The formatter uses UWORD positions, counts and allocation sizes, and
unchecked arithmetic. Long paragraphs, tab expansion or accumulated
escape commands can truncate lengths and overrun buffers. Incomplete
escapes can read beyond input. A nonempty paragraph for which TextFit
returns zero without advancing the source, including an entirely
filtered paragraph, can cause a loop without progress. No cancellation
or timeout is provided. Justification assumes a nonzero measured space
width.
Setting Text frees the old source before copying the replacement. Never
pass the current Text getter pointer or a pointer into it to that
setter. Append copies into new storage before freeing the old source,
but its ULONG allocation-size calculation is unchecked. These
limitations describe this implementation, not guaranteed safe
arbitrary-input handling.