Call clean_env very early in main() for paranoia's sake. Idea from

Marc Esipovich.

diff --git a/sudo.c b/sudo.c
index 0580720a24033d96671eea8efd81dbfe0158f108..903e742c2da672655b9f5a2dcf2a42c186be8bcc 100644 (file)
--- a/sudo.c
+++ b/sudo.c
@@ -193,6 +193,9 @@ main(argc, argv)
 # endif
 #endif /* HAVE_GETPRPWNAM && HAVE_SET_AUTH_PARAMETERS */
 
+    /* Get rid of any nasty bits in the environment. */
+    clean_env(environ, badenv_table);
+
     Argv = argv;
     Argc = argc;
 
@@ -272,8 +275,6 @@ main(argc, argv)
     if (user_cmnd == NULL && NewArgc == 0)
        usage(1);
 
-    clean_env(environ, badenv_table);
-
     cmnd_status = init_vars(sudo_mode);
 
     /* At this point, ruid == euid == 0 */