Why is this call to LocalFree() causing an error?

Question

I am invoking GetNamedSecurityInfo() as follows:

PSID pSID = NULL;
PSECURITY_DESCRIPTOR pSD = NULL;

// Retrieve the owner SID for the file
if(GetNamedSecurityInfo(TEXT("myfile.txt"),
                        SE_FILE_OBJECT,
                        OWNER_SECURITY_INFORMATION,
                        &pSID,
                        NULL, NULL, NULL,
                        &pSD) != ERROR_SUCCESS) {
    /* error handling */
}

FreeSid(pSID);
LocalFree(pSD);

However, when I run the application, it crashes. The debugger reports: Critical error detected c0000374 and points to the LocalFree() line at the end of the snippet above.

Why is this line causing a problem? According to the documentation for the ppSecurityDescriptor parameter:

"A pointer to a variable that receives a pointer to the security descriptor of the object. When you have finished using the pointer, free the returned buffer by calling the LocalFree function."

...which is exactly what I have done.

Answer 1

The SID referenced by your pSID local var is referring to data already held within the security descriptor referenced by pSD. It "owns" that SID, and you own the descriptor reference. You only need to free the latter.

Short version: Remove the FreeSid(pSID) call.