When you read this code, you can quickly understand the properties of this function and how to avoid buffer overrun security issues. Notice that these annotations resemble the information in the documentation, but they are more concise and they follow a semantic pattern. _Out_writes_bytes_all_(count) void *dest, SAL could provide more clarity about the properties and implementation of the function, as shown here: void * memcpy( It doesn't know that there is a relationship between the two buffers and count, and it also can't effectively guess about a relationship. However, the compiler can't read the documentation or informal comments. The destination buffer must be at least as large as the source buffer. Memcpy copies the count of bytes from the source buffer to the destination buffer. The documentation contains a couple of bits of information that suggest that your code has to maintain certain properties to ensure program correctness: For more information, see Avoiding Buffer Overruns.' Important: Make sure that the destination buffer is the same size or larger than the source buffer. Use memmove to handle overlapping regions. If the source and destination overlap, the behavior of memcpy is undefined. ' memcpy copies count bytes from src to dest wmemcpy copies count wide characters (two bytes). Here's what the documentation for memcpy says:

Without SAL annotations, you'd have to rely on documentation or code comments. Just by looking at a declaration such as the one in the example, you don't know what they are.

Consider this example that shows the C runtime function memcpy: void * memcpy(Ĭan you tell what this function does? When a function is implemented or called, certain properties must be maintained to ensure program correctness. SAL can help you make your code design more understandable, both for humans and for code analysis tools. Simply stated, SAL is an inexpensive way to let the compiler check your code for you. By using SAL annotations, you can describe your functions in greater detail so that developers who are consuming them can better understand how to use them. Natively, C and C++ provide only limited ways for developers to consistently express intent and invariance. For more information about SAL 2.0 for Windows driver development, see SAL 2.0 Annotations for Windows Drivers. Visual Studio code analysis for C++ uses SAL annotations to modify its analysis of functions. The annotations are defined in the header file. The Microsoft source-code annotation language (SAL) provides a set of annotations that you can use to describe how a function uses its parameters, the assumptions that it makes about them, and the guarantees that it makes when it finishes.

Sal & gabi