RtlStringCbPrintfExW - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTSTRSAFE_H_INCLUDED_
#ifndef NTSTRSAFE_LIB_IMPL
#ifndef _M_CEE_PURE
#ifndef NTSTRSAFE_NO_CB_FUNCTIONS
NTSTRSAFEDDI
RtlStringCbPrintfExW(
_Out_writes_bytes_(cbDest) _Always_(_Post_z_) NTSTRSAFE_PWSTR pszDest,
_In_ size_t cbDest,
_Outptr_opt_result_bytebuffer_(*pcbRemaining) NTSTRSAFE_PWSTR* ppszDestEnd,
_Out_opt_ size_t* pcbRemaining,
_In_ DWORD dwFlags,
_In_ _Printf_format_string_ NTSTRSAFE_PCWSTR pszFormat,
...)
{
NTSTATUS status;
size_t cchDest = cbDest / sizeof(wchar_t);
status = RtlStringExValidateDestW(pszDest, cchDest, NTSTRSAFE_MAX_CCH, dwFlags);
if (NT_SUCCESS(status))
{
NTSTRSAFE_PWSTR pszDestEnd = pszDest;
size_t cchRemaining = cchDest;
status = RtlStringExValidateSrcW(&pszFormat, NULL, NTSTRSAFE_MAX_CCH, dwFlags);
if (NT_SUCCESS(status))
{
if (dwFlags & (~STRSAFE_VALID_FLAGS))
{
status = STATUS_INVALID_PARAMETER;
if (cchDest != 0)
{
*pszDest = L'\0';
}
}
else if (cchDest == 0)
{
// only fail if there was actually a non-empty format string
if (*pszFormat != L'\0')
{
if (pszDest == NULL)
{
status = STATUS_INVALID_PARAMETER;
}
else
{
status = STATUS_BUFFER_OVERFLOW;
}
}
else
{
// for consistency with other use in this case...
__analysis_assume_nullterminated(pszDest);
}
}
else
{
size_t cchNewDestLength = 0;
va_list argList;
va_start(argList, pszFormat);
status = RtlStringVPrintfWorkerW(pszDest,
cchDest,
&cchNewDestLength,
pszFormat,
argList);
va_end(argList);
pszDestEnd = pszDest + cchNewDestLength;
cchRemaining = cchDest - cchNewDestLength;
if (NT_SUCCESS(status) && (dwFlags & STRSAFE_FILL_BEHIND_NULL))
{
size_t cbRemaining;
// safe to multiply cchRemaining * sizeof(wchar_t) since cchRemaining < NTSTRSAFE_MAX_CCH and sizeof(wchar_t) is 2
cbRemaining = (cchRemaining * sizeof(wchar_t)) + (cbDest % sizeof(wchar_t));
// handle the STRSAFE_FILL_BEHIND_NULL flag
RtlStringExHandleFillBehindNullW(pszDestEnd, cbRemaining, dwFlags);
}
}
}
else
{
if (cchDest != 0)
{
*pszDest = L'\0';
}
}
if (!NT_SUCCESS(status) &&
(dwFlags & (STRSAFE_NO_TRUNCATION | STRSAFE_FILL_ON_FAILURE | STRSAFE_NULL_ON_FAILURE)) &&
(cbDest != 0))
{
// handle the STRSAFE_FILL_ON_FAILURE, STRSAFE_NULL_ON_FAILURE, and STRSAFE_NO_TRUNCATION flags
RtlStringExHandleOtherFlagsW(pszDest,
cbDest,
0,
&pszDestEnd,
&cchRemaining,
dwFlags);
}
if (NT_SUCCESS(status) || (status == STATUS_BUFFER_OVERFLOW))
{
if (ppszDestEnd)
{
*ppszDestEnd = pszDestEnd;
}
if (pcbRemaining)
{
// safe to multiply cchRemaining * sizeof(wchar_t) since cchRemaining < NTSTRSAFE_MAX_CCH and sizeof(wchar_t) is 2
*pcbRemaining = (cchRemaining * sizeof(wchar_t)) + (cbDest % sizeof(wchar_t));
}
}
}
else if (cchDest > 0)
{
*pszDest = L'\0';
}
return status;
}
View code on GitHub// ntstrsafe.h
NTSTRSAFEDDI RtlStringCbPrintfExW(
[out, optional] NTSTRSAFE_PWSTR pszDest,
[in] size_t cbDest,
[out, optional] NTSTRSAFE_PWSTR *ppszDestEnd,
[out, optional] size_t *pcbRemaining,
[in] DWORD dwFlags,
[in, optional] NTSTRSAFE_PCWSTR pszFormat,
...
);
View the official Windows Driver Kit DDI referenceNo description available.
The RtlStringCbPrintfExW and RtlStringCbPrintfExA functions create a byte-counted text string, with formatting that is based on supplied formatting information.
pszDest [out, optional]A pointer to a caller-supplied buffer that receives a formatted, null-terminated string. The function creates this string from both the formatting string that is supplied by pszFormat and the function's argument list. The pszDest pointer can be NULL, but only if STRSAFE_IGNORE_NULLS is set in dwFlags.
cbDest [in]The size of the destination buffer, in bytes. The buffer must be large enough to contain the formatted string plus the terminating null character.
For Unicode strings, the maximum number of bytes is NTSTRSAFE_MAX_CCH * sizeof(WCHAR).
For ANSI strings, the maximum number of bytes is NTSTRSAFE_MAX_CCH * sizeof(char).
If pszDest is NULL, cbDest must be zero.
ppszDestEnd [out, optional]If the caller supplies a non-NULL address pointer then, after the operation completes, the function loads that address with a pointer to the destination buffer's resulting null string terminator.
pcbRemaining [out, optional]If the caller supplies a non-NULL address pointer, the function loads the address with the number of unused bytes that are in the buffer pointed to by pszDest, including bytes used for the terminating null character.
dwFlags [in]One or more flags and, optionally, a fill byte. The flags are defined as follows:
| Value | Meaning |
|---|---|
| STRSAFE_FILL_BEHIND_NULL | If set and the function succeeds, the low byte of dwFlags is used to fill the portion of the destination buffer that follows the terminating null character. |
| STRSAFE_IGNORE_NULLS | If set, either pszDest or pszSrc, or both, can be NULL. NULLpszSrc pointers are treated like empty strings (TEXT("")), which can be copied. NULLpszDest pointers cannot receive nonempty strings. |
| STRSAFE_FILL_ON_FAILURE | If set and the function fails, the low byte of dwFlags is used to fill the entire destination buffer, and the buffer is null-terminated. This operation overwrites any preexisting buffer contents. |
| STRSAFE_NULL_ON_FAILURE | If set and the function fails, the destination buffer is set to an empty string (TEXT("")). This operation overwrites any preexisting buffer contents. |
| STRSAFE_NO_TRUNCATION | If set and the function returns STATUS_BUFFER_OVERFLOW, the contents of the destination buffer are not modified. |
pszFormat [in, optional]A pointer to a null-terminated text string that contains printf-styled formatting directives. The pszFormat pointer can be NULL, but only if STRSAFE_IGNORE_NULLS is set in dwFlags.
...A list of arguments that are interpreted by the function, based on formatting directives contained in the pszFormat string.
The function returns one of the NTSTATUS values that are listed in the following table. For information about how to test NTSTATUS values, see Using NTSTATUS Values.
| Return code | Description |
|---|---|
| STATUS_SUCCESS | This success status means source data was present, the output string was created without truncation, and the resultant destination buffer is null-terminated. |
| STATUS_BUFFER_OVERFLOW | This warning status means the operation did not complete due to insufficient space in the destination buffer. If STRSAFE_NO_TRUNCATION is set in dwFlags, the destination buffer is not modified. If the flag is not set, the destination buffer contains a truncated version of the created string. |
| STATUS_INVALID_PARAMETER | This error status means the function received an invalid input parameter. For more information, see the following paragraph. The function returns the STATUS_INVALID_PARAMETER value when: * An invalid flag was specified. * The value in cbDest is larger than the maximum buffer size. * The destination buffer was already full. * A NULL pointer was present without the STRSAFE_IGNORE_NULLS flag. * The destination buffer pointer was NULL, but the buffer size was not zero. * The destination buffer pointer was NULL, or its length was zero, but a nonzero length source string was present. |
RtlStringCbPrintfExW and RtlStringCbPrintfExA should be used instead of the following functions:
All of these functions accept a format string and a list of arguments, interpret them, and create a formatted string. The size, in bytes, of the destination buffer is provided to RtlStringCbPrintfExW and RtlStringCbPrintfExA to ensure that they do not write past the end of the buffer.
RtlStringCbPrintfExW and RtlStringCbPrintfExA add to the functionality of RtlStringCbPrintf by returning a pointer to the end of the destination string, as well as the number of bytes left unused in that string. Flags can be passed to the function for additional control.
Use RtlStringCbPrintfExW to handle Unicode strings and RtlStringCbPrintfExA to handle ANSI strings. The form you use depends on your data, as shown in the following table.
| String data type | String literal | Function |
|---|---|---|
| WCHAR | L"string" | RtlStringCbPrintfExW |
| char | "string" | RtlStringCbPrintfExA |
If pszDest and pszFormat point to overlapping strings or if any argument strings overlap, the behavior of the function is undefined.
Neither pszFormat nor pszDest can be NULL unless the STRSAFE_IGNORE_NULLS flag is set, in which case either or both can be NULL. If pszDest is NULL, pszFormat must either be NULL or point to an empty string.
For more information about the safe string functions, see Using Safe String Functions.