{"record":{"id":"d393ac246dd700ce","repo":"puppetlabs/puppet","slug":"failed-to-convert-binary-sid","errorCode":null,"errorMessage":"Failed to convert binary SID","messagePattern":"Failed to convert binary SID","errorType":"exception","errorClass":"Puppet::Util::Windows::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/sid.rb","lineNumber":169,"sourceCode":"      Principal.lookup_account_sid(sid_bytes).domain_account\n    rescue\n      nil\n    end\n    module_function :sid_to_name\n\n    # https://stackoverflow.com/a/1792930 - 68 bytes, 184 characters in a string\n    MAXIMUM_SID_STRING_LENGTH = 184\n\n    # Convert a SID pointer to a SID string, e.g. \"S-1-5-32-544\".\n    def sid_ptr_to_string(psid)\n      if !psid.is_a?(FFI::Pointer) || IsValidSid(psid) == FFI::WIN32_FALSE\n        raise Puppet::Util::Windows::Error, _(\"Invalid SID\")\n      end\n\n      sid_string = nil\n      FFI::MemoryPointer.new(:pointer, 1) do |buffer_ptr|\n        if ConvertSidToStringSidW(psid, buffer_ptr) == FFI::WIN32_FALSE\n          raise Puppet::Util::Windows::Error, _(\"Failed to convert binary SID\")\n        end\n\n        buffer_ptr.read_win32_local_pointer do |wide_string_ptr|\n          if wide_string_ptr.null?\n            raise Puppet::Error, _(\"ConvertSidToStringSidW failed to allocate buffer for sid\")\n          end\n\n          sid_string = wide_string_ptr.read_arbitrary_wide_string_up_to(MAXIMUM_SID_STRING_LENGTH)\n        end\n      end\n\n      sid_string\n    end\n    module_function :sid_ptr_to_string\n\n    # Convert a SID string, e.g. \"S-1-5-32-544\" to a pointer (containing the\n    # address of the binary SID structure). The returned value can be used in\n    # Win32 APIs that expect a PSID, e.g. IsValidSid. The account for this","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/sid.rb#L151-L187","documentation":"Raised by Puppet::Util::Windows::SID.sid_ptr_to_string when ConvertSidToStringSidW returns FALSE, i.e. Windows failed to render the (already IsValidSid-validated) binary SID into 'S-1-...' string form. Puppet::Util::Windows::Error attaches GetLastError. Because IsValidId passed just before, this branch indicates the conversion API itself failed rather than a bad SID.","triggerScenarios":"Heap exhaustion or process memory pressure making the API's internal LocalAlloc fail; passing a pointer to memory that was mutated between the IsValidSid check and the conversion call; running on a broken/Wine-like environment where advapi32 conversion misbehaves.","commonSituations":"Extremely rare in practice; occasionally seen in long-lived agents with memory fragmentation or when native memory is corrupted by another extension; test harnesses using mocked FFI modules that return WIN32_FALSE unexpectedly.","solutions":["Retry the conversion once — transient allocation failures can clear.","Check process memory usage / native heap health of the agent if it recurs.","Confirm nothing else writes into the SID buffer between validation and conversion.","Fall back to manual SDDL rendering from the SID bytes (Revision, IdentifierAuthority, SubAuthorities) if the API keeps failing.","Report the Win32 code from the exception message to narrow down the API-level cause."],"exampleFix":"// exampleFix not applicable - guard is retry-oriented, see tryCatchPattern\nnull","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"begin\n  sid_string = Puppet::Util::Windows::SID.sid_ptr_to_string(ptr)\nrescue Puppet::Util::Windows::Error => e\n  raise unless e.code == 8 || e.code == 14 # ERROR_NOT_ENOUGH_MEMORY / ERROR_OUTOFMEMORY\n  GC.start\n  retry if (attempts += 1) < 2\n  raise\nend","preventionTips":["Monitor agent memory pressure — allocation-dependent APIs fail first under exhaustion.","Do not mutate SID buffers between validation and conversion.","In tests, make FFI stubs faithful: success requires setting the out-pointer."],"tags":["windows","sid","win32","advapi32","puppet"],"backgroundTag":"sid-conversion-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}