Properly close token in sspi authentication

We can never leak more than one token, but we shouldn't do that. We
don't bother closing it in the error paths since the process will
exit shortly anyway.

Christian Ullrich

diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
index 1e0277f39f04902497471b546f44f6944e96ecaa..18cffc912c0d8bf3ac9596f5e707e165887599eb 100644 (file)
--- a/src/backend/libpq/auth.c
+++ b/src/backend/libpq/auth.c
@@ -1253,6 +1253,8 @@ pg_SSPI_recvauth(Port *port)
                (errmsg_internal("could not get user token: error code %lu",
                                 GetLastError())));
 
+   CloseHandle(token);
+
    if (!LookupAccountSid(NULL, tokenuser->User.Sid, accountname, &accountnamesize,
                          domainname, &domainnamesize, &accountnameuse))
        ereport(ERROR,