From df0bd5a0f7e8893e1177f53b1ca126ffaf24160e Mon Sep 17 00:00:00 2001 From: Magnus Hagander Date: Thu, 14 Jan 2016 13:06:03 +0100 Subject: [PATCH] Properly close token in sspi authentication We can never leak more than one token, but we shouldn't do that. We don't bother closing it in the error paths since the process will exit shortly anyway. Christian Ullrich --- src/backend/libpq/auth.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index d05330d28d2..bc3bd5f3278 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -1464,6 +1464,8 @@ pg_SSPI_recvauth(Port *port) (errmsg_internal("could not get user token: error code %lu", GetLastError()))); + CloseHandle(token); + if (!LookupAccountSid(NULL, tokenuser->User.Sid, accountname, &accountnamesize, domainname, &domainnamesize, &accountnameuse)) ereport(ERROR,