{"record":{"id":"397cd62e8330dc42","repo":"java-native-access/jna","slug":"sacl-is-invalid","errorCode":null,"errorMessage":"SACL is invalid","messagePattern":"SACL is invalid","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java","lineNumber":2901,"sourceCode":"                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain group\");\n            if (!Advapi32.INSTANCE.IsValidSid(psidGroup))\n                throw new IllegalArgumentException(\"Group PSID is invalid\");\n            infoType |= GROUP_SECURITY_INFORMATION;\n        }\n\n        if (setDACL) {\n            if (dacl == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain DACL\");\n            if (!Advapi32.INSTANCE.IsValidAcl(dacl.getPointer()))\n                throw new IllegalArgumentException(\"DACL is invalid\");\n            infoType |= DACL_SECURITY_INFORMATION;\n        }\n\n        if (setSACL) {\n            if (sacl == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain SACL\");\n            if (!Advapi32.INSTANCE.IsValidAcl(sacl.getPointer()))\n                throw new IllegalArgumentException(\"SACL is invalid\");\n            infoType |= SACL_SECURITY_INFORMATION;\n        }\n\n        /*\n         * Control bits SE_DACL_PROTECTED/SE_SACL_PROTECTED indicate the *ACL is protected. The *ACL_SECURITY_INFORMATION flags\n         * are meta flags for SetNamedSecurityInfo and are not stored in the SD.  If either *ACLProtectedStatus is set,\n         * get the current status from the securityDescriptor and apply as such, otherwise the ACL remains at its default.\n        */\n        if (setDACLProtectedStatus) {\n            if ((securityDescriptor.Control & SE_DACL_PROTECTED) != 0) {\n                infoType |= PROTECTED_DACL_SECURITY_INFORMATION;\n            }\n            else if ((securityDescriptor.Control & SE_DACL_PROTECTED) == 0) {\n                infoType |= UNPROTECTED_DACL_SECURITY_INFORMATION;\n            }\n        }\n\n        if (setSACLProtectedStatus) {","sourceCodeStart":2883,"sourceCodeEnd":2919,"githubUrl":"https://github.com/java-native-access/jna/blob/d036ad9781adad4b66693e8fa7098e4ac665e0a3/contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java#L2883-L2919","documentation":"When setSACL is requested and a SACL is present, Advapi32Util validates it with Advapi32.IsValidAcl; on failure it throws IllegalArgumentException ('SACL is invalid'), preventing a corrupt audit ACL from being written to the object.","triggerScenarios":"setSACL=true with a malformed SACL structure: bad header/revision, AclSize inconsistent with the buffer, corrupted SYSTEM_AUDIT ACEs, or a partially parsed ACL from a truncated descriptor.","commonSituations":"Hand-built audit ACEs with wrong sizes; descriptor buffers edited without adjusting SACL offsets; SACL copied across descriptors of different layouts.","solutions":["Pre-check with Advapi32.INSTANCE.IsValidAcl(sacl.getPointer()) and rebuild if false.","Rebuild the SACL programmatically (ACL/ACE structures via JNA) instead of reusing suspect bytes.","Re-extract the SACL from the source object with SE_SECURITY_NAME privilege held.","Skip the SACL component (setSACL=false) if audit configuration is not essential."],"exampleFix":"// before\nAdvapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);\n// after\nif (sd.getSystemACL() != null && Advapi32.INSTANCE.IsValidAcl(sd.getSystemACL().getPointer())) {\n    Advapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);\n}","handlingStrategy":"validation","validationCode":"ACL sacl = securityDescriptor.getSystemACL();\nif (sacl == null || !Advapi32.INSTANCE.IsValidAcl(sacl.getPointer())) {\n    throw new IllegalStateException(\"SACL missing or invalid\");\n}","typeGuard":"boolean isValidSACL(SECURITY_DESCRIPTOR_RELATIVE sd) {\n    ACL a = sd.getSystemACL();\n    return a != null && Advapi32.INSTANCE.IsValidAcl(a.getPointer());\n}","tryCatchPattern":"try {\n    Advapi32Util.setSecurityDescriptorComponents(sd, false, false, false, true, false, false);\n} catch (IllegalArgumentException e) {\n    log.error(\"SACL rejected: \" + e.getMessage());\n}","preventionTips":["Validate SACLs with Advapi32.INSTANCE.IsValidAcl before applying.","Rebuild audit ACLs programmatically rather than copying raw bytes between descriptors.","Re-extract SACLs from the source with proper privileges if validation fails."],"tags":["windows","security-descriptor","acl-validation","jna"],"backgroundTag":"invalid-argument-value","analyzedSha":"d036ad9781adad4b66693e8fa7098e4ac665e0a3","analyzedAt":"2026-09-12T06:50:59.239Z","contentChangedAt":"2026-09-12T06:50:59.239Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}