puppetlabs/puppet-win32-ruby — pull request #26 by Iristyle (2014-03-17 22:56:58+00:00)
Title: (PE-3180) win32-security SID buffer size too small

- When calling Windows::Security::SID.new('foo'), the SID of user 'foo'
is looked up with the Win32 API call LookupAccountSid. Unfortunately
the win32-security gem hardcodes a fixed size buffer which is too
small for the returned SID under certain circumstances (for domain
SIDs for instance). Idiomatic Win32 API states that the first API
call should be used to determine a buffer size, a buffer should then
be allocated, and then a subsequent call should be made to the Win32
API with the appropriate buffer.
- Being 'more correct' would be a larger code change, so instead the
simplest approach here is to bump up the buffer size appropriately.
- Note that the version of win32-security we're presently using is
> 1 year old, and we do have plans to replace it with a safer 0.2.5+
version that uses FFI and follows safeer practices around calling
Win32 APIs. However, at this time, this requires some more
involved code changes that may be too large for a bugfix release.