Properly close token in sspi authentication

We can never leak more than one token, but we shouldn't do that. We
don't bother closing it in the error paths since the process will
exit shortly anyway.

Christian Ullrich

diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
index 49cfe3bdc4a0b61e1ec30faecfecb4892c568485..c91320f4968f4e81d9ee043393eb1197ac6f7222 100644 (file)
--- a/src/backend/libpq/auth.c
+++ b/src/backend/libpq/auth.c
@@ -1467,6 +1467,8 @@ pg_SSPI_recvauth(Port *port)
                (errmsg_internal("could not get user token: error code %lu",
                                 GetLastError())));
 
+   CloseHandle(token);
+
    if (!LookupAccountSid(NULL, tokenuser->User.Sid, accountname, &accountnamesize,
                          domainname, &domainnamesize, &accountnameuse))
        ereport(ERROR,