I am not sure if StringCbPrintf
and the include file strsafe.h
where it is defined belong the the WinAPI. On one hand, Microsoft documents the function on its WinAPI sites and strsafe.h
is under the Windows SDK directory structure which indicates (to me, at least) that it is indeed part of the WinAPI. On the other hand, strsafe.h
includes stdio.h
etc. which belong to the CRT. I was always under the impression that the WinAPI is completely independent from the CRT (but not vice versa). Possibly, my assumption about the relationship between WinAPI and CRT is wrong. Thus my question: is StringCbPrintf
part of the WinAPI?
2 Answers
The StrSafe API is a bit strange because it does not have its own .DLL nor its own exported functions. I assume it was developed this way because it needed to support older versions of Windows that had already been released. It was created during the WinXP service pack security push:
During February and March 2002, all application development in Microsoft stopped and developers took part in the Security Push initiative. The goal was to check all code for possible security vulnerabilities and fix those problems. One of the outcomes of the Security Push was a library of safe string functions called "strsafe.lib" with an associated header called "strsafe.h." This library is available through the Platform SDK that can be downloaded from the MSDN web site and is automatically installed as part of Visual C++.NET 2003.
As far as I can tell, a copy of strsafe.h was also included with Writing Secure Code (Second Edition) by Michael Howard and David LeBlanc but I'm not sure if they are the original authors (David LeBlanc is the author of SafeInt):
You can find a copy of Strsafe.h in the companion content in the folder Secureco2\Strsafe.
msvcrt.dll is basically a system file these days, only Windows 95 shipped without it. You are not supposed to use it as your C run-time but SDK code from Microsoft can probably use it without issues.
msvcrt.dll is now a "known DLL," meaning that it is a system component owned and built by Windows. It is intended for future use only by system-level components.
If you want to use msvcrt.dll as your C run-time as well then you must use the WDK for <= Windows 7 but when using the inline version of StrSafe.h, as long as you link to a .lib that contains the required vsnprintf
type functions it should not really matter which CRT it comes from. There is also a StrSafe.lib file but Microsoft recommends that you use the inline version.
You are correct that the Windows API is supposed to be independent of the CRT but StrSafe also supports stdin functions like StringCbGetsA
and they did not choose to separate those into a separate header for whatever reason. That combined with the need for a existing vsnprintf
type function to do the actual work means that StrSafe is somewhat attached to the CRT even though it is meant to be used by all WinAPI developers.
There is probably no true answer to whether it is part of the WinAPI or not since it is a bit subjective. Since it is included with the SDK in the include folder one would assume that Microsoft believes it is a SDK/API component and not a CRT component.
If it's not implemented in Windows and exported from one of its DLLs (as e.g. CreateFile() or CloseHandle() from kernel32.dll), I'd say it's not part of the WinAPI, even if it ends up calling things that are implemented in Windows.
-
The main question is - which .dll is exporting these functions. Commented Feb 28, 2019 at 10:47
-
@montonero As far as I can see, StringCbPrintf() appears to be defined (not just declared) in Strsafe.h and not exported from any DLL in the system32 directory. The MSDN page for this function lists only this header file whereas for e.g. lstrcat() both Winbase.h and kernel32.dll are listed. Commented Feb 28, 2019 at 11:06
-
@montonero - the
StringCbPrintf
is inline function implemented in strsafe.h. internal it finally call_vsnwprintf
which exported from different dlls– RbMmCommented Feb 28, 2019 at 11:07 -
_vsnwprintf
is not exported from a WinAPI dll which only adds to my confisuion because I fell that consequently,StringCbPrintf
should documented along with the CRT and its header file should be found in the CRT directory/ies. Commented Feb 28, 2019 at 11:38 -
1@RenéNyffenegger
_vsnwprintf
is exported from several different dlls. including msvcrt.dll and ntdll.dll in user mode. in kernel mode this is exported by ntoskrnl.exe. part or not this of winapi - relative question.– RbMmCommented Feb 28, 2019 at 11:54