IsValidSecurityDescriptor() / QueryServiceObjectSecurity()

See more:

C++

Hello all,

I've a strange behaviour :

First, I call QueryServiceObjectSecurity() to retrieve a security descriptor on a service handle.
The call works well, no error, and I get data.
I can call GetSecurityDescriptorDacl() on the structure returned, it works. So, I assume that the security descriptor returned is a good one.

Here is an extract of code :

// Some variables used

SC_HANDLE hService;
PSECURITY_DESCRIPTOR SecDesc=NULL;
DWORD allocatedSize=0;
DWORD SecDescSizeNeeded=0;

// hService is initialized by a call to OpenService()

// First call to get the size needed
QueryServiceObjectSecurity(hService,DACL_SECURITY_INFORMATION,
&SecDesc,0,&SecDescSizeNeeded)

// Calls to HeapAlloc() for memory allocation with a size of
 // SecDescSizeNeeded
allocatedSize=SecDescSizeNeeded;

 if (!QueryServiceObjectSecurity(hService,DACL_SECURITY_INFORMATION,
&SecDesc,allocatedSize,&SecDescSizeNeeded))
        {
            < some error processing >
        }

if (IsValidSecurityDescriptor(SecDesc)){
    // Descriptor is VALID ;
} else {
    // Descriptor is NOT VALID;
 
}

But... If I call IsValidSecurityDescriptor() with the PSECURITY_DESCRIPTOR structure returned by my call to QueryServiceObjectSecurity(), it always returns with FALSE ?

I can't figure out why ?

Any clue about this problem ?

Thanks in advance !

---
Gonzague