When parsing sudoOptions that include an operator (!, +, +=, -=)

strip out any whitespace on either side of the operator.

diff --git a/plugins/sudoers/ldap.c b/plugins/sudoers/ldap.c
index f46fc2d77c09ff6e2c69ea78848b9a9543693054..1f547f557e15a1c1b4cd88f0fb99f1ba93ef7ffa 100644 (file)
--- a/plugins/sudoers/ldap.c
+++ b/plugins/sudoers/ldap.c
@@ -1046,7 +1046,7 @@ static bool
 sudo_ldap_parse_options(LDAP *ld, LDAPMessage *entry)
 {
     struct berval **bv, **p;
-    char *var, *val;
+    char *cp, *var;
     int op;
     bool rc = false;
     debug_decl(sudo_ldap_parse_options, SUDOERS_DEBUG_LDAP)
@@ -1064,17 +1064,25 @@ sudo_ldap_parse_options(LDAP *ld, LDAPMessage *entry)
        DPRINTF2("ldap sudoOption: '%s'", var);
 
        /* check for equals sign past first char */
-       val = strchr(var, '=');
-       if (val > var) {
-           *val++ = '\0';      /* split on = and truncate var */
-           op = val[-2];       /* peek for += or -= cases */
+       cp = strchr(var, '=');
+       if (cp > var) {
+           char *val = cp + 1;
+           op = cp[-1];        /* peek for += or -= cases */
            if (op == '+' || op == '-') {
                /* case var+=val or var-=val */
-               val[-2] = '\0'; /* remove extra + or - char */
+               cp--;
            } else {
                /* case var=val */
                op = true;
            }
+           /* Trim whitespace between var and operator. */
+           while (cp > var && isblank((unsigned char)cp[-1]))
+               cp--;
+           /* Truncate variable name. */
+           *cp = '\0';
+           /* Trim leading whitespace from val. */
+           while (isblank((unsigned char)*val))
+               val++;
            /* Strip double quotes if present. */
            if (*val == '"') {
                char *ep = val + strlen(val);
@@ -1086,7 +1094,10 @@ sudo_ldap_parse_options(LDAP *ld, LDAPMessage *entry)
            set_default(var, val, op);
        } else if (*var == '!') {
            /* case !var Boolean False */
-           set_default(var + 1, NULL, false);
+           do {
+               var++;
+           } while (isblank((unsigned char)*var));
+           set_default(var, NULL, false);
        } else {
            /* case var Boolean True */
            set_default(var, NULL, true);

diff --git a/plugins/sudoers/sssd.c b/plugins/sudoers/sssd.c
index 5bdc4d5af951cd75f37171bfd772aedd8d334880..0fb19f9706cb5d2d05020f53253b81c9b475bba9 100644 (file)
--- a/plugins/sudoers/sssd.c
+++ b/plugins/sudoers/sssd.c
@@ -1024,7 +1024,7 @@ sudo_sss_parse_options(struct sudo_sss_handle *handle, struct sss_sudo_rule *rul
 {
     int i, op;
     bool ret = false;
-    char *v, *val;
+    char *cp, *v;
     char **val_array = NULL;
     debug_decl(sudo_sss_parse_options, SUDOERS_DEBUG_SSSD);
 
@@ -1052,17 +1052,25 @@ sudo_sss_parse_options(struct sudo_sss_handle *handle, struct sss_sudo_rule *rul
        }
 
        /* check for equals sign past first char */
-       val = strchr(v, '=');
-       if (val > v) {
-           *val++ = '\0';      /* split on = and truncate var */
-           op = val[-2];       /* peek for += or -= cases */
+       cp = strchr(v, '=');
+       if (cp > v) {
+           char *val = cp + 1;
+           op = cp[-1];        /* peek for += or -= cases */
            if (op == '+' || op == '-') {
                /* case var+=val or var-=val */
-               val[-2] = '\0'; /* remove extra + or - char */
+               cp--;
            } else {
                /* case var=val */
                op = true;
            }
+           /* Trim whitespace between var and operator. */
+           while (cp > v && isblank((unsigned char)cp[-1]))
+               cp--;
+           /* Truncate variable name. */
+           *cp = '\0';
+           /* Trim leading whitespace from val. */
+           while (isblank((unsigned char)*val))
+               val++;
            /* Strip double quotes if present. */
            if (*val == '"') {
                char *ep = val + strlen(val);
@@ -1074,7 +1082,10 @@ sudo_sss_parse_options(struct sudo_sss_handle *handle, struct sss_sudo_rule *rul
            set_default(v, val, op);
        } else if (*v == '!') {
            /* case !var Boolean False */
-           set_default(v + 1, NULL, false);
+           do {
+               v++;
+           } while (isblank((unsigned char)*v));
+           set_default(v, NULL, false);
        } else {
            /* case var Boolean True */
            set_default(v, NULL, true);