

pcbRemaining    -   if pcbRemaining is non-null, the function will return
the number of bytes left in the destination string,
including the null terminator

dwFlags         -   controls some details of the string copy:

STRSAFE_FILL_BEHIND_NULL
if the function succeeds, the low byte of dwFlags will be
used to fill the uninitialize part of destination buffer
behind the null terminator

STRSAFE_IGNORE_NULLS
treat NULL string pointers like empty strings (TEXT("")).
this flag is useful for emulating functions like lstrcat

STRSAFE_FILL_ON_FAILURE
if the function fails, the low byte of dwFlags will be
used to fill all of the destination buffer, and it will
be null terminated. This will overwrite any pre-existing
or truncated string

STRSAFE_NULL_ON_FAILURE
if the function fails, the destination buffer will be set
to the empty string. This will overwrite any pre-existing or
truncated string

STRSAFE_NO_TRUNCATION
if the function returns STATUS_BUFFER_OVERFLOW, pszDest
will not contain a truncated string, it will remain unchanged.

Notes:
Behavior is undefined if source and destination strings overlap.

pszDest and pszSrc should not be NULL unless the STRSAFE_IGNORE_NULLS flag
is specified.  If STRSAFE_IGNORE_NULLS is passed, both pszDest and pszSrc
may be NULL.  An error may still be returned even though NULLS are ignored
due to insufficient space.

Return Value:

STATUS_SUCCESS -   if there was source data and it was all concatenated
and the resultant dest string was null terminated

failure        -   you can use the macro NTSTATUS_CODE() to get a win32
error code for all hresult failure cases

STATUS_BUFFER_OVERFLOW /
NTSTATUS_CODE(status) == ERROR_INSUFFICIENT_BUFFER
-   this return value is an indication that the operation
failed due to insufficient space. When this error
occurs, the destination buffer is modified to contain
a truncated version of the ideal result and is null
terminated. This is useful for situations where
truncation is ok.

It is strongly recommended to use the NT_SUCCESS() macro to test the
return value of this function

--*/


NTSTRSAFEDDI
    RtlStringCbCatExA(
            _Inout_updates_bytes_(cbDest) _Always_(_Post_z_) NTSTRSAFE_PSTR pszDest,
            _In_ size_t cbDest,
            _In_ NTSTRSAFE_PCSTR pszSrc,
            _Outptr_opt_result_bytebuffer_(*pcbRemaining) NTSTRSAFE_PSTR* ppszDestEnd,
            _Out_opt_ size_t* pcbRemaining,
            _In_ DWORD dwFlags)
{
    NTSTATUS status;
    size_t cchDest = cbDest / sizeof(char);
    size_t cchDestLength;

    status = RtlStringExValidateDestAndLengthA(pszDest,
            cchDest,
            &cchDestLength,
            NTSTRSAFE_MAX_CCH,
            dwFlags);

    if (NT_SUCCESS(status))
    {
        NTSTRSAFE_PSTR pszDestEnd = pszDest + cchDestLength;
        size_t cchRemaining = cchDest - cchDestLength;

        status = RtlStringExValidateSrcA(&pszSrc, NULL, NTSTRSAFE_MAX_CCH, dwFlags);

        if (NT_SUCCESS(status))
        {
            if (dwFlags & (~STRSAFE_VALID_FLAGS))
            {
                status = STATUS_INVALID_PARAMETER;
            }
            else if (cchRemaining <= 1)
            {
                // only fail if there was actually src data to append
                if (*pszSrc != '\0')
                {
                    if (pszDest == NULL)
                    {
                        status = STATUS_INVALID_PARAMETER;
                    }
                    else
                    {
                        status = STATUS_BUFFER_OVERFLOW;
                    }
                }
            }
            else
            {
                size_t cchCopied = 0;

                status = RtlStringCopyWorkerA(pszDestEnd,
                        cchRemaining,
                        &cchCopied,
                        pszSrc,
                        NTSTRSAFE_MAX_LENGTH);

                pszDestEnd = pszDestEnd + cchCopied;
                cchRemaining = cchRemaining - cchCopied;

                if (NT_SUCCESS(status)                           &&
                        (dwFlags & STRSAFE_FILL_BEHIND_NULL)    &&
                        (cchRemaining > 1))
                {
                    size_t cbRemaining;

                    // safe to multiply cchRemaining * sizeof(char) since cchRemaining < NTSTRSAFE_MAX_CCH and sizeof(char) is 1
                    cbRemaining = (cchRemaining * sizeof(char)) + (cbDest % sizeof(char));

                    // handle the STRSAFE_FILL_BEHIND_NULL flag
                    RtlStringExHandleFillBehindNullA(pszDestEnd, cbRemaining, dwFlags);
                }
            }
        }

        if (!NT_SUCCESS(status)                                                                              &&
                (dwFlags & (STRSAFE_NO_TRUNCATION | STRSAFE_FILL_ON_FAILURE | STRSAFE_NULL_ON_FAILURE)) &&
                (cbDest != 0))
        {
            // handle the STRSAFE_FILL_ON_FAILURE, STRSAFE_NULL_ON_FAILURE, and STRSAFE_NO_TRUNCATION flags
            RtlStringExHandleOtherFlagsA(pszDest,
                    cbDest,
                    cchDestLength,
                    &pszDestEnd,
                    &cchRemaining,
                    dwFlags);
        }

        if (NT_SUCCESS(status) || (status == STATUS_BUFFER_OVERFLOW))
        {
            if (ppszDestEnd)
            {
                *ppszDestEnd = pszDestEnd;
            }

            if (pcbRemaining)
            {
                // safe to multiply cchRemaining * sizeof(char) since cchRemaining < NTSTRSAFE_MAX_CCH and sizeof(char) is 1
                *pcbRemaining = (cchRemaining * sizeof(char)) + (cbDest % sizeof(char));
            }
        }
    }

    return status;
}

#endif
#endif
#endif

View code on GitHub
// ntstrsafe.h

NTSTRSAFEDDI RtlStringCbCatExA(
  [in, out, optional] NTSTRSAFE_PSTR  pszDest,
  [in]                size_t          cbDest,
  [in, optional]      NTSTRSAFE_PCSTR pszSrc,
  [out, optional]     NTSTRSAFE_PSTR  *ppszDestEnd,
  [out, optional]     size_t          *pcbRemaining,
  [in]                DWORD           dwFlags
);
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (nf-ntstrsafe-rtlstringcbcatexa)

RtlStringCbCatExA function

Description

The RtlStringCbCatExW and RtlStringCbCatExA functions concatenate two byte-counted strings.

Parameters

pszDest [in, out, optional]

A pointer to a buffer which, on input, contains a null-terminated string to which pszSrc will be concatenated. On output, this is the destination buffer that contains the entire resultant string. The string at pszSrc is added to the end of the string at pszDest and terminated with a null character. The pszDest pointer can be NULL, but only if STRSAFE_IGNORE_NULLS is set in dwFlags.

cbDest [in]

The size of the destination buffer, in bytes. The buffer must be large enough to include both strings and the terminating null character.

For Unicode strings, the maximum number of bytes is NTSTRSAFE_MAX_CCH * sizeof(WCHAR)

For ANSI strings, the maximum number of bytes is NTSTRSAFE_MAX_CCH * sizeof(char)

pszSrc [in, optional]

A pointer to a null-terminated string. This string will be concatenated to the end of the string that is contained in the buffer at pszDest. The pszSrc pointer can be NULL, but only if STRSAFE_IGNORE_NULLS is set in dwFlags.

ppszDestEnd [out, optional]

If the caller supplies a non-NULL address pointer, then after the concatenation operation completes, the function loads that address with a pointer to the destination buffer's resulting NULL string terminator.

pcbRemaining [out, optional]

If the caller supplies a non-NULL address pointer, the function loads the address with the number of unused bytes that are in the buffer pointed to by pszDest, including bytes used for the terminating null character.

dwFlags [in]

One or more flags and, optionally, a fill byte. The flags are defined as follows:

Value Meaning
STRSAFE_FILL_BEHIND_NULL If this flag is set and the function succeeds, the low byte of dwFlags is used to fill the portion of the destination buffer that follows the terminating null character.
STRSAFE_IGNORE_NULLS If this flag is set, either pszDest or pszSrc, or both, can be NULL. NULL pszSrc pointers are treated like empty strings (TEXT("")), which can be copied. NULL pszDest pointers cannot receive nonempty strings.
STRSAFE_FILL_ON_FAILURE If this flag is set and the function fails, the low byte of dwFlags is used to fill the entire destination buffer, and the buffer is null-terminated. This operation overwrites any preexisting buffer contents.
STRSAFE_NULL_ON_FAILURE If this flag is set and the function fails, the destination buffer is set to an empty string (TEXT("")). This operation overwrites any preexisting buffer contents.
STRSAFE_NO_TRUNCATION If this flag is set and the function returns STATUS_BUFFER_OVERFLOW:

* If STRSAFE_FILL_ON_FAILURE is also specified, STRSAFE_NO_TRUNCATION fills the destination buffer accordingly.
* Otherwise, the destination buffer will be unmodified.

Return value

The function returns one of the NTSTATUS values that are listed in the following table. For information about how to test NTSTATUS values, see Using NTSTATUS Values.

Return code Description
STATUS_SUCCESS This success status means source data was present, the strings were fully concatenated without truncation, and the resultant destination buffer is null-terminated.
STATUS_BUFFER_OVERFLOW This warning status means the copy operation did not complete due to insufficient space in the destination buffer. If STRSAFE_NO_TRUNCATION is set, see the dwFlags parameter for more information.
STATUS_INVALID_PARAMETER This error status means the function received an invalid input parameter. For more information, see the following paragraph.

The function returns the STATUS_INVALID_PARAMETER when:

* An invalid flag was specified.
* The value in cbDest is larger than the maximum buffer size.
* The destination buffer was already full.
* A NULL pointer was present without the STRSAFE_IGNORE_NULLS flag.
* The destination buffer pointer was NULL, but the buffer size was not zero.
* The destination buffer pointer was NULL, or its length was zero, but a nonzero length source string was present.

Remarks

RtlStringCbCatExW and RtlStringCbCatExA should be used instead of the following functions:

Because RtlStringCbCatExW and RtlStringCbCatExAreceive the size of the destination buffer as input, they will not write past the end of the buffer.

RtlStringCbCatEx adds to the functionality of RtlStringCbCat by returning a pointer to the end of the destination string, as well as the number of bytes left unused in that string. Flags can also be passed to the function for additional control.

Use RtlStringCbCatExW to handle Unicode strings and RtlStringCbCatExA to handle ANSI strings. The form to use is determined by your data, as shown in the following table.

String data type String literal Function
WCHAR L"string" RtlStringCbCatExW
char "string" RtlStringCbCatExA

If pszSrc and pszDest point to overlapping strings, the behavior of the function is undefined.

Neither pszSrc nor pszDest can be NULL unless the STRSAFE_IGNORE_NULLS flag is set, in which case either or both can be NULL. If pszDest is NULL, pszSrc must either be NULL or point to an empty string.

For more information about the safe string functions, see Using safe string functions.

See also

View the official Windows Driver Kit DDI reference

Edit description on GitHub