{"record":{"id":"a3bbaf20632765e1","repo":"astrid-runtime/astrid","slug":"permissiondenied-a3bbaf","errorCode":"PermissionDenied","errorMessage":"malformed Windows ACL for {description}: {reason}","messagePattern":"malformed Windows ACL for (.+?): (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-core/src/platform_fs/windows/acl/ace.rs","lineNumber":261,"sourceCode":"\n    let subauthority_bytes = usize::from(fixed_header[1])\n        .checked_mul(SID_SUBAUTHORITY_SIZE)\n        .ok_or_else(|| malformed(description, \"the ACE SID length overflowed\"))?;\n    let expected_length = SID_FIXED_HEADER_SIZE\n        .checked_add(subauthority_bytes)\n        .ok_or_else(|| malformed(description, \"the ACE SID length overflowed\"))?;\n    if expected_length > sid_capacity {\n        return Err(malformed(\n            description,\n            \"an access-allowed ACE contains subauthorities beyond its declared size\",\n        ));\n    }\n\n    Ok(expected_length)\n}\n\nfn malformed(description: &str, reason: &str) -> io::Error {\n    io::Error::new(\n        io::ErrorKind::PermissionDenied,\n        format!(\"malformed Windows ACL for {description}: {reason}\"),\n    )\n}\n\n#[cfg(test)]\nmod tests {\n    use super::*;\n    use windows_sys::Win32::Security::ACL_REVISION;\n    use windows_sys::Win32::System::SystemServices::{\n        ACCESS_ALLOWED_CALLBACK_ACE_TYPE, ACCESS_ALLOWED_OBJECT_ACE_TYPE,\n    };\n\n    #[repr(align(4))]\n    struct AlignedAce([u8; 64]);\n\n    impl AlignedAce {\n        fn with_header(ace_type: u32, ace_size: u16) -> Self {","sourceCodeStart":243,"sourceCodeEnd":279,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-core/src/platform_fs/windows/acl/ace.rs#L243-L279","documentation":"This error is produced by the malformed() helper in the Windows ACE parser whenever a raw ACE from the OS cannot be decoded safely: wrong length, invalid SID, truncated structure, or an unexpected SID length for the ACE type. It signals a corrupt or hostile security descriptor rather than a policy violation, so it is surfaced as PermissionDenied.","triggerScenarios":"parse_ace/from_raw reading an ACE header whose declared length does not match the buffer, an SID whose expected_sid_length disagrees with the actual sub-authority count, or any structurally invalid ACE while decoding a file's DACL.","commonSituations":"Corrupted NTFS security descriptors after disk issues; third-party filesystems or filter drivers returning non-standard ACE layouts; fuzzed or crafted descriptors; buffers truncated by an intermediate API layer.","solutions":["Read the descriptor again (the corruption may be transient) with icacls <path> or Get-Acl to see what the OS reports","Restore the ACL: icacls <path> /reset or reinstall/rewrite the file so a fresh descriptor is created","Run chkdsk on the volume if descriptors are repeatedly malformed","If a specific filter/filesystem driver is in the path, exclude the file from it or report the bug to the driver vendor"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Sanity-check the descriptor before full validation\nfn descriptor_readable(path: &std::ffi::OsStr) -> bool {\n    std::fs::metadata(path).is_ok() // plus a GetNamedSecurityInfoW probe that succeeds\n}","typeGuard":null,"tryCatchPattern":"match validate_trusted_file_acl_handle(&file) {\n    Err(e) if e.to_string().starts_with(\"malformed Windows ACL\") => {\n        eprintln!(\"Corrupt security descriptor; reset ACL or reinstall the file\");\n    }\n    other => other?,\n}","preventionTips":["Run chkdsk periodically on volumes holding trusted binaries","Avoid third-party filesystems/filter drivers for install directories","Reinstall rather than hand-repairing binary files after disk errors"],"tags":["windows","acl","security","parsing","fs"],"backgroundTag":"invalid-argument-format","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}