puppetlabs/puppet · error · Puppet::Error

ConvertSidToStringSidW failed to allocate buffer for sid

Error message

ConvertSidToStringSidW failed to allocate buffer for sid

What it means

Raised by Puppet::Util::Windows::SID.sid_ptr_to_string when ConvertSidToStringSidW reported success but the returned string buffer pointer read via read_win32_local_pointer is NULL. It is a plain Puppet::Error (no Win32 code available) flagging that no buffer was allocated for the SID string.

Source

Thrown at lib/puppet/util/windows/sid.rb:174

    # https://stackoverflow.com/a/1792930 - 68 bytes, 184 characters in a string
    MAXIMUM_SID_STRING_LENGTH = 184

    # Convert a SID pointer to a SID string, e.g. "S-1-5-32-544".
    def sid_ptr_to_string(psid)
      if !psid.is_a?(FFI::Pointer) || IsValidSid(psid) == FFI::WIN32_FALSE
        raise Puppet::Util::Windows::Error, _("Invalid SID")
      end

      sid_string = nil
      FFI::MemoryPointer.new(:pointer, 1) do |buffer_ptr|
        if ConvertSidToStringSidW(psid, buffer_ptr) == FFI::WIN32_FALSE
          raise Puppet::Util::Windows::Error, _("Failed to convert binary SID")
        end

        buffer_ptr.read_win32_local_pointer do |wide_string_ptr|
          if wide_string_ptr.null?
            raise Puppet::Error, _("ConvertSidToStringSidW failed to allocate buffer for sid")
          end

          sid_string = wide_string_ptr.read_arbitrary_wide_string_up_to(MAXIMUM_SID_STRING_LENGTH)
        end
      end

      sid_string
    end
    module_function :sid_ptr_to_string

    # Convert a SID string, e.g. "S-1-5-32-544" to a pointer (containing the
    # address of the binary SID structure). The returned value can be used in
    # Win32 APIs that expect a PSID, e.g. IsValidSid. The account for this
    # SID may or may not exist.
    def string_to_sid_ptr(string_sid, &block)
      FFI::MemoryPointer.from_string_to_wide_string(string_sid) do |lpcwstr|
        FFI::MemoryPointer.new(:pointer, 1) do |sid_ptr_ptr|
          if ConvertStringSidToSidW(lpcwstr, sid_ptr_ptr) == FFI::WIN32_FALSE

View on GitHub (pinned to e227c27540)

Solutions

1. If seen in tests, fix the FFI stub to populate the out-pointer (write a valid local pointer).
2. Restart the process — one-off null returns point to transient native state.
3. Investigate memory corruption if other native calls misbehave in the same process.
4. Render the SID manually from its sub-authorities as a workaround.

Example fix

// exampleFix not applicable - defensive internal check
null

begin
  s = Puppet::Util::Windows::SID.sid_ptr_to_string(ptr)
rescue Puppet::Error => e
  raise unless e.message.include?('failed to allocate buffer for sid')
  raise 'native allocator returned null; restart process or check for memory corruption'
end

When it happens

Trigger: Inconsistent API behavior where the conversion returns TRUE yet the out-pointer is null — practically limited to broken native environments, shimmed/mocked FFI in tests, or memory corruption overwriting the out-parameter.

Common situations: Unit tests with stubbed FFI functions returning success without setting the pointer; native memory corruption from a separate loaded extension; exotic terminal-services/RDP contexts where local allocation semantics misbehave. Nearly never seen on healthy systems.

Related errors

• Failed to call LookupAccountNameW with account: %{account_na
• Failed to call LookupAccountSidW with bytes: %{sid_bytes}
• Invalid SID
• RegisterEventSourceW failed to open Windows eventlog
• ReportEventW failed to report event to Windows eventlog

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/a9ff6b74ba7a94bd. Report an issue: GitHub.