{"record":{"id":"fbb9ef441469bdc1","repo":"java-native-access/jna","slug":"dacl-is-invalid","errorCode":null,"errorMessage":"DACL is invalid","messagePattern":"DACL is invalid","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java","lineNumber":2893,"sourceCode":"                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain owner\");\n            if (!Advapi32.INSTANCE.IsValidSid(psidOwner))\n                throw new IllegalArgumentException(\"Owner PSID is invalid\");\n            infoType |= OWNER_SECURITY_INFORMATION;\n        }\n\n        if (setGroup) {\n            if (psidGroup == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain group\");\n            if (!Advapi32.INSTANCE.IsValidSid(psidGroup))\n                throw new IllegalArgumentException(\"Group PSID is invalid\");\n            infoType |= GROUP_SECURITY_INFORMATION;\n        }\n\n        if (setDACL) {\n            if (dacl == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain DACL\");\n            if (!Advapi32.INSTANCE.IsValidAcl(dacl.getPointer()))\n                throw new IllegalArgumentException(\"DACL is invalid\");\n            infoType |= DACL_SECURITY_INFORMATION;\n        }\n\n        if (setSACL) {\n            if (sacl == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain SACL\");\n            if (!Advapi32.INSTANCE.IsValidAcl(sacl.getPointer()))\n                throw new IllegalArgumentException(\"SACL is invalid\");\n            infoType |= SACL_SECURITY_INFORMATION;\n        }\n\n        /*\n         * Control bits SE_DACL_PROTECTED/SE_SACL_PROTECTED indicate the *ACL is protected. The *ACL_SECURITY_INFORMATION flags\n         * are meta flags for SetNamedSecurityInfo and are not stored in the SD.  If either *ACLProtectedStatus is set,\n         * get the current status from the securityDescriptor and apply as such, otherwise the ACL remains at its default.\n        */\n        if (setDACLProtectedStatus) {\n            if ((securityDescriptor.Control & SE_DACL_PROTECTED) != 0) {","sourceCodeStart":2875,"sourceCodeEnd":2911,"githubUrl":"https://github.com/java-native-access/jna/blob/d036ad9781adad4b66693e8fa7098e4ac665e0a3/contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java#L2875-L2911","documentation":"When setDACL is requested and a DACL is present, the library validates it with Advapi32.IsValidAcl. If the ACL structure fails Windows validation (bad AclRevision, size mismatch, corrupted ACEs), it throws IllegalArgumentException ('DACL is invalid').","triggerScenarios":"setDACL=true where the ACL bytes are corrupted or inconsistent: declared AclSize not matching buffer, malformed ACEs, ACL built by hand with wrong header fields.","commonSituations":"Manually constructed ACL structures with incorrect ACE sizes; copying ACL memory between descriptors without fixing offsets; truncated descriptor buffers causing partial ACL reads.","solutions":["Pre-check with Advapi32.INSTANCE.IsValidAcl(dacl.getPointer()) and rebuild the ACL if false.","Rebuild the DACL with Advapi32Util.createAccessControlList or similar helper rather than hand-writing bytes.","Re-extract the ACL from the source descriptor using the correct offsets (getSecurityDescriptorDacl).","Skip the DACL component (setDACL=false) if invalid, then set it separately from a freshly built ACL."],"exampleFix":"// before\nAdvapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);\n// after\nif (sd.getDiscretionaryACL() != null && Advapi32.INSTANCE.IsValidAcl(sd.getDiscretionaryACL().getPointer())) {\n    Advapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);\n}","handlingStrategy":"validation","validationCode":"ACL dacl = securityDescriptor.getDiscretionaryACL();\nif (dacl == null || !Advapi32.INSTANCE.IsValidAcl(dacl.getPointer())) {\n    throw new IllegalStateException(\"DACL missing or invalid\");\n}","typeGuard":"boolean isValidDACL(SECURITY_DESCRIPTOR_RELATIVE sd) {\n    ACL a = sd.getDiscretionaryACL();\n    return a != null && Advapi32.INSTANCE.IsValidAcl(a.getPointer());\n}","tryCatchPattern":"try {\n    Advapi32Util.setSecurityDescriptorComponents(sd, false, false, true, false, false, false);\n} catch (IllegalArgumentException e) {\n    log.error(\"DACL rejected: \" + e.getMessage());\n}","preventionTips":["Run Advapi32.INSTANCE.IsValidAcl on any ACL before applying it.","Build ACLs with library helpers instead of hand-writing ACE bytes.","Verify AclSize matches the actual buffer after manual construction."],"tags":["windows","security-descriptor","acl-validation","jna"],"backgroundTag":"invalid-argument-value","analyzedSha":"d036ad9781adad4b66693e8fa7098e4ac665e0a3","analyzedAt":"2026-09-12T06:50:59.239Z","contentChangedAt":"2026-09-12T06:50:59.239Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}