Make env_keep override badenv_table as documented

Fix traversal of badenv_table (broken in last commit)

diff --git a/env.c b/env.c
index b60f21b2663c3425deed1f678c80320c276b5d5e..fae584401fefda016d8a3f291904019d9810b6cf 100644 (file)
--- a/env.c
+++ b/env.c
@@ -234,9 +234,11 @@ rebuild_env(sudo_mode, envp)
 {
     char **newenvp, **ep, **nep, **ek, *cp;
     char *ekflat, *ps1, **env_keep;
+    int okvar;
     size_t env_size, eklen;
     struct env_table *entry;
 
+    okvar = 0;
     eklen = 0;
     ekflat = ps1 = NULL;
     env_keep = NULL;
@@ -315,17 +317,35 @@ rebuild_env(sudo_mode, envp)
            ;
        nep = newenvp = (char **) emalloc(env_size * sizeof(char *));
 
-       /* Copy envp entries as long as they don't match badenv_table. */
+       /*
+        * Copy envp entries as long as they don't match badenv_table
+        * (unless excepted by env_keep).
+        */
        for (ep = envp; *ep; ep++) {
-           for (entry = badenv_table; entry->name; entry++) {
-               if (strncmp(*ep, entry->name, entry->len) != 0 ||
-                   (entry->check && !strpbrk(*ep, "/%"))) {
-                   if (strncmp(*ep, "SUDO_PS1=", 9) == 0)
-                       ps1 = *ep + 5;
-                   *nep++ = *ep;
-                   break;
+           /* env_keep overrides badenv_table */
+           if (env_keep) {
+               for (ek = env_keep; *ek; ek++) {
+                   eklen = strlen(*ek);
+                   if (strncmp(*ek, *ep, eklen) == 0 && (*ep)[eklen] == '=') {
+                       okvar = 1;
+                       break;
+                   }
                }
            }
+           if (!okvar) {
+               for (okvar = 1, entry = badenv_table; entry->name; entry++) {
+                   if (strncmp(*ep, entry->name, entry->len) == 0 &&
+                       (!entry->check || strpbrk(*ep, "/%"))) {
+                       okvar = 0;
+                       break;
+                   }
+               }
+           }
+           if (okvar) {
+               if (strncmp(*ep, "SUDO_PS1=", 9) == 0)
+                   ps1 = *ep + 5;
+               *nep++ = *ep;
+           }
        }
     }
     *nep = NULL;