[misc] fix PVS-Studio static analyzer warnings

* Surround macro params to ensure expected results
* Fix copy-paste errors
* Fix a potential buffer overflow in SetSectionHeaders()
* Add const modifier where relevant
* Use GetWindowLongPtr() everywhere
* Use proper sprintf format for unsigned int
* Use %s for printf-like funcs (https://www.viva64.com/en/w/v618/print/)
* Closes #1464

src/badblocks.c

@@ -463,7 +463,7 @@ static unsigned int test_rw(HANDLE hDrive, blk64_t last_block, size_t block_size
 			if (max_bb && bb_count >= max_bb) {
 				if (s_flag || v_flag) {
 					uprintf(abort_msg);
-					fprintf(log_fd, abort_msg);
+					fprintf(log_fd, "%s", abort_msg);
 					fflush(log_fd);
 				}
 				cancel_ops = -1;
@@ -511,7 +511,7 @@ static unsigned int test_rw(HANDLE hDrive, blk64_t last_block, size_t block_size
 			if (max_bb && bb_count >= max_bb) {
 				if (s_flag || v_flag) {
 					uprintf(abort_msg);
-					fprintf(log_fd, abort_msg);
+					fprintf(log_fd, "%s", abort_msg);
 					fflush(log_fd);
 				}
 				cancel_ops = -1;

src/format.c

@@ -250,8 +250,8 @@ static void ToValidLabel(char* Label, BOOL bFAT)
 {
 	size_t i, j, k;
 	BOOL found;
-	WCHAR unauthorized[] = L"*?,;:/\\|+=<>[]\"";
+	const WCHAR unauthorized[] = L"*?,;:/\\|+=<>[]\"";
-	WCHAR to_underscore[] = L"\t.";
+	const WCHAR to_underscore[] = L"\t.";
 	WCHAR *wLabel = utf8_to_wchar(Label);
 
 	if (wLabel == NULL)
@@ -1863,7 +1863,7 @@ DWORD WINAPI FormatThread(void* param)
 			if (report.bb_count) {
 				bb_msg = lmprintf(MSG_011, report.bb_count, report.num_read_errors, report.num_write_errors,
 					report.num_corruption_errors);
-				fprintf(log_fd, bb_msg);
+				fprintf(log_fd, "%s", bb_msg);
 				GetLocalTime(&lt);
 				fprintf(log_fd, APPLICATION_NAME " bad blocks check ended on: %04d.%02d.%02d %02d:%02d:%02d",
 				lt.wYear, lt.wMonth, lt.wDay, lt.wHour, lt.wMinute, lt.wSecond);

src/format_ext.c

@@ -177,7 +177,7 @@ const char* error_message(errcode_t error_code)
 			static_sprintf(error_string, "Unknown ext2fs error %ld (EXT2_ET_BASE + %ld)", error_code, error_code - EXT2_ET_BASE);
 		} else {
 			SetLastError((FormatStatus == 0) ? (ERROR_SEVERITY_ERROR | FAC(FACILITY_STORAGE) | (error_code & 0xFFFF)) : FormatStatus);
-			static_sprintf(error_string, WindowsErrorString());
+			static_sprintf(error_string, "%s", WindowsErrorString());
 		}
 		return error_string;
 	}

src/localization.c

@@ -378,7 +378,7 @@ char* lmprintf(uint32_t msg_id, ...)
 	}
 
 	if (format == NULL) {
-		safe_sprintf(buf[buf_id], LOC_MESSAGE_SIZE-1, "MSG_%03d UNTRANSLATED", msg_id - MSG_000);
+		safe_sprintf(buf[buf_id], LOC_MESSAGE_SIZE-1, "MSG_%03u UNTRANSLATED", msg_id - MSG_000);
 	} else {
 		if (right_to_left_mode && (msg_table != default_msg_table)) {
 			if (is_rtf) {

src/net.c

@@ -41,7 +41,7 @@
 #include "settings.h"
 
 /* Maximum download chunk size, in bytes */
-#define DOWNLOAD_BUFFER_SIZE    10*KB
+#define DOWNLOAD_BUFFER_SIZE    (10*KB)
 /* Default delay between update checks (1 day) */
 #define DEFAULT_UPDATE_INTERVAL (24*3600)
 

src/parser.c

@@ -646,7 +646,7 @@ char* get_token_data_file_indexed(const char* token, const char* filename, int i
 		goto out;
 	}
 	wtoken = utf8_to_wchar(token);
-	if (wfilename == NULL) {
+	if (wtoken == NULL) {
 		uprintf(conversion_error, token);
 		goto out;
 	}
@@ -695,7 +695,7 @@ char* set_token_data_file(const char* token, const char* data, const char* filen
 		goto out;
 	}
 	wtoken = utf8_to_wchar(token);
-	if (wfilename == NULL) {
+	if (wtoken == NULL) {
 		uprintf(conversion_error, token);
 		goto out;
 	}
@@ -974,7 +974,7 @@ char* insert_section_data(const char* filename, const char* section, const char*
 		goto out;
 	}
 	wsection = utf8_to_wchar(section);
-	if (wfilename == NULL) {
+	if (wsection == NULL) {
 		uprintf(conversion_error, section);
 		goto out;
 	}
@@ -1110,7 +1110,7 @@ char* replace_in_token_data(const char* filename, const char* token, const char*
 		goto out;
 	}
 	wtoken = utf8_to_wchar(token);
-	if (wfilename == NULL) {
+	if (wtoken == NULL) {
 		uprintf(conversion_error, token);
 		goto out;
 	}
@@ -1120,7 +1120,7 @@ char* replace_in_token_data(const char* filename, const char* token, const char*
 		goto out;
 	}
 	wrep = utf8_to_wchar(rep);
-	if (wsrc == NULL) {
+	if (wrep == NULL) {
 		uprintf(conversion_error, rep);
 		goto out;
 	}

src/rufus.c

@@ -138,7 +138,7 @@ const char* flash_type[BADLOCKS_PATTERN_TYPES] = { "SLC", "MLC", "TLC" };
 static void SetClusterSizeLabels(void)
 {
 	unsigned int i, j, msg_id;
-	safe_sprintf(ClusterSizeLabel[0], 64, lmprintf(MSG_029));
+	safe_sprintf(ClusterSizeLabel[0], 64, "%s", lmprintf(MSG_029));
 	for (i=512, j=1, msg_id=MSG_026; j<MAX_CLUSTER_SIZES; i<<=1, j++) {
 		if (i > 8192) {
 			i /= 1024;
@@ -885,7 +885,7 @@ static BOOL PopulateProperties(void)
 	EnableControls(TRUE, FALSE);
 
 	// Set a proposed label according to the size (eg: "256MB", "8GB")
-	static_sprintf(SelectedDrive.proposed_label,
+	static_sprintf(SelectedDrive.proposed_label, "%s",
 		SizeToHumanReadable(SelectedDrive.DiskSize, FALSE, use_fake_units));
 
 	// Add a tooltip (with the size of the device in parenthesis)

src/rufus.h

@@ -656,8 +656,8 @@ static __inline HMODULE GetLibraryHandle(char* szLibraryName) {
 	if ((pf##proc == NULL) && (NT_SUCCESS(status))) status = STATUS_NOT_IMPLEMENTED; } while(0)
 
 /* Custom application errors */
-#define FAC(f)                         (f<<16)
+#define FAC(f)                         ((f)<<16)
-#define APPERR(err)                    (APPLICATION_ERROR_MASK|err)
+#define APPERR(err)                    (APPLICATION_ERROR_MASK|(err))
 #define ERROR_INCOMPATIBLE_FS          0x1201
 #define ERROR_CANT_QUICK_FORMAT        0x1202
 #define ERROR_INVALID_CLUSTER_SIZE     0x1203

src/rufus.rc

@@ -33,7 +33,7 @@ LANGUAGE LANG_NEUTRAL, SUBLANG_NEUTRAL
 IDD_DIALOG DIALOGEX 12, 12, 232, 326
 STYLE DS_SETFONT | DS_MODALFRAME | DS_CENTER | WS_MINIMIZEBOX | WS_POPUP | WS_CAPTION | WS_SYSMENU
 EXSTYLE WS_EX_ACCEPTFILES
-CAPTION "Rufus 3.9.1622"
+CAPTION "Rufus 3.9.1623"
 FONT 9, "Segoe UI Symbol", 400, 0, 0x0
 BEGIN
     LTEXT           "Drive Properties",IDS_DRIVE_PROPERTIES_TXT,8,6,53,12,NOT WS_GROUP
@@ -395,8 +395,8 @@ END
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 3,9,1622,0
+ FILEVERSION 3,9,1623,0
- PRODUCTVERSION 3,9,1622,0
+ PRODUCTVERSION 3,9,1623,0
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -414,13 +414,13 @@ BEGIN
             VALUE "Comments", "https://rufus.ie"
             VALUE "CompanyName", "Akeo Consulting"
             VALUE "FileDescription", "Rufus"
-            VALUE "FileVersion", "3.9.1622"
+            VALUE "FileVersion", "3.9.1623"
             VALUE "InternalName", "Rufus"
             VALUE "LegalCopyright", "© 2011-2020 Pete Batard (GPL v3)"
             VALUE "LegalTrademarks", "https://www.gnu.org/licenses/gpl-3.0.html"
             VALUE "OriginalFilename", "rufus-3.9.exe"
             VALUE "ProductName", "Rufus"
-            VALUE "ProductVersion", "3.9.1622"
+            VALUE "ProductVersion", "3.9.1623"
         END
     END
     BLOCK "VarFileInfo"

src/ui.c

@@ -149,7 +149,7 @@ void GetMainButtonsWidth(HWND hDlg)
 {
 	unsigned int i;
 	RECT rc;
-	LONG style;
+	LONG_PTR style;
 	char download[64];
 
 	GetWindowRect(GetDlgItem(hDlg, main_button_ids[0]), &rc);
@@ -167,9 +167,9 @@ void GetMainButtonsWidth(HWND hDlg)
 		static_strcpy(download, lmprintf(MSG_040));
 		CharUpperBuffU(download, sizeof(download));
 		bw = max(bw, GetTextSize(GetDlgItem(hDlg, IDC_SELECT), download).cx + (3 * cbw) / 2);
-		style = GetWindowLong(GetDlgItem(hDlg, IDC_SELECT), GWL_STYLE);
+		style = GetWindowLongPtr(GetDlgItem(hDlg, IDC_SELECT), GWL_STYLE);
-		style|= BS_SPLITBUTTON;
+		style |= BS_SPLITBUTTON;
-		SetWindowLong(GetDlgItem(hDlg, IDC_SELECT), GWL_STYLE, style);
+		SetWindowLongPtr(GetDlgItem(hDlg, IDC_SELECT), GWL_STYLE, style);
 	}
 }
 
@@ -561,7 +561,7 @@ void SetSectionHeaders(HWND hDlg)
 		SendDlgItemMessageA(hDlg, section_control_ids[i], WM_SETFONT, (WPARAM)hf, TRUE);
 		hCtrl = GetDlgItem(hDlg, section_control_ids[i]);
 		memset(wtmp, 0, sizeof(wtmp));
-		GetWindowTextW(hCtrl, wtmp, ARRAYSIZE(wtmp));
+		GetWindowTextW(hCtrl, wtmp, ARRAYSIZE(wtmp) - 3);
 		wlen = wcslen(wtmp);
 		wtmp[wlen++] = L' ';
 		wtmp[wlen++] = L' ';