1

I am not sure if StringCbPrintf and the include file strsafe.h where it is defined belong the the WinAPI. On one hand, Microsoft documents the function on its WinAPI sites and strsafe.h is under the Windows SDK directory structure which indicates (to me, at least) that it is indeed part of the WinAPI. On the other hand, strsafe.h includes stdio.h etc. which belong to the CRT. I was always under the impression that the WinAPI is completely independent from the CRT (but not vice versa). Possibly, my assumption about the relationship between WinAPI and CRT is wrong. Thus my question: is StringCbPrintf part of the WinAPI?

2 Answers 2

2

The StrSafe API is a bit strange because it does not have its own .DLL nor its own exported functions. I assume it was developed this way because it needed to support older versions of Windows that had already been released. It was created during the WinXP service pack security push:

During February and March 2002, all application development in Microsoft stopped and developers took part in the Security Push initiative. The goal was to check all code for possible security vulnerabilities and fix those problems. One of the outcomes of the Security Push was a library of safe string functions called "strsafe.lib" with an associated header called "strsafe.h." This library is available through the Platform SDK that can be downloaded from the MSDN web site and is automatically installed as part of Visual C++.NET 2003.

As far as I can tell, a copy of strsafe.h was also included with Writing Secure Code (Second Edition) by Michael Howard and David LeBlanc but I'm not sure if they are the original authors (David LeBlanc is the author of SafeInt):

You can find a copy of Strsafe.h in the companion content in the folder Secureco2\Strsafe.


msvcrt.dll is basically a system file these days, only Windows 95 shipped without it. You are not supposed to use it as your C run-time but SDK code from Microsoft can probably use it without issues.

msvcrt.dll is now a "known DLL," meaning that it is a system component owned and built by Windows. It is intended for future use only by system-level components.

If you want to use msvcrt.dll as your C run-time as well then you must use the WDK for <= Windows 7 but when using the inline version of StrSafe.h, as long as you link to a .lib that contains the required vsnprintf type functions it should not really matter which CRT it comes from. There is also a StrSafe.lib file but Microsoft recommends that you use the inline version.


You are correct that the Windows API is supposed to be independent of the CRT but StrSafe also supports stdin functions like StringCbGetsA and they did not choose to separate those into a separate header for whatever reason. That combined with the need for a existing vsnprintf type function to do the actual work means that StrSafe is somewhat attached to the CRT even though it is meant to be used by all WinAPI developers.

There is probably no true answer to whether it is part of the WinAPI or not since it is a bit subjective. Since it is included with the SDK in the include folder one would assume that Microsoft believes it is a SDK/API component and not a CRT component.

0

If it's not implemented in Windows and exported from one of its DLLs (as e.g. CreateFile() or CloseHandle() from kernel32.dll), I'd say it's not part of the WinAPI, even if it ends up calling things that are implemented in Windows.

10
  • The main question is - which .dll is exporting these functions.
    – montonero
    Commented Feb 28, 2019 at 10:47
  • @montonero As far as I can see, StringCbPrintf() appears to be defined (not just declared) in Strsafe.h and not exported from any DLL in the system32 directory. The MSDN page for this function lists only this header file whereas for e.g. lstrcat() both Winbase.h and kernel32.dll are listed. Commented Feb 28, 2019 at 11:06
  • @montonero - the StringCbPrintf is inline function implemented in strsafe.h. internal it finally call _vsnwprintf which exported from different dlls
    – RbMm
    Commented Feb 28, 2019 at 11:07
  • _vsnwprintf is not exported from a WinAPI dll which only adds to my confisuion because I fell that consequently, StringCbPrintf should documented along with the CRT and its header file should be found in the CRT directory/ies. Commented Feb 28, 2019 at 11:38
  • 1
    @RenéNyffenegger _vsnwprintf is exported from several different dlls. including msvcrt.dll and ntdll.dll in user mode. in kernel mode this is exported by ntoskrnl.exe. part or not this of winapi - relative question.
    – RbMm
    Commented Feb 28, 2019 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.