{"record":{"id":"b55b76667fd52c8c","repo":"java-native-access/jna","slug":"owner-psid-is-invalid","errorCode":null,"errorMessage":"Owner PSID is invalid","messagePattern":"Owner PSID is invalid","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java","lineNumber":2877,"sourceCode":"                                                      boolean setOwner,\n                                                      boolean setGroup,\n                                                      boolean setDACL,\n                                                      boolean setSACL,\n                                                      boolean setDACLProtectedStatus,\n                                                      boolean setSACLProtectedStatus) {\n\n        final PSID psidOwner = securityDescriptor.getOwner();\n        final PSID psidGroup = securityDescriptor.getGroup();\n        final ACL dacl = securityDescriptor.getDiscretionaryACL();\n        final ACL sacl = securityDescriptor.getSystemACL();\n\n        int infoType = 0;\n        // Parameter validation and infoType flag setting.\n        if (setOwner) {\n            if (psidOwner == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain owner\");\n            if (!Advapi32.INSTANCE.IsValidSid(psidOwner))\n                throw new IllegalArgumentException(\"Owner PSID is invalid\");\n            infoType |= OWNER_SECURITY_INFORMATION;\n        }\n\n        if (setGroup) {\n            if (psidGroup == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain group\");\n            if (!Advapi32.INSTANCE.IsValidSid(psidGroup))\n                throw new IllegalArgumentException(\"Group PSID is invalid\");\n            infoType |= GROUP_SECURITY_INFORMATION;\n        }\n\n        if (setDACL) {\n            if (dacl == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain DACL\");\n            if (!Advapi32.INSTANCE.IsValidAcl(dacl.getPointer()))\n                throw new IllegalArgumentException(\"DACL is invalid\");\n            infoType |= DACL_SECURITY_INFORMATION;\n        }","sourceCodeStart":2859,"sourceCodeEnd":2895,"githubUrl":"https://github.com/java-native-access/jna/blob/d036ad9781adad4b66693e8fa7098e4ac665e0a3/contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java#L2859-L2895","documentation":"In the same security-descriptor update path, after confirming an owner SID exists, Advapi32Util calls Advapi32.IsValidSid to verify the SID structure. If Windows reports the owner PSID is not a valid SID, the library throws IllegalArgumentException instead of letting the Win32 call fail later with an opaque error.","triggerScenarios":"Calling with setOwner=true where psidOwner is non-null but its bytes are malformed: wrong revision, bad sub-authority count, SID buffer smaller than declared, or a SID copied from memory at the wrong offset.","commonSituations":"Hand-assembling SIDs or copying them out of a raw byte buffer with an incorrect offset/length; parsing a descriptor with mismatched offsets; truncating a descriptor before parsing so the owner SID references memory past the buffer.","solutions":["Validate the SID yourself with Advapi32.INSTANCE.IsValidSid(psidOwner) before the call and repair/re-read it if false.","Re-parse the SECURITY_DESCRIPTOR_RELATIVE from the full, unmodified descriptor bytes so owner offsets land correctly.","Use Advapi32Util.convertSidBinaryToString / getTokenOwner-style helpers to round-trip the SID and confirm it is well formed.","Fetch a fresh owner SID from a reliable source (e.g. LookupAccountName) instead of reusing hand-built bytes."],"exampleFix":"// before\nAdvapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);\n// after\nif (Advapi32.INSTANCE.IsValidSid(sd.getOwner())) {\n    Advapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);\n}","handlingStrategy":"validation","validationCode":"if (securityDescriptor.getOwner() == null || !Advapi32.INSTANCE.IsValidSid(securityDescriptor.getOwner())) {\n    throw new IllegalStateException(\"Owner SID missing or invalid\");\n}","typeGuard":"boolean isValidOwner(SECURITY_DESCRIPTOR_RELATIVE sd) {\n    return sd.getOwner() != null && Advapi32.INSTANCE.IsValidSid(sd.getOwner());\n}","tryCatchPattern":"try {\n    Advapi32Util.setSecurityDescriptorComponents(sd, true, false, false, false, false, false);\n} catch (IllegalArgumentException e) {\n    log.error(\"Owner SID rejected: \" + e.getMessage());\n}","preventionTips":["Run Advapi32.INSTANCE.IsValidSid on every SID before use.","Re-parse descriptors from their full original buffers so SID offsets resolve correctly.","Prefer SIDs obtained from LookupAccountName over hand-assembled byte arrays."],"tags":["windows","security-descriptor","sid-validation","jna"],"backgroundTag":"invalid-argument-value","analyzedSha":"d036ad9781adad4b66693e8fa7098e4ac665e0a3","analyzedAt":"2026-09-12T06:50:59.239Z","contentChangedAt":"2026-09-12T06:50:59.239Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}