Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit10a5252

Browse files
committed
Fix some memory leaks and improve restricted token handling on Windows
The leaks have been detected by a Coverity run on Windows. No backpatchis done as the leaks are minor.While on it, make restricted token creation more consistent in its errorhandling by logging an error instead of a warning if missingadvapi32.dll, which was missing in the NT4 days. Any modern platformshould have this DLL around. Now, if the library is not there, an erroris still reported back to the caller, and nothing is done do there is nobehavior change done in this commit.Author: Ranier VilelaDiscussion:https://postgr.es/m/CAEudQApa9MG0foPkgPX87fipk=vhnF2Xfg+CfUyR08h4R7Mywg@mail.gmail.com
1 parent3ec20c7 commit10a5252

File tree

3 files changed

+42
-12
lines changed

3 files changed

+42
-12
lines changed

‎src/backend/libpq/auth.c

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1387,6 +1387,13 @@ pg_SSPI_recvauth(Port *port)
13871387
mtype=pq_getbyte();
13881388
if (mtype!='p')
13891389
{
1390+
if (sspictx!=NULL)
1391+
{
1392+
DeleteSecurityContext(sspictx);
1393+
free(sspictx);
1394+
}
1395+
FreeCredentialsHandle(&sspicred);
1396+
13901397
/* Only log error if client didn't disconnect. */
13911398
if (mtype!=EOF)
13921399
ereport(ERROR,
@@ -1402,6 +1409,12 @@ pg_SSPI_recvauth(Port *port)
14021409
{
14031410
/* EOF - pq_getmessage already logged error */
14041411
pfree(buf.data);
1412+
if (sspictx!=NULL)
1413+
{
1414+
DeleteSecurityContext(sspictx);
1415+
free(sspictx);
1416+
}
1417+
FreeCredentialsHandle(&sspicred);
14051418
returnSTATUS_ERROR;
14061419
}
14071420

@@ -2517,6 +2530,7 @@ InitializeLDAPConnection(Port *port, LDAP **ldap)
25172530
(errmsg("could not load function _ldap_start_tls_sA in wldap32.dll"),
25182531
errdetail("LDAP over SSL is not supported on this platform.")));
25192532
ldap_unbind(*ldap);
2533+
FreeLibrary(ldaphandle);
25202534
returnSTATUS_ERROR;
25212535
}
25222536

‎src/backend/postmaster/postmaster.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4719,6 +4719,8 @@ internal_forkexec(int argc, char *argv[], Port *port)
47194719
if (cmdLine[sizeof(cmdLine)-2]!='\0')
47204720
{
47214721
elog(LOG,"subprocess command line too long");
4722+
UnmapViewOfFile(param);
4723+
CloseHandle(paramHandle);
47224724
return-1;
47234725
}
47244726

@@ -4735,6 +4737,8 @@ internal_forkexec(int argc, char *argv[], Port *port)
47354737
{
47364738
elog(LOG,"CreateProcess call failed: %m (error code %lu)",
47374739
GetLastError());
4740+
UnmapViewOfFile(param);
4741+
CloseHandle(paramHandle);
47384742
return-1;
47394743
}
47404744

@@ -4750,6 +4754,8 @@ internal_forkexec(int argc, char *argv[], Port *port)
47504754
GetLastError())));
47514755
CloseHandle(pi.hProcess);
47524756
CloseHandle(pi.hThread);
4757+
UnmapViewOfFile(param);
4758+
CloseHandle(paramHandle);
47534759
return-1;/* log made by save_backend_variables */
47544760
}
47554761

‎src/common/restricted_token.c

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,8 @@ typedef BOOL (WINAPI * __CreateRestrictedToken) (HANDLE, DWORD, DWORD, PSID_AND_
4040
*
4141
* Returns restricted token on success and 0 on failure.
4242
*
43-
* OnNT4, oranyothersystem not containing the required functions,will
44-
*NOT execute anything.
43+
* On any system not containing the required functions,do nothing
44+
*but still report an error.
4545
*/
4646
HANDLE
4747
CreateRestrictedProcess(char*cmd,PROCESS_INFORMATION*processInfo)
@@ -52,30 +52,36 @@ CreateRestrictedProcess(char *cmd, PROCESS_INFORMATION *processInfo)
5252
HANDLErestrictedToken;
5353
SID_IDENTIFIER_AUTHORITYNtAuthority= {SECURITY_NT_AUTHORITY};
5454
SID_AND_ATTRIBUTESdropSids[2];
55-
__CreateRestrictedToken_CreateRestrictedToken=NULL;
55+
__CreateRestrictedToken_CreateRestrictedToken;
5656
HANDLEAdvapi32Handle;
5757

5858
ZeroMemory(&si,sizeof(si));
5959
si.cb=sizeof(si);
6060

6161
Advapi32Handle=LoadLibrary("ADVAPI32.DLL");
62-
if (Advapi32Handle!=NULL)
62+
if (Advapi32Handle==NULL)
6363
{
64-
_CreateRestrictedToken= (__CreateRestrictedToken)GetProcAddress(Advapi32Handle,"CreateRestrictedToken");
64+
pg_log_error("could not load advapi32.dll: error code %lu",
65+
GetLastError());
66+
return0;
6567
}
6668

69+
_CreateRestrictedToken= (__CreateRestrictedToken)GetProcAddress(Advapi32Handle,"CreateRestrictedToken");
70+
6771
if (_CreateRestrictedToken==NULL)
6872
{
69-
pg_log_warning("cannot create restricted tokens on this platform");
70-
if (Advapi32Handle!=NULL)
71-
FreeLibrary(Advapi32Handle);
73+
pg_log_error("cannot create restricted tokens on this platform: error code %lu",
74+
GetLastError());
75+
FreeLibrary(Advapi32Handle);
7276
return0;
7377
}
7478

7579
/* Open the current token to use as a base for the restricted one */
7680
if (!OpenProcessToken(GetCurrentProcess(),TOKEN_ALL_ACCESS,&origToken))
7781
{
78-
pg_log_error("could not open process token: error code %lu",GetLastError());
82+
pg_log_error("could not open process token: error code %lu",
83+
GetLastError());
84+
FreeLibrary(Advapi32Handle);
7985
return0;
8086
}
8187

@@ -88,7 +94,10 @@ CreateRestrictedProcess(char *cmd, PROCESS_INFORMATION *processInfo)
8894
SECURITY_BUILTIN_DOMAIN_RID,DOMAIN_ALIAS_RID_POWER_USERS,0,0,0,0,0,
8995
0,&dropSids[1].Sid))
9096
{
91-
pg_log_error("could not allocate SIDs: error code %lu",GetLastError());
97+
pg_log_error("could not allocate SIDs: error code %lu",
98+
GetLastError());
99+
CloseHandle(origToken);
100+
FreeLibrary(Advapi32Handle);
92101
return0;
93102
}
94103

@@ -171,8 +180,8 @@ get_restricted_token(void)
171180
else
172181
{
173182
/*
174-
* Successfully re-execed. Now wait for child process to capture
175-
*exitcode.
183+
* Successfully re-executed. Now wait for child process to capture
184+
*the exit code.
176185
*/
177186
DWORDx;
178187

@@ -187,6 +196,7 @@ get_restricted_token(void)
187196
}
188197
exit(x);
189198
}
199+
pg_free(cmdline);
190200
}
191201
#endif
192202
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp