Properly close token in sspi authentication

We can never leak more than one token, but we shouldn't do that. We
don't bother closing it in the error paths since the process will
exit shortly anyway.

Christian Ullrich

diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
index 60d8d8848d302e6ff5c9f2cfdf6cf2439c5d343e..334b1a89547f099297616c0eb34199df1c5ddac1 100644 (file)
--- a/src/backend/libpq/auth.c
+++ b/src/backend/libpq/auth.c
@@ -1255,6 +1255,8 @@ pg_SSPI_recvauth(Port *port)
                (errmsg_internal("could not get user token: error code %lu",
                                 GetLastError())));
 
+   CloseHandle(token);
+
    if (!LookupAccountSid(NULL, tokenuser->User.Sid, accountname, &accountnamesize,
                          domainname, &domainnamesize, &accountnameuse))
        ereport(ERROR,