C++ password generator with WinAPI clipboard function

Question

I made a simple password generator with a copy-to-clipboard functionality implemented via WinAPI calls. Here is the code:

#include <iostream>
#include <string>
#include <random>
#include <algorithm>
#include <Windows.h>

void copytoclipboard(const std::string& s){
    HGLOBAL hMem = GlobalAlloc(GMEM_MOVEABLE, s.size() + 1);
    memcpy(GlobalLock(hMem), s.c_str(), s.size() + 1);
    GlobalUnlock(hMem);
    OpenClipboard(0);
    EmptyClipboard();
    SetClipboardData(CF_TEXT, hMem);
    CloseClipboard();
}
int main(){
    std::string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789%^&$+-_!@#%?";
    std::string pw = "";
    const int pass_length = 12;
    const int from = 0;
    const int to = chars.size();
    std::random_device rd;
    std::mt19937 g(rd());
    std::uniform_int_distribution<int>  distr(from, to);
    auto rng = std::default_random_engine{};
    std::shuffle(chars.begin(), chars.end(), rng);
    for (int i = 0; i < pass_length; ++i){
        pw.push_back(chars[distr(g)]);
    }
    copytoclipboard(pw);
}

What can be improved and are there any pitfalls with the above approach such as the lack of GlobalFree(hMem);?

Answer 1

Out Of Bounds Problem

const int to = chars.size();
...
std::uniform_int_distribution<int>  distr(from, to);

uniform_int_distribution - Produces random integer values i, uniformly distributed on the closed interval [a, b]

So if chars were "ABC", size is 3, and the range of values returned would be [0,3] = 0,1,2 and 3. 3 is an invalid index. Therefore 'to' should be chars.size() - 1.

Error Checking

You should check the return values on system functions like OpenClipboard.

if (!OpenClipboard())
{
    auto lastError = GetLastError();
    // get error message, throw exception?
}

GlobalFree

From MSDN - If SetClipboardData succeeds, the system owns the object identified by the hMem parameter. The application may not write to or free the data once ownership has been transferred to the system

So it looks like a GlobalFree call is not needed. You should free it though if SetClipboardData (or any of the other system calls) fails.