{"record":{"id":"d1719b7eca7c41d0","repo":"java-native-access/jna","slug":"group-psid-is-invalid","errorCode":null,"errorMessage":"Group PSID is invalid","messagePattern":"Group PSID is invalid","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java","lineNumber":2885,"sourceCode":"        final PSID psidGroup = securityDescriptor.getGroup();\n        final ACL dacl = securityDescriptor.getDiscretionaryACL();\n        final ACL sacl = securityDescriptor.getSystemACL();\n\n        int infoType = 0;\n        // Parameter validation and infoType flag setting.\n        if (setOwner) {\n            if (psidOwner == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain owner\");\n            if (!Advapi32.INSTANCE.IsValidSid(psidOwner))\n                throw new IllegalArgumentException(\"Owner PSID is invalid\");\n            infoType |= OWNER_SECURITY_INFORMATION;\n        }\n\n        if (setGroup) {\n            if (psidGroup == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain group\");\n            if (!Advapi32.INSTANCE.IsValidSid(psidGroup))\n                throw new IllegalArgumentException(\"Group PSID is invalid\");\n            infoType |= GROUP_SECURITY_INFORMATION;\n        }\n\n        if (setDACL) {\n            if (dacl == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain DACL\");\n            if (!Advapi32.INSTANCE.IsValidAcl(dacl.getPointer()))\n                throw new IllegalArgumentException(\"DACL is invalid\");\n            infoType |= DACL_SECURITY_INFORMATION;\n        }\n\n        if (setSACL) {\n            if (sacl == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain SACL\");\n            if (!Advapi32.INSTANCE.IsValidAcl(sacl.getPointer()))\n                throw new IllegalArgumentException(\"SACL is invalid\");\n            infoType |= SACL_SECURITY_INFORMATION;\n        }","sourceCodeStart":2867,"sourceCodeEnd":2903,"githubUrl":"https://github.com/java-native-access/jna/blob/d036ad9781adad4b66693e8fa7098e4ac665e0a3/contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java#L2867-L2903","documentation":"When setGroup is requested and the group SID is present but Advapi32.IsValidSid rejects it, the library throws IllegalArgumentException ('Group PSID is invalid'), guarding against passing a malformed SID to SetSecurityDescriptor components.","triggerScenarios":"setGroup=true with a non-null but structurally invalid psidGroup: bad revision/sub-authority count, truncated buffer, wrong offset into the descriptor bytes.","commonSituations":"Manual SID construction from raw bytes; offsets skewed after editing descriptor fields; copying group SIDs between descriptors of different sizes without adjusting offsets.","solutions":["Pre-validate with Advapi32.INSTANCE.IsValidSid(psidGroup) and rebuild the SID if invalid.","Re-parse the descriptor from its full original buffer so the group offset resolves to valid memory.","Replace the hand-built SID with one obtained from LookupAccountName or Advapi32Util helpers.","Skip the group component (setGroup=false) if the group is not essential."],"exampleFix":"// before\nAdvapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);\n// after\nif (sd.getGroup() != null && Advapi32.INSTANCE.IsValidSid(sd.getGroup())) {\n    Advapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);\n}","handlingStrategy":"validation","validationCode":"if (securityDescriptor.getGroup() == null || !Advapi32.INSTANCE.IsValidSid(securityDescriptor.getGroup())) {\n    throw new IllegalStateException(\"Group SID missing or invalid\");\n}","typeGuard":"boolean isValidGroup(SECURITY_DESCRIPTOR_RELATIVE sd) {\n    return sd.getGroup() != null && Advapi32.INSTANCE.IsValidSid(sd.getGroup());\n}","tryCatchPattern":"try {\n    Advapi32Util.setSecurityDescriptorComponents(sd, false, true, false, false, false, false);\n} catch (IllegalArgumentException e) {\n    log.error(\"Group SID rejected: \" + e.getMessage());\n}","preventionTips":["Validate every SID with Advapi32.INSTANCE.IsValidSid before passing it in.","Keep descriptor buffers intact; re-parse instead of patching offsets.","Test SID round-trips with Advapi32Util.convertSidBinaryToString."],"tags":["windows","security-descriptor","sid-validation","jna"],"backgroundTag":"invalid-argument-value","analyzedSha":"d036ad9781adad4b66693e8fa7098e4ac665e0a3","analyzedAt":"2026-09-12T06:50:59.239Z","contentChangedAt":"2026-09-12T06:50:59.239Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}