| Previous | Next |
| ERROR_GENERIC_NOT_MAPPED | ERROR_NOT_LOGON_PROCESS |
ERROR_BAD_DESCRIPTOR_FORMAT
A security API received a descriptor in the wrong representation or with inconsistent control data
Windows security descriptors have absolute and self-relative forms. In self-relative form, the SR control bit is set and component fields are offsets from the beginning of the descriptor; this is the representation used for portable storage and protocol data. Absolute descriptors use pointers. Passing one representation to code that interprets it as the other can make otherwise valid owner, DACL, or SACL data appear corrupt.
Inspect SECURITY_DESCRIPTOR.Control, especially SE_SELF_RELATIVE, and validate the descriptor before dereferencing any component. Use MakeAbsoluteSD and MakeSelfRelativeSD for conversion instead of flipping the control bit or copying the header. If the descriptor arrived from disk, RPC, registry, or another process, preserve its original byte buffer and length. A pointer-valid absolute descriptor cannot be serialized by copying its bytes because its component addresses are process-specific.
What to inspect
- Check SE_SELF_RELATIVE and validate the complete descriptor buffer.
- Use documented conversion APIs between absolute and self-relative forms.
- Audit serialization code for copied pointers or incorrect descriptor lengths.
References
- MS-DTYP: SECURITY_DESCRIPTOR
- Microsoft: securitybaseapi functions
- Microsoft: TOKEN_INFORMATION_CLASS
Looking for a different code? Search another status or error code.