what does (return +1) mean in windows API buffer annotation?

What does return + 1 mean here

DWORD
WINAPI
GetModuleFileName(
    __in_opt HMODULE hModule,
    __out_ecount_part(nSize, return + 1) LPTSTR lpFilename,
    __in DWORD nSize
    );

It means "one more than the value returned by the call". __out_ecount_part annotation wants its length expression to include the NUL terminator, and the GetModuleFileName return value doesn't include the terminator, so +1 to account for the difference.

> If the function succeeds, the return value is the length of the string that is copied to the buffer, in characters, not including the terminating null character.

In "C" all strings are '\0' terminated. so the +1 allows for that extra '\0' at the end of the filename

SAL annotations are generally built as combinations of primitives. __out_ecount_part, specifically, denotes a parameter that the function writes output through (_out). Indices index into elements as opposed to bytes (_ecount), and the function only writes to part of the buffer (_part).

The final two arguments in the annotation denote the buffer's total size and initialized length (on return). The total size is simple, as that value has a name (nSize). The initialized length, however, is the return value of the function, which doesn't have a name. SAL uses return to refer to it.

return + 1 thus states that, on return, the buffer has been filled from the start up to (but not including) the index one past the function's return value. The + 1 accounts for the zero-terminator, the most common encoding for strings in C.

Note that SAL annotations are evaluated by static code analyzer tools only. None of this is meaningful to a C or C++ compiler. SAL annotations are implemented as preprocessor macros and get fully purged during pre-processing. This allows the use of otherwise reserved keywords (such as return).