GetSecurityByName() function SecurityDescriptor address is 0x00000

[Tomas Dalebjörk]

Hi,

I noticed that the call to GetSecurityByName() sometimes has the
SecurityDescriptor set to address 0x00000000

This causes our code to crash, as we are assuming that
SecurityDescriptor always has a target address to copy the value to

This is from the crash:

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ff76603061e (spfs!memcpy_repmovs+0x000000000000000e)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000000
Attempt to write to address 0000000000000000

I also printed the address-value of the SecurityDescriptor, and it
sometimes has values, and sometimes no values?

worker.3.log:2023-07-07.10:00:08 SP99999D
GetSecurityByName(\common.h:3):SecurityDescriptor=000001480A3AAC00
worker.3.log:2023-07-07.10:00:16 SP99999D
GetSecurityByName(\common.h:3):SecurityDescriptor=0000014811534C00
worker.3.log:2023-07-07.10:05:10 SP99999D
GetSecurityByName(\common.h:3):SecurityDescriptor=00000261D2156C00
worker.3.log:2023-07-07.10:05:18 SP99999D
GetSecurityByName(\common.h:3):SecurityDescriptor=00000261D2876C00
worker.3.log:2023-07-07.10:06:55 SP99999D
GetSecurityByName(\common.h:3):SecurirtyDescriptor=000002375A64DC00
worker.3.log:2023-07-07.10:08:17 SP99999D
GetSecurityByName(\common.h:3):SecurityDescriptor=000001F66A926C00
worker.4.log:2023-07-07.10:00:16 SP99999D
GetSecurityByName(\aes.h:4):SecurityDescriptor=0000000000000000

Here is how to reproduce the error:

1. copy a file to your mounted drive

C:\> copy sample.txt X:

2. copy a new file to your mounted drive

C:\> copy newsample.txt X:

3. rename sample.txt to newsample.txt

C:\> move X:\sample.txt X:\newsample.txt

The GetSecurityByName() call for the X:\newsample.txt will have the
SecurityDescriptor address set to 0x0000000

Please let me know if this is ment to be like this, and what the call
should return in such calls?


Regards Tomas

[Bill Zissimopoulos]

Apologies for the late response, but I am currently on vacation.

The GetSecurityByName() call can indeed by called with a NULL security descriptor buffer. This is by design and is used to determine if a file exists in some scenarios.

Bill