From: Joshua Rogers <MegaManSec@users.noreply.github.com>
Date: Sun, 2 Nov 2025 19:56:35 +0000 (+0000)
Subject: negotiate_sspi_auth: Respond with ERR when FormatMessage() fails (#2158)
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=58f6e257a69b3d33f32ae97f0f751f0ab33121c6;p=thirdparty%2Fsquid.git

negotiate_sspi_auth: Respond with ERR when FormatMessage() fails (#2158)
---

diff --git a/src/auth/negotiate/SSPI/negotiate_sspi_auth.cc b/src/auth/negotiate/SSPI/negotiate_sspi_auth.cc
index 137ffce347..8d5924d93b 100644
--- a/src/auth/negotiate/SSPI/negotiate_sspi_auth.cc
+++ b/src/auth/negotiate/SSPI/negotiate_sspi_auth.cc
@@ -233,14 +233,18 @@ manage_request()
         c = (char *) SSP_ValidateNegotiateCredentials(decoded, decodedLen, &Done, &status, cred);
 
         if (status == SSP_ERROR) {
-            FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM |
-                          FORMAT_MESSAGE_IGNORE_INSERTS,
-                          nullptr,
-                          GetLastError(),
-                          MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),    /* Default language */
-                          (LPTSTR) & ErrorMessage,
-                          0,
-                          nullptr);
+            const auto n = FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM |
+                                         FORMAT_MESSAGE_IGNORE_INSERTS,
+                                         nullptr,
+                                         GetLastError(),
+                                         MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),    /* Default language */
+                                         (LPTSTR) & ErrorMessage,
+                                         0,
+                                         nullptr);
+            if (!n) {
+                SEND2("NA * Windows error: %s", GetLastError());
+                return 1;
+            }
             if (ErrorMessage[strlen(ErrorMessage) - 1] == '\n')
                 ErrorMessage[strlen(ErrorMessage) - 1] = '\0';
             if (ErrorMessage[strlen(ErrorMessage) - 1] == '\r')