{"record":{"id":"abb4a3538a98e360","repo":"astrid-runtime/astrid","slug":"malformed-windows-acl-for-description-reason","errorCode":null,"errorMessage":"malformed Windows ACL for {description}: {reason}","messagePattern":"malformed Windows ACL for (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-core/src/local_transport/windows/acl.rs","lineNumber":339,"sourceCode":"    }\n\n    let subauthority_bytes = usize::from(fixed_header[1])\n        .checked_mul(SID_SUBAUTHORITY_SIZE)\n        .ok_or_else(|| malformed(description, \"the ACE SID length overflowed\"))?;\n    let expected_length = SID_FIXED_HEADER_SIZE\n        .checked_add(subauthority_bytes)\n        .ok_or_else(|| malformed(description, \"the ACE SID length overflowed\"))?;\n    if expected_length > sid_capacity {\n        return Err(malformed(\n            description,\n            \"an access-allowed ACE contains subauthorities beyond its declared size\",\n        ));\n    }\n    Ok(expected_length)\n}\n\nfn malformed(description: &str, reason: &str) -> io::Error {\n    io::Error::new(\n        io::ErrorKind::PermissionDenied,\n        format!(\"malformed Windows ACL for {description}: {reason}\"),\n    )\n}\n\n#[cfg(test)]\nmod tests {\n    use super::*;\n    use windows_sys::Win32::Security::ACL_REVISION;\n    use windows_sys::Win32::System::SystemServices::ACCESS_ALLOWED_OBJECT_ACE_TYPE;\n\n    #[repr(align(4))]\n    struct AlignedAce([u8; 64]);\n\n    impl AlignedAce {\n        fn with_header(ace_type: u32, ace_size: u16) -> Self {\n            let mut result = Self([0; 64]);\n            result.0[0] = u8::try_from(ace_type).unwrap();","sourceCodeStart":321,"sourceCodeEnd":357,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-core/src/local_transport/windows/acl.rs#L321-L357","documentation":"The bounded ACL parser in acl.rs produces this error whenever a raw Windows ACL structure fails structural validation: null DACL pointer, invalid ACL per IsValidAcl, out-of-bounds ACEs, bad SID lengths, or leftover bytes. It guards against corrupted or maliciously crafted security descriptors returned for the named pipe, converting them into a PermissionDenied error of the form 'malformed Windows ACL for {description}: {reason}' where {reason} details the exact defect.","triggerScenarios":"Called from ValidatedAcl::from_raw, ValidatedAcl::ace, parse_ace, expected_sid_length, or bytes_remaining_from when GetSecurityInfo returns an ACL/ACE/SID that fails bounds or structure checks during connect()/accept() pipe validation.","commonSituations":"Kernel/driver corruption or a buggy third-party filter driver rewriting pipe ACLs; memory corruption or a hostile process tampering with pipe security descriptors; Windows version quirks producing unusual SID sub-authority counts; fuzzed/adversarial pipe endpoints.","solutions":["Retry the connection once — if the descriptor was transiently inconsistent this usually resolves it by re-reading a valid descriptor.","Recreate the pipe via the library so a known-good descriptor is installed.","Check for third-party filter drivers (antivirus/EDR) touching named-pipe security descriptors and exclude the pipe path.","Capture the {reason} text from the message and report it if it persists on pipes you control — it indicates corrupted ACL structures."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Preflight: read the descriptor yourself and run IsValidAcl before connecting\n// unsafe { IsValidAcl(dacl_ptr) } == 0 => recreate the pipe before calling connect()","typeGuard":null,"tryCatchPattern":"// Malformed ACLs are rarely recoverable in-process; do one bounded retry then surface the reason\nfor attempt in 0..2 {\n    match connect() {\n        Err(e) if attempt == 0 && e.to_string().starts_with(\"malformed Windows ACL\") => continue,\n        r => break r.map_err(|e| anyhow!(\"pipe ACL invalid: {e}\")),\n    }\n}","preventionTips":["Recreate the pipe via the library so descriptors are always well-formed","Exclude the pipe path from third-party filter drivers / security agents that rewrite ACLs","Escalate persistent occurrences with the {reason} text — it indicates corrupted descriptor data","Keep Windows and the library updated to avoid descriptor-parsing edge cases"],"tags":["windows","acl","security","malformed-data","named-pipes"],"backgroundTag":"invalid-argument-format","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}