{"record":{"id":"2befb2af32f07c82","repo":"puppetlabs/puppet","slug":"invalid-sid-2befb2","errorCode":null,"errorMessage":"Invalid SID","messagePattern":"Invalid SID","errorType":"exception","errorClass":"Puppet::Util::Windows::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/user.rb","lineNumber":60,"sourceCode":"  # logon for a separate reason\n  ERROR_ACCOUNT_RESTRICTION = 1327\n  ERROR_INVALID_LOGON_HOURS = 1328\n  ERROR_INVALID_WORKSTATION = 1329\n  ERROR_ACCOUNT_DISABLED    = 1331\n\n  def check_token_membership\n    is_admin = false\n    FFI::MemoryPointer.new(:byte, SECURITY_MAX_SID_SIZE) do |sid_pointer|\n      FFI::MemoryPointer.new(:dword, 1) do |size_pointer|\n        size_pointer.write_uint32(SECURITY_MAX_SID_SIZE)\n\n        if CreateWellKnownSid(:WinBuiltinAdministratorsSid, FFI::Pointer::NULL, sid_pointer, size_pointer) == FFI::WIN32_FALSE\n          raise Puppet::Util::Windows::Error, _(\"Failed to create administrators SID\")\n        end\n      end\n\n      if IsValidSid(sid_pointer) == FFI::WIN32_FALSE\n        raise Puppet::Util::Windows::Error, _(\"Invalid SID\")\n      end\n\n      FFI::MemoryPointer.new(:win32_bool, 1) do |ismember_pointer|\n        if CheckTokenMembership(FFI::Pointer::NULL_HANDLE, sid_pointer, ismember_pointer) == FFI::WIN32_FALSE\n          raise Puppet::Util::Windows::Error, _(\"Failed to check membership\")\n        end\n\n        # Is administrators SID enabled in calling thread's access token?\n        is_admin = ismember_pointer.read_win32_bool\n      end\n    end\n\n    is_admin\n  end\n  module_function :check_token_membership\n\n  def password_is?(name, password, domain = '.')\n    logon_user(name, password, domain) { |token| }","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/user.rb#L42-L78","documentation":"Raised by Puppet::Util::Windows::User.check_token_membership as a defensive post-condition: CreateWellKnownSid claimed success but the produced buffer fails IsValidSid. It guards against feeding a garbage SID into CheckTokenMembership. Since the input is a constant well-known SID type, hitting this implies corrupted output memory or an API contract violation, not bad input.","triggerScenarios":"The freshly created SID buffer being corrupted between the two calls — native memory overwrite by another extension, broken advapi32 behavior on emulation layers, or a mocked FFI layer in tests returning success while leaving the buffer zeroed (zeroed memory fails IsValidSid because Revision is 0).","commonSituations":"Spec suites stubbing CreateWellKnownSid without writing a valid Revision byte into the buffer; a loaded native gem stomping the stack/heap of the Puppet process. Essentially never occurs on healthy systems.","solutions":["In test doubles, write a minimal valid SID into the buffer (first byte Revision = 1).","Restart the agent if native corruption is suspected in production.","Capture a crash dump if it recurs to identify the component corrupting memory.","Do not attempt caller-side workarounds — the inputs are constants."],"exampleFix":"// exampleFix not applicable - defensive internal check\nnull","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"begin\n  Puppet::Util::Windows::User.check_token_membership\nrescue Puppet::Util::Windows::Error => e\n  raise unless e.message == 'Invalid SID'\n  Puppet.warning('CreateWellKnownSid returned garbage; possible native memory corruption')\n  nil\nend","preventionTips":["In test doubles, write a Revision byte of 1 into the SID buffer.","Escalate recurring occurrences — output corruption from CreateWellKnownSid signals a broken native environment."],"tags":["windows","sid","validation","puppet"],"backgroundTag":"invalid-sid","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}