Question about GetTokenInformation and memory leaks

[Dan Kegel]

I've never used the security apis, so I'm pretty unfamiliar with them.
Valgrinding chromium's sandbox_unittests.exe shows the leak

16 bytes in 1 blocks are definitely lost in loss record 123 of 728
   at RtlAllocateHeap (heap.c:1423)
   by RtlAllocateAndInitializeSid (sec.c:156)
   by NtQueryInformationToken (nt.c:379)
   by GetTokenInformation (security.c:676)
   by ATL::CAccessToken::GetInfoConvert<ATL::CSid,_TOKEN_PRIMARY_GROUP>
(atlsecurity.h:754)
   by ATL::CAccessToken::GetPrimaryGroup (atlsecurity.inl:3623)
   by sandbox::RestrictedTokenTest_CustomInit_Test::TestBody
(restricted_token_unittest.cc:92)

The test in question is on line 92 of
http://src.chromium.org/viewvc/chrome/trunk/src/sandbox/src/restricted_token_unittest.cc?revision=11651

Can someone familiar with this stuff have a look?
I suspect it's a problem with the test, but
can't figure out what's going on.   I would
have thought the destructors for ATL::CAccessToken
and ATL::CSid would have freed everything.
(I think the code leaks token_handle, but fixing
that doesn't get rid of the reported leak.)
- Dan