Repository navigation
read_env_file: remove filtered entries from the g/c list before freeing - #585
Merged
Merged
Conversation
env_file_next_local() adds each line it returns to the sudoers garbage collection list. When read_env_file() drops a restricted_env_file entry that is not allowed by env_keep/env_check (or is matched by env_delete), it frees the string but leaves it on the g/c list, so sudoers_gc_run() frees it a second time when the plugin is closed. This only affects builds with NO_LEAKS defined (--disable-leaks, --enable-sanitizer and the fuzzers).
millert
approved these changes
Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
read_env_file() frees a restricted_env_file line that env_keep/env_check (or env_delete) filters out, but env_file_next_local() already put that string on the sudoers g/c list. With NO_LEAKS defined (--disable-leaks, --enable-sanitizer, the fuzzers), sudoers_gc_run() frees it again when the plugin is closed. To reproduce, point fuzz_policy's restricted_env_file at a file containing
FOO_NOT_KEPT=1; ASan then reports "attempting double-free" in sudoers_gc_run, with the first free in read_env_file.Remove the entry from the g/c list before freeing it, the same pairing editor.c uses. Production builds (no NO_LEAKS) are unaffected because sudoers_gc_run() is a no-op there. This is the only place in the tree that frees a g/c-tracked pointer without removing it first.