diff --git a/lib/eventlog/eventlog.c b/lib/eventlog/eventlog.c
index 2da61f91f..ae16e2e6e 100644
--- a/lib/eventlog/eventlog.c
+++ b/lib/eventlog/eventlog.c
@@ -348,7 +348,7 @@ exec_mailer(int pipein)
 
     /* Set stdin to read side of the pipe. */
     if (dup3(pipein, STDIN_FILENO, 0) == -1) {
-	syslog(LOG_ERR, _("unable to dup stdin: %m"));
+	syslog(LOG_ERR, _("unable to dup stdin: %m")); // -V618
 	sudo_debug_printf(SUDO_DEBUG_ERROR,
 	    "unable to dup stdin: %s", strerror(errno));
 	sudo_debug_exit(__func__, __FILE__, __LINE__, sudo_debug_subsys);
@@ -357,7 +357,7 @@ exec_mailer(int pipein)
 
     /* Build up an argv based on the mailer path and flags */
     if ((mflags = strdup(evl_conf.mailerflags)) == NULL) {
-	syslog(LOG_ERR, _("unable to allocate memory"));
+	syslog(LOG_ERR, _("unable to allocate memory")); // -V618
 	sudo_debug_exit(__func__, __FILE__, __LINE__, sudo_debug_subsys);
 	_exit(127);
     }
@@ -393,7 +393,7 @@ exec_mailer(int pipein)
 	execve(mpath, argv, root_envp);
     else
 	execv(mpath, argv);
-    syslog(LOG_ERR, _("unable to execute %s: %m"), mpath);
+    syslog(LOG_ERR, _("unable to execute %s: %m"), mpath); // -V618
     sudo_debug_printf(SUDO_DEBUG_ERROR, "unable to execute %s: %s",
 	mpath, strerror(errno));
     _exit(127);
@@ -441,7 +441,7 @@ send_mail(const struct eventlog *evlog, const char *fmt, ...)
 	    switch (fork()) {
 		case -1:
 		    /* Error. */
-		    syslog(LOG_ERR, _("unable to fork: %m"));
+		    syslog(LOG_ERR, _("unable to fork: %m")); // -V618
 		    sudo_debug_printf(SUDO_DEBUG_ERROR, "unable to fork: %s",
 			strerror(errno));
 		    sudo_debug_exit(__func__, __FILE__, __LINE__, sudo_debug_subsys);
@@ -485,7 +485,7 @@ send_mail(const struct eventlog *evlog, const char *fmt, ...)
     closefrom_nodebug(STDERR_FILENO + 1);
 
     if (pipe2(pfd, O_CLOEXEC) == -1) {
-	syslog(LOG_ERR, _("unable to open pipe: %m"));
+	syslog(LOG_ERR, _("unable to open pipe: %m")); // -V618
 	sudo_debug_printf(SUDO_DEBUG_ERROR, "unable to open pipe: %s",
 	    strerror(errno));
 	sudo_debug_exit(__func__, __FILE__, __LINE__, sudo_debug_subsys);
@@ -495,7 +495,7 @@ send_mail(const struct eventlog *evlog, const char *fmt, ...)
     switch (pid = sudo_debug_fork()) {
 	case -1:
 	    /* Error. */
-	    syslog(LOG_ERR, _("unable to fork: %m"));
+	    syslog(LOG_ERR, _("unable to fork: %m")); // -V618
 	    sudo_debug_printf(
 		SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO|SUDO_DEBUG_ERRNO,
 		"unable to fork");
diff --git a/lib/util/arc4random.c b/lib/util/arc4random.c
index 77e3ec205..8e19555a8 100644
--- a/lib/util/arc4random.c
+++ b/lib/util/arc4random.c
@@ -142,7 +142,7 @@ _rs_rekey(unsigned char *dat, size_t datlen)
 	}
 	/* immediately reinit for backtracking resistance */
 	_rs_init(rs_buf, KEYSZ + IVSZ);
-	memset(rs_buf, 0, KEYSZ + IVSZ);
+	memset(rs_buf, 0, KEYSZ + IVSZ); // -V512
 	rs_have = sizeof(rs_buf) - KEYSZ - IVSZ;
 }
 
diff --git a/lib/util/sudo_debug.c b/lib/util/sudo_debug.c
index b98e05c56..50c18450f 100644
--- a/lib/util/sudo_debug.c
+++ b/lib/util/sudo_debug.c
@@ -239,6 +239,7 @@ sudo_debug_new_output(struct sudo_debug_instance *instance,
 
     return output;
 oom:
+    // -V:sudo_warn_nodebug:575, 618
     sudo_warn_nodebug(NULL);
 bad:
     if (output != NULL)
diff --git a/plugins/audit_json/audit_json.c b/plugins/audit_json/audit_json.c
index 64adcb738..acc4360c6 100644
--- a/plugins/audit_json/audit_json.c
+++ b/plugins/audit_json/audit_json.c
@@ -456,7 +456,7 @@ audit_write_exit_record(int exit_status, int error)
 		    goto oom;
             } else {
 		json_value.type = JSON_STRING;
-		json_value.u.string = signame;
+		json_value.u.string = signame; // -V507
 		if (!sudo_json_add_value(&json, "signal", &json_value))
 		    goto oom;
 	    }
diff --git a/plugins/python/python_convmessage.c b/plugins/python/python_convmessage.c
index 91cd3dfac..67e6d96bc 100644
--- a/plugins/python/python_convmessage.c
+++ b/plugins/python/python_convmessage.c
@@ -50,11 +50,11 @@ _sudo_ConvMessage__Init(PyObject *py_self, PyObject *py_args, PyObject *py_kwarg
         goto cleanup;
 
     py_object_set_attr_number(py_self, "timeout", conv_message.timeout);
-    if (PyErr_Occurred())
+    if (PyErr_Occurred()) // -V547
         goto cleanup;
 
     py_object_set_attr_string(py_self, "msg", conv_message.msg);
-    if (PyErr_Occurred())
+    if (PyErr_Occurred()) // -V547
         goto cleanup;
 
 cleanup:
@@ -113,11 +113,11 @@ sudo_module_ConvMessage_to_c(PyObject *py_conv_message, struct sudo_conv_message
         debug_return_int(SUDO_RC_ERROR);
 
     conv_message->timeout = (int)py_object_get_optional_attr_number(py_conv_message, "timeout");
-    if (PyErr_Occurred())
+    if (PyErr_Occurred()) // -V547
         debug_return_int(SUDO_RC_ERROR);
 
     conv_message->msg = py_object_get_optional_attr_string(py_conv_message, "msg");
-    if (PyErr_Occurred())
+    if (PyErr_Occurred()) // -V547
         debug_return_int(SUDO_RC_ERROR);
 
     debug_return_int(SUDO_RC_OK);
diff --git a/plugins/sudoers/auth/pam.c b/plugins/sudoers/auth/pam.c
index 53890c2d5..eb75dcd3f 100644
--- a/plugins/sudoers/auth/pam.c
+++ b/plugins/sudoers/auth/pam.c
@@ -252,7 +252,7 @@ sudo_pam_init2(struct passwd *pw, sudo_auth *auth, bool quiet)
     if (ttypath == NULL)
 	ttypath = "";
 #endif
-    if (ttypath != NULL) {
+    if (ttypath != NULL) { // -V547
 	rc = pam_set_item(pamh, PAM_TTY, ttypath);
 	if (rc != PAM_SUCCESS) {
 	    errstr = sudo_pam_strerror(pamh, rc);
diff --git a/plugins/sudoers/getdate.c b/plugins/sudoers/getdate.c
index 8cd2cbcde..b7d08d62d 100644
--- a/plugins/sudoers/getdate.c
+++ b/plugins/sudoers/getdate.c
@@ -29,6 +29,9 @@
 /* SUPPRESS 287 on yaccpar_sccsid *//* Unused static variable */
 /* SUPPRESS 288 on yyerrlab *//* Label unused */
 
+/* PVS Studio suppression*/
+/* -V::1037, 1042*/
+
 #include <config.h>
 
 #include <stdio.h>
@@ -106,7 +109,7 @@ static int	yyerror(const char *s);
 static int	yylex(void);
        int	yyparse(void);
 
-#line 94 "getdate.y"
+#line 97 "getdate.y"
 #ifndef YYSTYPE_DEFINED
 #define YYSTYPE_DEFINED
 typedef union {
@@ -114,7 +117,7 @@ typedef union {
     enum _MERIDIAN	Meridian;
 } YYSTYPE;
 #endif /* YYSTYPE_DEFINED */
-#line 112 "getdate.c"
+#line 115 "getdate.c"
 #define tAGO 257
 #define tDAY 258
 #define tDAYZONE 259
@@ -129,11 +132,7 @@ typedef union {
 #define tZONE 268
 #define tDST 269
 #define YYERRCODE 256
-#if defined(__cplusplus) || defined(__STDC__)
 const short yylhs[] =
-#else
-short yylhs[] =
-#endif
 	{                                        -1,
     0,    0,    2,    2,    2,    2,    2,    2,    3,    3,
     3,    3,    3,    4,    4,    4,    6,    6,    6,    5,
@@ -141,11 +140,7 @@ short yylhs[] =
     9,    9,    9,    9,    9,    9,    9,    9,    8,    1,
     1,
 };
-#if defined(__cplusplus) || defined(__STDC__)
 const short yylen[] =
-#else
-short yylen[] =
-#endif
 	{                                         2,
     0,    2,    1,    1,    1,    1,    1,    1,    2,    4,
     4,    6,    6,    1,    1,    2,    1,    2,    2,    3,
@@ -153,11 +148,7 @@ short yylen[] =
     2,    1,    2,    2,    1,    2,    2,    1,    1,    0,
     1,
 };
-#if defined(__cplusplus) || defined(__STDC__)
 const short yydefred[] =
-#else
-short yydefred[] =
-#endif
 	{                                      1,
     0,    0,   15,   32,    0,   38,   35,    0,    0,    0,
     2,    3,    4,    5,    6,    7,    8,    0,   18,    0,
@@ -165,50 +156,30 @@ short yydefred[] =
     0,    0,   16,   28,    0,   23,   27,   22,    0,    0,
    25,   41,   11,    0,   10,    0,    0,   21,   13,   12,
 };
-#if defined(__cplusplus) || defined(__STDC__)
 const short yydgoto[] =
-#else
-short yydgoto[] =
-#endif
 	{                                       1,
    45,   11,   12,   13,   14,   15,   16,   17,   18,
 };
-#if defined(__cplusplus) || defined(__STDC__)
 const short yysindex[] =
-#else
-short yysindex[] =
-#endif
 	{                                      0,
  -249,  -38,    0,    0, -260,    0,    0, -240,  -47, -248,
     0,    0,    0,    0,    0,    0,    0, -237,    0,  -18,
     0,    0,    0,    0,    0,    0, -262,    0,    0, -239,
  -238, -236,    0,    0, -235,    0,    0,    0,  -56,  -19,
     0,    0,    0, -234,    0, -232, -258,    0,    0,    0,};
-#if defined(__cplusplus) || defined(__STDC__)
 const short yyrindex[] =
-#else
-short yyrindex[] =
-#endif
 	{                                      0,
     0,    1,    0,    0,    0,    0,    0,    0,   69,   12,
     0,    0,    0,    0,    0,    0,    0,   23,    0,   34,
     0,    0,    0,    0,    0,    0,   67,    0,    0,    0,
     0,    0,    0,    0,    0,    0,    0,    0,   56,   45,
     0,    0,    0,    0,    0,    0,   56,    0,    0,    0,};
-#if defined(__cplusplus) || defined(__STDC__)
 const short yygindex[] =
-#else
-short yygindex[] =
-#endif
 	{                                      0,
   -17,    0,    0,    0,    0,    0,    0,    0,    0,
 };
 #define YYTABLESIZE 337
-#if defined(__cplusplus) || defined(__STDC__)
 const short yytable[] =
-#else
-short yytable[] =
-#endif
 	{                                      32,
    17,   44,   42,   36,   37,   19,   20,   49,    2,    3,
    31,   14,    4,    5,    6,    7,    8,    9,   10,   34,
@@ -245,11 +216,7 @@ short yytable[] =
    40,    0,   40,   40,   26,   26,    0,   39,   26,   26,
    26,   26,    0,    0,   26,   39,   39,
 };
-#if defined(__cplusplus) || defined(__STDC__)
 const short yycheck[] =
-#else
-short yycheck[] =
-#endif
 	{                                      47,
     0,   58,  261,  266,  267,   44,  267,  266,  258,  259,
    58,    0,  262,  263,  264,  265,  266,  267,  268,  257,
@@ -292,11 +259,7 @@ short yycheck[] =
 #endif
 #define YYMAXTOKEN 269
 #if YYDEBUG
-#if defined(__cplusplus) || defined(__STDC__)
 const char * const yyname[] =
-#else
-char *yyname[] =
-#endif
 	{
 "end-of-file",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
 0,0,0,0,0,0,0,0,0,0,"','",0,0,"'/'",0,0,0,0,0,0,0,0,0,0,"':'",0,0,0,0,0,0,0,0,0,
@@ -308,11 +271,7 @@ char *yyname[] =
 "tDAYZONE","tID","tMERIDIAN","tMINUTE_UNIT","tMONTH","tMONTH_UNIT","tSEC_UNIT",
 "tSNUMBER","tUNUMBER","tZONE","tDST",
 };
-#if defined(__cplusplus) || defined(__STDC__)
 const char * const yyrule[] =
-#else
-char *yyrule[] =
-#endif
 	{"$accept : spec",
 "spec :",
 "spec : spec item",
@@ -383,7 +342,7 @@ short *yysslim;
 YYSTYPE *yyvs;
 unsigned int yystacksize;
 int yyparse(void);
-#line 313 "getdate.y"
+#line 316 "getdate.y"
 
 /* Month and day table. */
 static TABLE const MonthDayTable[] = {
@@ -1005,13 +964,9 @@ main(int argc, char *argv[])
     /* NOTREACHED */
 }
 #endif	/* TEST */
-#line 951 "getdate.c"
+#line 954 "getdate.c"
 /* allocate initial stack or double stack size, up to YYMAXDEPTH */
-#if defined(__cplusplus) || defined(__STDC__)
 static int yygrowstack(void)
-#else
-static int yygrowstack()
-#endif
 {
     unsigned int newsize;
     long sslen;
@@ -1027,23 +982,19 @@ static int yygrowstack()
 #ifdef SIZE_MAX
 #define YY_SIZE_MAX SIZE_MAX
 #else
-#ifdef __STDC__
 #define YY_SIZE_MAX 0xffffffffU
-#else
-#define YY_SIZE_MAX (unsigned int)0xffffffff
-#endif
 #endif
     if (YY_SIZE_MAX / newsize < sizeof *newss)
         goto bail;
     sslen = yyssp - yyss;
-    newss = yyss ? (short *)realloc(yyss, newsize * sizeof *newss) :
-      (short *)malloc(newsize * sizeof *newss); /* overflow check above */
+    newss = yyss ? realloc(yyss, newsize * sizeof *newss) :
+      malloc(newsize * sizeof *newss); /* overflow check above */
     if (newss == NULL)
         goto bail;
     yyss = newss;
     yyssp = newss + sslen;
-    newvs = yyvs ? (YYSTYPE *)realloc(yyvs, newsize * sizeof *newvs) :
-      (YYSTYPE *)malloc(newsize * sizeof *newvs); /* overflow check above */
+    newvs = yyvs ? realloc(yyvs, newsize * sizeof *newvs) :
+      malloc(newsize * sizeof *newvs); /* overflow check above */
     if (newvs == NULL)
         goto bail;
     yyvs = newvs;
@@ -1052,10 +1003,8 @@ static int yygrowstack()
     yysslim = yyss + newsize - 1;
     return 0;
 bail:
-    if (yyss)
-            free(yyss);
-    if (yyvs)
-            free(yyvs);
+    free(yyss);
+    free(yyvs);
     yyss = yyssp = NULL;
     yyvs = yyvsp = NULL;
     yystacksize = 0;
@@ -1067,19 +1016,11 @@ bail:
 #define YYACCEPT goto yyaccept
 #define YYERROR goto yyerrlab
 int
-#if defined(__cplusplus) || defined(__STDC__)
 yyparse(void)
-#else
-yyparse()
-#endif
 {
     int yym, yyn, yystate;
 #if YYDEBUG
-#if defined(__cplusplus) || defined(__STDC__)
     const char *yys;
-#else /* !(defined(__cplusplus) || defined(__STDC__)) */
-    char *yys;
-#endif /* !(defined(__cplusplus) || defined(__STDC__)) */
 
     if ((yys = getenv("YYDEBUG")))
     {
@@ -1214,37 +1155,37 @@ yyreduce:
     switch (yyn)
     {
 case 3:
-#line 112 "getdate.y"
+#line 115 "getdate.y"
 {
 	    yyHaveTime++;
 	}
 break;
 case 4:
-#line 115 "getdate.y"
+#line 118 "getdate.y"
 {
 	    yyHaveZone++;
 	}
 break;
 case 5:
-#line 118 "getdate.y"
+#line 121 "getdate.y"
 {
 	    yyHaveDate++;
 	}
 break;
 case 6:
-#line 121 "getdate.y"
+#line 124 "getdate.y"
 {
 	    yyHaveDay++;
 	}
 break;
 case 7:
-#line 124 "getdate.y"
+#line 127 "getdate.y"
 {
 	    yyHaveRel++;
 	}
 break;
 case 9:
-#line 130 "getdate.y"
+#line 133 "getdate.y"
 {
 	    yyHour = yyvsp[-1].Number;
 	    yyMinutes = 0;
@@ -1253,7 +1194,7 @@ case 9:
 	}
 break;
 case 10:
-#line 136 "getdate.y"
+#line 139 "getdate.y"
 {
 	    yyHour = yyvsp[-3].Number;
 	    yyMinutes = yyvsp[-1].Number;
@@ -1262,7 +1203,7 @@ case 10:
 	}
 break;
 case 11:
-#line 142 "getdate.y"
+#line 145 "getdate.y"
 {
 	    yyHour = yyvsp[-3].Number;
 	    yyMinutes = yyvsp[-1].Number;
@@ -1272,7 +1213,7 @@ case 11:
 	}
 break;
 case 12:
-#line 149 "getdate.y"
+#line 152 "getdate.y"
 {
 	    yyHour = yyvsp[-5].Number;
 	    yyMinutes = yyvsp[-3].Number;
@@ -1281,7 +1222,7 @@ case 12:
 	}
 break;
 case 13:
-#line 155 "getdate.y"
+#line 158 "getdate.y"
 {
 	    yyHour = yyvsp[-5].Number;
 	    yyMinutes = yyvsp[-3].Number;
@@ -1292,56 +1233,56 @@ case 13:
 	}
 break;
 case 14:
-#line 165 "getdate.y"
+#line 168 "getdate.y"
 {
 	    yyTimezone = yyvsp[0].Number;
 	    yyDSTmode = DSToff;
 	}
 break;
 case 15:
-#line 169 "getdate.y"
+#line 172 "getdate.y"
 {
 	    yyTimezone = yyvsp[0].Number;
 	    yyDSTmode = DSTon;
 	}
 break;
 case 16:
-#line 174 "getdate.y"
+#line 177 "getdate.y"
 {
 	    yyTimezone = yyvsp[-1].Number;
 	    yyDSTmode = DSTon;
 	}
 break;
 case 17:
-#line 180 "getdate.y"
+#line 183 "getdate.y"
 {
 	    yyDayOrdinal = 1;
 	    yyDayNumber = yyvsp[0].Number;
 	}
 break;
 case 18:
-#line 184 "getdate.y"
+#line 187 "getdate.y"
 {
 	    yyDayOrdinal = 1;
 	    yyDayNumber = yyvsp[-1].Number;
 	}
 break;
 case 19:
-#line 188 "getdate.y"
+#line 191 "getdate.y"
 {
 	    yyDayOrdinal = yyvsp[-1].Number;
 	    yyDayNumber = yyvsp[0].Number;
 	}
 break;
 case 20:
-#line 194 "getdate.y"
+#line 197 "getdate.y"
 {
 	    yyMonth = yyvsp[-2].Number;
 	    yyDay = yyvsp[0].Number;
 	}
 break;
 case 21:
-#line 198 "getdate.y"
+#line 201 "getdate.y"
 {
 	    if (yyvsp[-4].Number >= 100) {
 		yyYear = yyvsp[-4].Number;
@@ -1355,7 +1296,7 @@ case 21:
 	}
 break;
 case 22:
-#line 209 "getdate.y"
+#line 212 "getdate.y"
 {
 	    /* ISO 8601 format.  yyyy-mm-dd.  */
 	    yyYear = yyvsp[-2].Number;
@@ -1364,7 +1305,7 @@ case 22:
 	}
 break;
 case 23:
-#line 215 "getdate.y"
+#line 218 "getdate.y"
 {
 	    /* e.g. 17-JUN-1992.  */
 	    yyDay = yyvsp[-2].Number;
@@ -1373,14 +1314,14 @@ case 23:
 	}
 break;
 case 24:
-#line 221 "getdate.y"
+#line 224 "getdate.y"
 {
 	    yyMonth = yyvsp[-1].Number;
 	    yyDay = yyvsp[0].Number;
 	}
 break;
 case 25:
-#line 225 "getdate.y"
+#line 228 "getdate.y"
 {
 	    yyMonth = yyvsp[-3].Number;
 	    yyDay = yyvsp[-2].Number;
@@ -1388,14 +1329,14 @@ case 25:
 	}
 break;
 case 26:
-#line 230 "getdate.y"
+#line 233 "getdate.y"
 {
 	    yyMonth = yyvsp[0].Number;
 	    yyDay = yyvsp[-1].Number;
 	}
 break;
 case 27:
-#line 234 "getdate.y"
+#line 237 "getdate.y"
 {
 	    yyMonth = yyvsp[-1].Number;
 	    yyDay = yyvsp[-2].Number;
@@ -1403,68 +1344,68 @@ case 27:
 	}
 break;
 case 28:
-#line 241 "getdate.y"
+#line 244 "getdate.y"
 {
 	    yyRelSeconds = -yyRelSeconds;
 	    yyRelMonth = -yyRelMonth;
 	}
 break;
 case 30:
-#line 248 "getdate.y"
-{
-	    yyRelSeconds += yyvsp[-1].Number * yyvsp[0].Number * 60L;
-	}
-break;
-case 31:
 #line 251 "getdate.y"
 {
 	    yyRelSeconds += yyvsp[-1].Number * yyvsp[0].Number * 60L;
 	}
 break;
-case 32:
+case 31:
 #line 254 "getdate.y"
+{
+	    yyRelSeconds += yyvsp[-1].Number * yyvsp[0].Number * 60L;
+	}
+break;
+case 32:
+#line 257 "getdate.y"
 {
 	    yyRelSeconds += yyvsp[0].Number * 60L;
 	}
 break;
 case 33:
-#line 257 "getdate.y"
-{
-	    yyRelSeconds += yyvsp[-1].Number;
-	}
-break;
-case 34:
 #line 260 "getdate.y"
 {
 	    yyRelSeconds += yyvsp[-1].Number;
 	}
 break;
-case 35:
+case 34:
 #line 263 "getdate.y"
+{
+	    yyRelSeconds += yyvsp[-1].Number;
+	}
+break;
+case 35:
+#line 266 "getdate.y"
 {
 	    yyRelSeconds++;
 	}
 break;
 case 36:
-#line 266 "getdate.y"
-{
-	    yyRelMonth += yyvsp[-1].Number * yyvsp[0].Number;
-	}
-break;
-case 37:
 #line 269 "getdate.y"
 {
 	    yyRelMonth += yyvsp[-1].Number * yyvsp[0].Number;
 	}
 break;
-case 38:
+case 37:
 #line 272 "getdate.y"
+{
+	    yyRelMonth += yyvsp[-1].Number * yyvsp[0].Number;
+	}
+break;
+case 38:
+#line 275 "getdate.y"
 {
 	    yyRelMonth += yyvsp[0].Number;
 	}
 break;
 case 39:
-#line 277 "getdate.y"
+#line 280 "getdate.y"
 {
 	    if (yyHaveTime && yyHaveDate && !yyHaveRel)
 		yyYear = yyvsp[0].Number;
@@ -1492,18 +1433,18 @@ case 39:
 	}
 break;
 case 40:
-#line 304 "getdate.y"
+#line 307 "getdate.y"
 {
 	    yyval.Meridian = MER24;
 	}
 break;
 case 41:
-#line 307 "getdate.y"
+#line 310 "getdate.y"
 {
 	    yyval.Meridian = yyvsp[0].Meridian;
 	}
 break;
-#line 1449 "getdate.c"
+#line 1434 "getdate.c"
     }
     yyssp -= yym;
     yystate = *yyssp;
@@ -1556,19 +1497,15 @@ to state %d\n", YYPREFIX, *yyssp, yystate);
 yyoverflow:
     yyerror("yacc stack overflow");
 yyabort:
-    if (yyss)
-            free(yyss);
-    if (yyvs)
-            free(yyvs);
+    free(yyss);
+    free(yyvs);
     yyss = yyssp = NULL;
     yyvs = yyvsp = NULL;
     yystacksize = 0;
     return (1);
 yyaccept:
-    if (yyss)
-            free(yyss);
-    if (yyvs)
-            free(yyvs);
+    free(yyss);
+    free(yyvs);
     yyss = yyssp = NULL;
     yyvs = yyvsp = NULL;
     yystacksize = 0;
diff --git a/plugins/sudoers/getdate.y b/plugins/sudoers/getdate.y
index 531705fe2..6e424a711 100644
--- a/plugins/sudoers/getdate.y
+++ b/plugins/sudoers/getdate.y
@@ -12,6 +12,9 @@
 /* SUPPRESS 287 on yaccpar_sccsid *//* Unused static variable */
 /* SUPPRESS 288 on yyerrlab *//* Label unused */
 
+// PVS Studio suppression
+// -V::1037, 1042
+
 #include <config.h>
 
 #include <stdio.h>
diff --git a/plugins/sudoers/goodpath.c b/plugins/sudoers/goodpath.c
index 9f12c40f6..c4c8bbd3c 100644
--- a/plugins/sudoers/goodpath.c
+++ b/plugins/sudoers/goodpath.c
@@ -55,7 +55,7 @@ sudo_goodpath(const char *path, const char *runchroot, struct stat *sbp)
 		errno = ENAMETOOLONG;
 		goto done;
 	    }
-	    path = pathbuf;
+	    path = pathbuf; // -V507
 	}
 	if (sbp == NULL)
 	    sbp = &sb;
diff --git a/plugins/sudoers/gram.c b/plugins/sudoers/gram.c
index 1b11e8c32..0bb72857d 100644
--- a/plugins/sudoers/gram.c
+++ b/plugins/sudoers/gram.c
@@ -128,6 +128,9 @@
 /* If we last saw a newline the entry is on the preceding line. */
 #define this_lineno	(sudoerschar == '\n' ? sudolineno - 1 : sudolineno)
 
+// PVS Studio suppression
+// -V::1037, 1042
+
 /*
  * Globals
  */
@@ -159,7 +162,7 @@ static struct sudo_command *new_command(char *, char *);
 static struct command_digest *new_digest(int, char *);
 static void alias_error(const char *name, int errnum);
 
-#line 157 "gram.c"
+#line 160 "gram.c"
 
 # ifndef YY_CAST
 #  ifdef __cplusplus
@@ -316,7 +319,7 @@ extern int sudoersdebug;
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 union YYSTYPE
 {
-#line 80 "gram.y"
+#line 83 "gram.y"
 
     struct cmndspec *cmndspec;
     struct defaults *defaults;
@@ -330,7 +333,7 @@ union YYSTYPE
     char *string;
     int tok;
 
-#line 328 "gram.c"
+#line 331 "gram.c"
 
 };
 typedef union YYSTYPE YYSTYPE;
@@ -836,21 +839,21 @@ static const yytype_int8 yytranslate[] =
   /* YYRLINE[YYN] -- Source line where rule number YYN was defined.  */
 static const yytype_int16 yyrline[] =
 {
-       0,   189,   189,   192,   195,   196,   199,   202,   205,   212,
-     219,   225,   228,   231,   234,   237,   241,   245,   249,   253,
-     259,   262,   268,   271,   277,   278,   284,   291,   298,   305,
-     312,   321,   322,   326,   332,   346,   350,   356,   363,   370,
-     377,   384,   393,   394,   453,   508,   515,   522,   529,   538,
-     539,   545,   548,   569,   573,   579,   591,   603,   608,   612,
-     617,   622,   627,   631,   636,   639,   644,   659,   668,   677,
-     686,   703,   704,   705,   706,   707,   708,   709,   710,   711,
-     712,   715,   721,   724,   728,   732,   740,   748,   759,   765,
-     771,   777,   785,   788,   791,   794,   797,   800,   803,   806,
-     809,   812,   815,   818,   821,   824,   827,   832,   839,   846,
-     862,   863,   866,   866,   876,   879,   880,   886,   887,   890,
-     890,   900,   903,   904,   910,   911,   914,   914,   924,   927,
-     928,   931,   931,   941,   944,   945,   951,   955,   961,   968,
-     975,   982,   989,   998,   999,  1005,  1009,  1015,  1022,  1029
+       0,   192,   192,   195,   198,   199,   202,   205,   208,   215,
+     222,   228,   231,   234,   237,   240,   244,   248,   252,   256,
+     262,   265,   271,   274,   280,   281,   287,   294,   301,   308,
+     315,   324,   325,   329,   335,   349,   353,   359,   366,   373,
+     380,   387,   396,   397,   456,   511,   518,   525,   532,   541,
+     542,   548,   551,   572,   576,   582,   594,   606,   611,   615,
+     620,   625,   630,   634,   639,   642,   647,   662,   671,   680,
+     689,   706,   707,   708,   709,   710,   711,   712,   713,   714,
+     715,   718,   724,   727,   731,   735,   743,   751,   762,   768,
+     774,   780,   788,   791,   794,   797,   800,   803,   806,   809,
+     812,   815,   818,   821,   824,   827,   830,   835,   842,   849,
+     865,   866,   869,   869,   879,   882,   883,   889,   890,   893,
+     893,   903,   906,   907,   913,   914,   917,   917,   927,   930,
+     931,   934,   934,   944,   947,   948,   954,   958,   964,   971,
+     978,   985,   992,  1001,  1002,  1008,  1012,  1018,  1025,  1032
 };
 #endif
 
@@ -1619,31 +1622,31 @@ yyreduce:
   switch (yyn)
     {
   case 2: /* file: %empty  */
-#line 189 "gram.y"
+#line 192 "gram.y"
                         {
 			    ; /* empty file */
 			}
-#line 1621 "gram.c"
+#line 1624 "gram.c"
     break;
 
   case 6: /* entry: '\n'  */
-#line 199 "gram.y"
+#line 202 "gram.y"
                              {
 			    ; /* blank line */
 			}
-#line 1629 "gram.c"
+#line 1632 "gram.c"
     break;
 
   case 7: /* entry: error '\n'  */
-#line 202 "gram.y"
+#line 205 "gram.y"
                                    {
 			    yyerrok;
 			}
-#line 1637 "gram.c"
+#line 1640 "gram.c"
     break;
 
   case 8: /* entry: include  */
-#line 205 "gram.y"
+#line 208 "gram.y"
                                 {
 			    if (!push_include((yyvsp[0].string), false)) {
 				free((yyvsp[0].string));
@@ -1651,11 +1654,11 @@ yyreduce:
 			    }
 			    free((yyvsp[0].string));
 			}
-#line 1649 "gram.c"
+#line 1652 "gram.c"
     break;
 
   case 9: /* entry: includedir  */
-#line 212 "gram.y"
+#line 215 "gram.y"
                                    {
 			    if (!push_include((yyvsp[0].string), true)) {
 				free((yyvsp[0].string));
@@ -1663,142 +1666,142 @@ yyreduce:
 			    }
 			    free((yyvsp[0].string));
 			}
-#line 1661 "gram.c"
+#line 1664 "gram.c"
     break;
 
   case 10: /* entry: userlist privileges '\n'  */
-#line 219 "gram.y"
+#line 222 "gram.y"
                                                  {
 			    if (!add_userspec((yyvsp[-2].member), (yyvsp[-1].privilege))) {
 				sudoerserror(N_("unable to allocate memory"));
 				YYERROR;
 			    }
 			}
-#line 1672 "gram.c"
+#line 1675 "gram.c"
     break;
 
   case 11: /* entry: USERALIAS useraliases '\n'  */
-#line 225 "gram.y"
-                                                   {
-			    ;
-			}
-#line 1680 "gram.c"
-    break;
-
-  case 12: /* entry: HOSTALIAS hostaliases '\n'  */
 #line 228 "gram.y"
                                                    {
 			    ;
 			}
-#line 1688 "gram.c"
+#line 1683 "gram.c"
     break;
 
-  case 13: /* entry: CMNDALIAS cmndaliases '\n'  */
+  case 12: /* entry: HOSTALIAS hostaliases '\n'  */
 #line 231 "gram.y"
                                                    {
 			    ;
 			}
-#line 1696 "gram.c"
+#line 1691 "gram.c"
+    break;
+
+  case 13: /* entry: CMNDALIAS cmndaliases '\n'  */
+#line 234 "gram.y"
+                                                   {
+			    ;
+			}
+#line 1699 "gram.c"
     break;
 
   case 14: /* entry: RUNASALIAS runasaliases '\n'  */
-#line 234 "gram.y"
+#line 237 "gram.y"
                                                      {
 			    ;
 			}
-#line 1704 "gram.c"
+#line 1707 "gram.c"
     break;
 
   case 15: /* entry: DEFAULTS defaults_list '\n'  */
-#line 237 "gram.y"
+#line 240 "gram.y"
                                                     {
 			    if (!add_defaults(DEFAULTS, NULL, (yyvsp[-1].defaults)))
 				YYERROR;
 			}
-#line 1713 "gram.c"
+#line 1716 "gram.c"
     break;
 
   case 16: /* entry: DEFAULTS_USER userlist defaults_list '\n'  */
-#line 241 "gram.y"
+#line 244 "gram.y"
                                                                   {
 			    if (!add_defaults(DEFAULTS_USER, (yyvsp[-2].member), (yyvsp[-1].defaults)))
 				YYERROR;
 			}
-#line 1722 "gram.c"
+#line 1725 "gram.c"
     break;
 
   case 17: /* entry: DEFAULTS_RUNAS userlist defaults_list '\n'  */
-#line 245 "gram.y"
+#line 248 "gram.y"
                                                                    {
 			    if (!add_defaults(DEFAULTS_RUNAS, (yyvsp[-2].member), (yyvsp[-1].defaults)))
 				YYERROR;
 			}
-#line 1731 "gram.c"
+#line 1734 "gram.c"
     break;
 
   case 18: /* entry: DEFAULTS_HOST hostlist defaults_list '\n'  */
-#line 249 "gram.y"
+#line 252 "gram.y"
                                                                   {
 			    if (!add_defaults(DEFAULTS_HOST, (yyvsp[-2].member), (yyvsp[-1].defaults)))
 				YYERROR;
 			}
-#line 1740 "gram.c"
+#line 1743 "gram.c"
     break;
 
   case 19: /* entry: DEFAULTS_CMND cmndlist defaults_list '\n'  */
-#line 253 "gram.y"
+#line 256 "gram.y"
                                                                   {
 			    if (!add_defaults(DEFAULTS_CMND, (yyvsp[-2].member), (yyvsp[-1].defaults)))
 				YYERROR;
 			}
-#line 1749 "gram.c"
+#line 1752 "gram.c"
     break;
 
   case 20: /* include: INCLUDE WORD '\n'  */
-#line 259 "gram.y"
+#line 262 "gram.y"
                                           {
 			    (yyval.string) = (yyvsp[-1].string);
 			}
-#line 1757 "gram.c"
+#line 1760 "gram.c"
     break;
 
   case 21: /* include: INCLUDE WORD error '\n'  */
-#line 262 "gram.y"
+#line 265 "gram.y"
                                                 {
 			    yyerrok;
 			    (yyval.string) = (yyvsp[-2].string);
 			}
-#line 1766 "gram.c"
+#line 1769 "gram.c"
     break;
 
   case 22: /* includedir: INCLUDEDIR WORD '\n'  */
-#line 268 "gram.y"
+#line 271 "gram.y"
                                              {
 			    (yyval.string) = (yyvsp[-1].string);
 			}
-#line 1774 "gram.c"
+#line 1777 "gram.c"
     break;
 
   case 23: /* includedir: INCLUDEDIR WORD error '\n'  */
-#line 271 "gram.y"
+#line 274 "gram.y"
                                                    {
 			    yyerrok;
 			    (yyval.string) = (yyvsp[-2].string);
 			}
-#line 1783 "gram.c"
+#line 1786 "gram.c"
     break;
 
   case 25: /* defaults_list: defaults_list ',' defaults_entry  */
-#line 278 "gram.y"
+#line 281 "gram.y"
                                                          {
 			    HLTQ_CONCAT((yyvsp[-2].defaults), (yyvsp[0].defaults), entries);
 			    (yyval.defaults) = (yyvsp[-2].defaults);
 			}
-#line 1792 "gram.c"
+#line 1795 "gram.c"
     break;
 
   case 26: /* defaults_entry: DEFVAR  */
-#line 284 "gram.y"
+#line 287 "gram.y"
                                {
 			    (yyval.defaults) = new_default((yyvsp[0].string), NULL, true);
 			    if ((yyval.defaults) == NULL) {
@@ -1806,11 +1809,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 1804 "gram.c"
+#line 1807 "gram.c"
     break;
 
   case 27: /* defaults_entry: '!' DEFVAR  */
-#line 291 "gram.y"
+#line 294 "gram.y"
                                    {
 			    (yyval.defaults) = new_default((yyvsp[0].string), NULL, false);
 			    if ((yyval.defaults) == NULL) {
@@ -1818,11 +1821,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 1816 "gram.c"
+#line 1819 "gram.c"
     break;
 
   case 28: /* defaults_entry: DEFVAR '=' WORD  */
-#line 298 "gram.y"
+#line 301 "gram.y"
                                         {
 			    (yyval.defaults) = new_default((yyvsp[-2].string), (yyvsp[0].string), true);
 			    if ((yyval.defaults) == NULL) {
@@ -1830,11 +1833,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 1828 "gram.c"
+#line 1831 "gram.c"
     break;
 
   case 29: /* defaults_entry: DEFVAR '+' WORD  */
-#line 305 "gram.y"
+#line 308 "gram.y"
                                         {
 			    (yyval.defaults) = new_default((yyvsp[-2].string), (yyvsp[0].string), '+');
 			    if ((yyval.defaults) == NULL) {
@@ -1842,11 +1845,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 1840 "gram.c"
+#line 1843 "gram.c"
     break;
 
   case 30: /* defaults_entry: DEFVAR '-' WORD  */
-#line 312 "gram.y"
+#line 315 "gram.y"
                                         {
 			    (yyval.defaults) = new_default((yyvsp[-2].string), (yyvsp[0].string), '-');
 			    if ((yyval.defaults) == NULL) {
@@ -1854,29 +1857,29 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 1852 "gram.c"
+#line 1855 "gram.c"
     break;
 
   case 32: /* privileges: privileges ':' privilege  */
-#line 322 "gram.y"
+#line 325 "gram.y"
                                                  {
 			    HLTQ_CONCAT((yyvsp[-2].privilege), (yyvsp[0].privilege), entries);
 			    (yyval.privilege) = (yyvsp[-2].privilege);
 			}
-#line 1861 "gram.c"
+#line 1864 "gram.c"
     break;
 
   case 33: /* privileges: privileges ':' error  */
-#line 326 "gram.y"
+#line 329 "gram.y"
                                              {
 			    yyerrok;
 			    (yyval.privilege) = (yyvsp[-2].privilege);
 			}
-#line 1870 "gram.c"
+#line 1873 "gram.c"
     break;
 
   case 34: /* privilege: hostlist '=' cmndspeclist  */
-#line 332 "gram.y"
+#line 335 "gram.y"
                                                   {
 			    struct privilege *p = calloc(1, sizeof(*p));
 			    if (p == NULL) {
@@ -1889,29 +1892,29 @@ yyreduce:
 			    HLTQ_INIT(p, entries);
 			    (yyval.privilege) = p;
 			}
-#line 1887 "gram.c"
+#line 1890 "gram.c"
     break;
 
   case 35: /* ophost: host  */
-#line 346 "gram.y"
+#line 349 "gram.y"
                              {
 			    (yyval.member) = (yyvsp[0].member);
 			    (yyval.member)->negated = false;
 			}
-#line 1896 "gram.c"
+#line 1899 "gram.c"
     break;
 
   case 36: /* ophost: '!' host  */
-#line 350 "gram.y"
+#line 353 "gram.y"
                                  {
 			    (yyval.member) = (yyvsp[0].member);
 			    (yyval.member)->negated = true;
 			}
-#line 1905 "gram.c"
+#line 1908 "gram.c"
     break;
 
   case 37: /* host: ALIAS  */
-#line 356 "gram.y"
+#line 359 "gram.y"
                               {
 			    (yyval.member) = new_member((yyvsp[0].string), ALIAS);
 			    if ((yyval.member) == NULL) {
@@ -1919,11 +1922,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 1917 "gram.c"
+#line 1920 "gram.c"
     break;
 
   case 38: /* host: ALL  */
-#line 363 "gram.y"
+#line 366 "gram.y"
                             {
 			    (yyval.member) = new_member(NULL, ALL);
 			    if ((yyval.member) == NULL) {
@@ -1931,11 +1934,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 1929 "gram.c"
+#line 1932 "gram.c"
     break;
 
   case 39: /* host: NETGROUP  */
-#line 370 "gram.y"
+#line 373 "gram.y"
                                  {
 			    (yyval.member) = new_member((yyvsp[0].string), NETGROUP);
 			    if ((yyval.member) == NULL) {
@@ -1943,11 +1946,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 1941 "gram.c"
+#line 1944 "gram.c"
     break;
 
   case 40: /* host: NTWKADDR  */
-#line 377 "gram.y"
+#line 380 "gram.y"
                                  {
 			    (yyval.member) = new_member((yyvsp[0].string), NTWKADDR);
 			    if ((yyval.member) == NULL) {
@@ -1955,11 +1958,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 1953 "gram.c"
+#line 1956 "gram.c"
     break;
 
   case 41: /* host: WORD  */
-#line 384 "gram.y"
+#line 387 "gram.y"
                              {
 			    (yyval.member) = new_member((yyvsp[0].string), WORD);
 			    if ((yyval.member) == NULL) {
@@ -1967,11 +1970,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 1965 "gram.c"
+#line 1968 "gram.c"
     break;
 
   case 43: /* cmndspeclist: cmndspeclist ',' cmndspec  */
-#line 394 "gram.y"
+#line 397 "gram.y"
                                                   {
 			    struct cmndspec *prev;
 			    prev = HLTQ_LAST((yyvsp[-2].cmndspec), cmndspec, entries);
@@ -2029,11 +2032,11 @@ yyreduce:
 			    }
 			    (yyval.cmndspec) = (yyvsp[-2].cmndspec);
 			}
-#line 2027 "gram.c"
+#line 2030 "gram.c"
     break;
 
   case 44: /* cmndspec: runasspec options cmndtag digcmnd  */
-#line 453 "gram.y"
+#line 456 "gram.y"
                                                           {
 			    struct cmndspec *cs = calloc(1, sizeof(*cs));
 			    if (cs == NULL) {
@@ -2087,11 +2090,11 @@ yyreduce:
 				cs->tags.setenv = IMPLIED;
 			    (yyval.cmndspec) = cs;
 			}
-#line 2085 "gram.c"
+#line 2088 "gram.c"
     break;
 
   case 45: /* digestspec: SHA224_TOK ':' DIGEST  */
-#line 508 "gram.y"
+#line 511 "gram.y"
                                               {
 			    (yyval.digest) = new_digest(SUDO_DIGEST_SHA224, (yyvsp[0].string));
 			    if ((yyval.digest) == NULL) {
@@ -2099,11 +2102,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2097 "gram.c"
+#line 2100 "gram.c"
     break;
 
   case 46: /* digestspec: SHA256_TOK ':' DIGEST  */
-#line 515 "gram.y"
+#line 518 "gram.y"
                                               {
 			    (yyval.digest) = new_digest(SUDO_DIGEST_SHA256, (yyvsp[0].string));
 			    if ((yyval.digest) == NULL) {
@@ -2111,11 +2114,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2109 "gram.c"
+#line 2112 "gram.c"
     break;
 
   case 47: /* digestspec: SHA384_TOK ':' DIGEST  */
-#line 522 "gram.y"
+#line 525 "gram.y"
                                               {
 			    (yyval.digest) = new_digest(SUDO_DIGEST_SHA384, (yyvsp[0].string));
 			    if ((yyval.digest) == NULL) {
@@ -2123,11 +2126,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2121 "gram.c"
+#line 2124 "gram.c"
     break;
 
   case 48: /* digestspec: SHA512_TOK ':' DIGEST  */
-#line 529 "gram.y"
+#line 532 "gram.y"
                                               {
 			    (yyval.digest) = new_digest(SUDO_DIGEST_SHA512, (yyvsp[0].string));
 			    if ((yyval.digest) == NULL) {
@@ -2135,28 +2138,28 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2133 "gram.c"
+#line 2136 "gram.c"
     break;
 
   case 50: /* digestlist: digestlist ',' digestspec  */
-#line 539 "gram.y"
+#line 542 "gram.y"
                                                   {
 			    HLTQ_CONCAT((yyvsp[-2].digest), (yyvsp[0].digest), entries);
 			    (yyval.digest) = (yyvsp[-2].digest);
 			}
-#line 2142 "gram.c"
+#line 2145 "gram.c"
     break;
 
   case 51: /* digcmnd: opcmnd  */
-#line 545 "gram.y"
+#line 548 "gram.y"
                                {
 			    (yyval.member) = (yyvsp[0].member);
 			}
-#line 2150 "gram.c"
+#line 2153 "gram.c"
     break;
 
   case 52: /* digcmnd: digestlist opcmnd  */
-#line 548 "gram.y"
+#line 551 "gram.y"
                                           {
 			    struct sudo_command *c =
 				(struct sudo_command *) (yyvsp[0].member)->name;
@@ -2176,29 +2179,29 @@ yyreduce:
 			    HLTQ_TO_TAILQ(&c->digests, (yyvsp[-1].digest), entries);
 			    (yyval.member) = (yyvsp[0].member);
 			}
-#line 2174 "gram.c"
+#line 2177 "gram.c"
     break;
 
   case 53: /* opcmnd: cmnd  */
-#line 569 "gram.y"
+#line 572 "gram.y"
                              {
 			    (yyval.member) = (yyvsp[0].member);
 			    (yyval.member)->negated = false;
 			}
-#line 2183 "gram.c"
+#line 2186 "gram.c"
     break;
 
   case 54: /* opcmnd: '!' cmnd  */
-#line 573 "gram.y"
+#line 576 "gram.y"
                                  {
 			    (yyval.member) = (yyvsp[0].member);
 			    (yyval.member)->negated = true;
 			}
-#line 2192 "gram.c"
+#line 2195 "gram.c"
     break;
 
   case 55: /* chdirspec: CWD '=' WORD  */
-#line 579 "gram.y"
+#line 582 "gram.y"
                                      {
 			    if ((yyvsp[0].string)[0] != '/' && (yyvsp[0].string)[0] != '~') {
 				if (strcmp((yyvsp[0].string), "*") != 0) {
@@ -2209,11 +2212,11 @@ yyreduce:
 			    }
 			    (yyval.string) = (yyvsp[0].string);
 			}
-#line 2207 "gram.c"
+#line 2210 "gram.c"
     break;
 
   case 56: /* chrootspec: CHROOT '=' WORD  */
-#line 591 "gram.y"
+#line 594 "gram.y"
                                         {
 			    if ((yyvsp[0].string)[0] != '/' && (yyvsp[0].string)[0] != '~') {
 				if (strcmp((yyvsp[0].string), "*") != 0) {
@@ -2224,83 +2227,83 @@ yyreduce:
 			    }
 			    (yyval.string) = (yyvsp[0].string);
 			}
-#line 2222 "gram.c"
+#line 2225 "gram.c"
     break;
 
   case 57: /* timeoutspec: CMND_TIMEOUT '=' WORD  */
-#line 603 "gram.y"
+#line 606 "gram.y"
                                               {
 			    (yyval.string) = (yyvsp[0].string);
 			}
-#line 2230 "gram.c"
+#line 2233 "gram.c"
     break;
 
   case 58: /* notbeforespec: NOTBEFORE '=' WORD  */
-#line 608 "gram.y"
+#line 611 "gram.y"
                                            {
 			    (yyval.string) = (yyvsp[0].string);
 			}
-#line 2238 "gram.c"
+#line 2241 "gram.c"
     break;
 
   case 59: /* notafterspec: NOTAFTER '=' WORD  */
-#line 612 "gram.y"
+#line 615 "gram.y"
                                           {
 			    (yyval.string) = (yyvsp[0].string);
 			}
-#line 2246 "gram.c"
+#line 2249 "gram.c"
     break;
 
   case 60: /* rolespec: ROLE '=' WORD  */
-#line 617 "gram.y"
+#line 620 "gram.y"
                                       {
 			    (yyval.string) = (yyvsp[0].string);
 			}
-#line 2254 "gram.c"
+#line 2257 "gram.c"
     break;
 
   case 61: /* typespec: TYPE '=' WORD  */
-#line 622 "gram.y"
+#line 625 "gram.y"
                                       {
 			    (yyval.string) = (yyvsp[0].string);
 			}
-#line 2262 "gram.c"
+#line 2265 "gram.c"
     break;
 
   case 62: /* privsspec: PRIVS '=' WORD  */
-#line 627 "gram.y"
+#line 630 "gram.y"
                                        {
 			    (yyval.string) = (yyvsp[0].string);
 			}
-#line 2270 "gram.c"
+#line 2273 "gram.c"
     break;
 
   case 63: /* limitprivsspec: LIMITPRIVS '=' WORD  */
-#line 631 "gram.y"
+#line 634 "gram.y"
                                             {
 			    (yyval.string) = (yyvsp[0].string);
 			}
-#line 2278 "gram.c"
+#line 2281 "gram.c"
     break;
 
   case 64: /* runasspec: %empty  */
-#line 636 "gram.y"
+#line 639 "gram.y"
                                     {
 			    (yyval.runas) = NULL;
 			}
-#line 2286 "gram.c"
+#line 2289 "gram.c"
     break;
 
   case 65: /* runasspec: '(' runaslist ')'  */
-#line 639 "gram.y"
+#line 642 "gram.y"
                                           {
 			    (yyval.runas) = (yyvsp[-1].runas);
 			}
-#line 2294 "gram.c"
+#line 2297 "gram.c"
     break;
 
   case 66: /* runaslist: %empty  */
-#line 644 "gram.y"
+#line 647 "gram.y"
                                     {
 			    (yyval.runas) = calloc(1, sizeof(struct runascontainer));
 			    if ((yyval.runas) != NULL) {
@@ -2316,11 +2319,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2314 "gram.c"
+#line 2317 "gram.c"
     break;
 
   case 67: /* runaslist: userlist  */
-#line 659 "gram.y"
+#line 662 "gram.y"
                                  {
 			    (yyval.runas) = calloc(1, sizeof(struct runascontainer));
 			    if ((yyval.runas) == NULL) {
@@ -2330,11 +2333,11 @@ yyreduce:
 			    (yyval.runas)->runasusers = (yyvsp[0].member);
 			    /* $$->runasgroups = NULL; */
 			}
-#line 2328 "gram.c"
+#line 2331 "gram.c"
     break;
 
   case 68: /* runaslist: userlist ':' grouplist  */
-#line 668 "gram.y"
+#line 671 "gram.y"
                                                {
 			    (yyval.runas) = calloc(1, sizeof(struct runascontainer));
 			    if ((yyval.runas) == NULL) {
@@ -2344,11 +2347,11 @@ yyreduce:
 			    (yyval.runas)->runasusers = (yyvsp[-2].member);
 			    (yyval.runas)->runasgroups = (yyvsp[0].member);
 			}
-#line 2342 "gram.c"
+#line 2345 "gram.c"
     break;
 
   case 69: /* runaslist: ':' grouplist  */
-#line 677 "gram.y"
+#line 680 "gram.y"
                                       {
 			    (yyval.runas) = calloc(1, sizeof(struct runascontainer));
 			    if ((yyval.runas) == NULL) {
@@ -2358,11 +2361,11 @@ yyreduce:
 			    /* $$->runasusers = NULL; */
 			    (yyval.runas)->runasgroups = (yyvsp[0].member);
 			}
-#line 2356 "gram.c"
+#line 2359 "gram.c"
     break;
 
   case 70: /* runaslist: ':'  */
-#line 686 "gram.y"
+#line 689 "gram.y"
                             {
 			    (yyval.runas) = calloc(1, sizeof(struct runascontainer));
 			    if ((yyval.runas) != NULL) {
@@ -2378,106 +2381,106 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2376 "gram.c"
+#line 2379 "gram.c"
     break;
 
   case 71: /* reserved_word: ALL  */
-#line 703 "gram.y"
+#line 706 "gram.y"
                                         { (yyval.string) = "ALL"; }
-#line 2382 "gram.c"
+#line 2385 "gram.c"
     break;
 
   case 72: /* reserved_word: CHROOT  */
-#line 704 "gram.y"
+#line 707 "gram.y"
                                         { (yyval.string) = "CHROOT"; }
-#line 2388 "gram.c"
+#line 2391 "gram.c"
     break;
 
   case 73: /* reserved_word: CWD  */
-#line 705 "gram.y"
+#line 708 "gram.y"
                                         { (yyval.string) = "CWD"; }
-#line 2394 "gram.c"
+#line 2397 "gram.c"
     break;
 
   case 74: /* reserved_word: CMND_TIMEOUT  */
-#line 706 "gram.y"
+#line 709 "gram.y"
                                         { (yyval.string) = "CMND_TIMEOUT"; }
-#line 2400 "gram.c"
+#line 2403 "gram.c"
     break;
 
   case 75: /* reserved_word: NOTBEFORE  */
-#line 707 "gram.y"
+#line 710 "gram.y"
                                         { (yyval.string) = "NOTBEFORE"; }
-#line 2406 "gram.c"
+#line 2409 "gram.c"
     break;
 
   case 76: /* reserved_word: NOTAFTER  */
-#line 708 "gram.y"
+#line 711 "gram.y"
                                         { (yyval.string) = "NOTAFTER"; }
-#line 2412 "gram.c"
+#line 2415 "gram.c"
     break;
 
   case 77: /* reserved_word: ROLE  */
-#line 709 "gram.y"
+#line 712 "gram.y"
                                         { (yyval.string) = "ROLE"; }
-#line 2418 "gram.c"
+#line 2421 "gram.c"
     break;
 
   case 78: /* reserved_word: TYPE  */
-#line 710 "gram.y"
+#line 713 "gram.y"
                                         { (yyval.string) = "TYPE"; }
-#line 2424 "gram.c"
+#line 2427 "gram.c"
     break;
 
   case 79: /* reserved_word: PRIVS  */
-#line 711 "gram.y"
+#line 714 "gram.y"
                                         { (yyval.string) = "PRIVS"; }
-#line 2430 "gram.c"
+#line 2433 "gram.c"
     break;
 
   case 80: /* reserved_word: LIMITPRIVS  */
-#line 712 "gram.y"
+#line 715 "gram.y"
                                         { (yyval.string) = "LIMITPRIVS"; }
-#line 2436 "gram.c"
+#line 2439 "gram.c"
     break;
 
   case 81: /* reserved_alias: reserved_word  */
-#line 715 "gram.y"
+#line 718 "gram.y"
                                       {
 			    sudoerserrorf(U_("syntax error, reserved word %s used as an alias name"), (yyvsp[0].string));
 			    YYERROR;
 			}
-#line 2445 "gram.c"
+#line 2448 "gram.c"
     break;
 
   case 82: /* options: %empty  */
-#line 721 "gram.y"
+#line 724 "gram.y"
                                     {
 			    init_options(&(yyval.options));
 			}
-#line 2453 "gram.c"
+#line 2456 "gram.c"
     break;
 
   case 83: /* options: options chdirspec  */
-#line 724 "gram.y"
+#line 727 "gram.y"
                                           {
 			    free((yyval.options).runcwd);
 			    (yyval.options).runcwd = (yyvsp[0].string);
 			}
-#line 2462 "gram.c"
+#line 2465 "gram.c"
     break;
 
   case 84: /* options: options chrootspec  */
-#line 728 "gram.y"
+#line 731 "gram.y"
                                            {
 			    free((yyval.options).runchroot);
 			    (yyval.options).runchroot = (yyvsp[0].string);
 			}
-#line 2471 "gram.c"
+#line 2474 "gram.c"
     break;
 
   case 85: /* options: options notbeforespec  */
-#line 732 "gram.y"
+#line 735 "gram.y"
                                               {
 			    (yyval.options).notbefore = parse_gentime((yyvsp[0].string));
 			    free((yyvsp[0].string));
@@ -2486,11 +2489,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2484 "gram.c"
+#line 2487 "gram.c"
     break;
 
   case 86: /* options: options notafterspec  */
-#line 740 "gram.y"
+#line 743 "gram.y"
                                              {
 			    (yyval.options).notafter = parse_gentime((yyvsp[0].string));
 			    free((yyvsp[0].string));
@@ -2499,11 +2502,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2497 "gram.c"
+#line 2500 "gram.c"
     break;
 
   case 87: /* options: options timeoutspec  */
-#line 748 "gram.y"
+#line 751 "gram.y"
                                             {
 			    (yyval.options).timeout = parse_timeout((yyvsp[0].string));
 			    free((yyvsp[0].string));
@@ -2515,175 +2518,175 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2513 "gram.c"
+#line 2516 "gram.c"
     break;
 
   case 88: /* options: options rolespec  */
-#line 759 "gram.y"
+#line 762 "gram.y"
                                          {
 #ifdef HAVE_SELINUX
 			    free((yyval.options).role);
 			    (yyval.options).role = (yyvsp[0].string);
 #endif
 			}
-#line 2524 "gram.c"
+#line 2527 "gram.c"
     break;
 
   case 89: /* options: options typespec  */
-#line 765 "gram.y"
+#line 768 "gram.y"
                                          {
 #ifdef HAVE_SELINUX
 			    free((yyval.options).type);
 			    (yyval.options).type = (yyvsp[0].string);
 #endif
 			}
-#line 2535 "gram.c"
+#line 2538 "gram.c"
     break;
 
   case 90: /* options: options privsspec  */
-#line 771 "gram.y"
+#line 774 "gram.y"
                                           {
 #ifdef HAVE_PRIV_SET
 			    free((yyval.options).privs);
 			    (yyval.options).privs = (yyvsp[0].string);
 #endif
 			}
-#line 2546 "gram.c"
+#line 2549 "gram.c"
     break;
 
   case 91: /* options: options limitprivsspec  */
-#line 777 "gram.y"
+#line 780 "gram.y"
                                                {
 #ifdef HAVE_PRIV_SET
 			    free((yyval.options).limitprivs);
 			    (yyval.options).limitprivs = (yyvsp[0].string);
 #endif
 			}
-#line 2557 "gram.c"
+#line 2560 "gram.c"
     break;
 
   case 92: /* cmndtag: %empty  */
-#line 785 "gram.y"
+#line 788 "gram.y"
                                     {
 			    TAGS_INIT(&(yyval.tag));
 			}
-#line 2565 "gram.c"
+#line 2568 "gram.c"
     break;
 
   case 93: /* cmndtag: cmndtag NOPASSWD  */
-#line 788 "gram.y"
+#line 791 "gram.y"
                                          {
 			    (yyval.tag).nopasswd = true;
 			}
-#line 2573 "gram.c"
+#line 2576 "gram.c"
     break;
 
   case 94: /* cmndtag: cmndtag PASSWD  */
-#line 791 "gram.y"
+#line 794 "gram.y"
                                        {
 			    (yyval.tag).nopasswd = false;
 			}
-#line 2581 "gram.c"
+#line 2584 "gram.c"
     break;
 
   case 95: /* cmndtag: cmndtag NOEXEC  */
-#line 794 "gram.y"
+#line 797 "gram.y"
                                        {
 			    (yyval.tag).noexec = true;
 			}
-#line 2589 "gram.c"
+#line 2592 "gram.c"
     break;
 
   case 96: /* cmndtag: cmndtag EXEC  */
-#line 797 "gram.y"
+#line 800 "gram.y"
                                      {
 			    (yyval.tag).noexec = false;
 			}
-#line 2597 "gram.c"
+#line 2600 "gram.c"
     break;
 
   case 97: /* cmndtag: cmndtag SETENV  */
-#line 800 "gram.y"
+#line 803 "gram.y"
                                        {
 			    (yyval.tag).setenv = true;
 			}
-#line 2605 "gram.c"
+#line 2608 "gram.c"
     break;
 
   case 98: /* cmndtag: cmndtag NOSETENV  */
-#line 803 "gram.y"
+#line 806 "gram.y"
                                          {
 			    (yyval.tag).setenv = false;
 			}
-#line 2613 "gram.c"
+#line 2616 "gram.c"
     break;
 
   case 99: /* cmndtag: cmndtag LOG_INPUT  */
-#line 806 "gram.y"
+#line 809 "gram.y"
                                           {
 			    (yyval.tag).log_input = true;
 			}
-#line 2621 "gram.c"
+#line 2624 "gram.c"
     break;
 
   case 100: /* cmndtag: cmndtag NOLOG_INPUT  */
-#line 809 "gram.y"
+#line 812 "gram.y"
                                             {
 			    (yyval.tag).log_input = false;
 			}
-#line 2629 "gram.c"
+#line 2632 "gram.c"
     break;
 
   case 101: /* cmndtag: cmndtag LOG_OUTPUT  */
-#line 812 "gram.y"
+#line 815 "gram.y"
                                            {
 			    (yyval.tag).log_output = true;
 			}
-#line 2637 "gram.c"
+#line 2640 "gram.c"
     break;
 
   case 102: /* cmndtag: cmndtag NOLOG_OUTPUT  */
-#line 815 "gram.y"
+#line 818 "gram.y"
                                              {
 			    (yyval.tag).log_output = false;
 			}
-#line 2645 "gram.c"
+#line 2648 "gram.c"
     break;
 
   case 103: /* cmndtag: cmndtag FOLLOWLNK  */
-#line 818 "gram.y"
+#line 821 "gram.y"
                                           {
 			    (yyval.tag).follow = true;
 			}
-#line 2653 "gram.c"
+#line 2656 "gram.c"
     break;
 
   case 104: /* cmndtag: cmndtag NOFOLLOWLNK  */
-#line 821 "gram.y"
+#line 824 "gram.y"
                                             {
 			    (yyval.tag).follow = false;
 			}
-#line 2661 "gram.c"
+#line 2664 "gram.c"
     break;
 
   case 105: /* cmndtag: cmndtag MAIL  */
-#line 824 "gram.y"
+#line 827 "gram.y"
                                      {
 			    (yyval.tag).send_mail = true;
 			}
-#line 2669 "gram.c"
+#line 2672 "gram.c"
     break;
 
   case 106: /* cmndtag: cmndtag NOMAIL  */
-#line 827 "gram.y"
+#line 830 "gram.y"
                                        {
 			    (yyval.tag).send_mail = false;
 			}
-#line 2677 "gram.c"
+#line 2680 "gram.c"
     break;
 
   case 107: /* cmnd: ALL  */
-#line 832 "gram.y"
+#line 835 "gram.y"
                             {
 			    (yyval.member) = new_member(NULL, ALL);
 			    if ((yyval.member) == NULL) {
@@ -2691,11 +2694,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2689 "gram.c"
+#line 2692 "gram.c"
     break;
 
   case 108: /* cmnd: ALIAS  */
-#line 839 "gram.y"
+#line 842 "gram.y"
                               {
 			    (yyval.member) = new_member((yyvsp[0].string), ALIAS);
 			    if ((yyval.member) == NULL) {
@@ -2703,11 +2706,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2701 "gram.c"
+#line 2704 "gram.c"
     break;
 
   case 109: /* cmnd: COMMAND  */
-#line 846 "gram.y"
+#line 849 "gram.y"
                                 {
 			    struct sudo_command *c;
 
@@ -2722,20 +2725,20 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2720 "gram.c"
+#line 2723 "gram.c"
     break;
 
   case 112: /* $@1: %empty  */
-#line 866 "gram.y"
+#line 869 "gram.y"
                               {
 			    alias_line = this_lineno;
 			    alias_column = sudolinebuf.toke_start + 1;
 			}
-#line 2729 "gram.c"
+#line 2732 "gram.c"
     break;
 
   case 113: /* hostalias: ALIAS $@1 '=' hostlist  */
-#line 869 "gram.y"
+#line 872 "gram.y"
                                        {
 			    if (!alias_add(&parsed_policy, (yyvsp[-3].string), HOSTALIAS,
 				sudoers, alias_line, alias_column, (yyvsp[0].member))) {
@@ -2743,29 +2746,29 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2741 "gram.c"
+#line 2744 "gram.c"
     break;
 
   case 116: /* hostlist: hostlist ',' ophost  */
-#line 880 "gram.y"
+#line 883 "gram.y"
                                             {
 			    HLTQ_CONCAT((yyvsp[-2].member), (yyvsp[0].member), entries);
 			    (yyval.member) = (yyvsp[-2].member);
 			}
-#line 2750 "gram.c"
+#line 2753 "gram.c"
     break;
 
   case 119: /* $@2: %empty  */
-#line 890 "gram.y"
+#line 893 "gram.y"
                               {
 			    alias_line = this_lineno;
 			    alias_column = sudolinebuf.toke_start + 1;
 			}
-#line 2759 "gram.c"
+#line 2762 "gram.c"
     break;
 
   case 120: /* cmndalias: ALIAS $@2 '=' cmndlist  */
-#line 893 "gram.y"
+#line 896 "gram.y"
                                        {
 			    if (!alias_add(&parsed_policy, (yyvsp[-3].string), CMNDALIAS,
 				sudoers, alias_line, alias_column, (yyvsp[0].member))) {
@@ -2773,29 +2776,29 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2771 "gram.c"
+#line 2774 "gram.c"
     break;
 
   case 123: /* cmndlist: cmndlist ',' digcmnd  */
-#line 904 "gram.y"
+#line 907 "gram.y"
                                              {
 			    HLTQ_CONCAT((yyvsp[-2].member), (yyvsp[0].member), entries);
 			    (yyval.member) = (yyvsp[-2].member);
 			}
-#line 2780 "gram.c"
+#line 2783 "gram.c"
     break;
 
   case 126: /* $@3: %empty  */
-#line 914 "gram.y"
+#line 917 "gram.y"
                               {
 			    alias_line = this_lineno;
 			    alias_column = sudolinebuf.toke_start + 1;
 			}
-#line 2789 "gram.c"
+#line 2792 "gram.c"
     break;
 
   case 127: /* runasalias: ALIAS $@3 '=' userlist  */
-#line 917 "gram.y"
+#line 920 "gram.y"
                                        {
 			    if (!alias_add(&parsed_policy, (yyvsp[-3].string), RUNASALIAS,
 				sudoers, alias_line, alias_column, (yyvsp[0].member))) {
@@ -2803,20 +2806,20 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2801 "gram.c"
+#line 2804 "gram.c"
     break;
 
   case 131: /* $@4: %empty  */
-#line 931 "gram.y"
+#line 934 "gram.y"
                               {
 			    alias_line = this_lineno;
 			    alias_column = sudolinebuf.toke_start + 1;
 			}
-#line 2810 "gram.c"
+#line 2813 "gram.c"
     break;
 
   case 132: /* useralias: ALIAS $@4 '=' userlist  */
-#line 934 "gram.y"
+#line 937 "gram.y"
                                        {
 			    if (!alias_add(&parsed_policy, (yyvsp[-3].string), USERALIAS,
 				sudoers, alias_line, alias_column, (yyvsp[0].member))) {
@@ -2824,38 +2827,38 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2822 "gram.c"
+#line 2825 "gram.c"
     break;
 
   case 135: /* userlist: userlist ',' opuser  */
-#line 945 "gram.y"
+#line 948 "gram.y"
                                             {
 			    HLTQ_CONCAT((yyvsp[-2].member), (yyvsp[0].member), entries);
 			    (yyval.member) = (yyvsp[-2].member);
 			}
-#line 2831 "gram.c"
+#line 2834 "gram.c"
     break;
 
   case 136: /* opuser: user  */
-#line 951 "gram.y"
+#line 954 "gram.y"
                              {
 			    (yyval.member) = (yyvsp[0].member);
 			    (yyval.member)->negated = false;
 			}
-#line 2840 "gram.c"
+#line 2843 "gram.c"
     break;
 
   case 137: /* opuser: '!' user  */
-#line 955 "gram.y"
+#line 958 "gram.y"
                                  {
 			    (yyval.member) = (yyvsp[0].member);
 			    (yyval.member)->negated = true;
 			}
-#line 2849 "gram.c"
+#line 2852 "gram.c"
     break;
 
   case 138: /* user: ALIAS  */
-#line 961 "gram.y"
+#line 964 "gram.y"
                               {
 			    (yyval.member) = new_member((yyvsp[0].string), ALIAS);
 			    if ((yyval.member) == NULL) {
@@ -2863,11 +2866,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2861 "gram.c"
+#line 2864 "gram.c"
     break;
 
   case 139: /* user: ALL  */
-#line 968 "gram.y"
+#line 971 "gram.y"
                             {
 			    (yyval.member) = new_member(NULL, ALL);
 			    if ((yyval.member) == NULL) {
@@ -2875,11 +2878,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2873 "gram.c"
+#line 2876 "gram.c"
     break;
 
   case 140: /* user: NETGROUP  */
-#line 975 "gram.y"
+#line 978 "gram.y"
                                  {
 			    (yyval.member) = new_member((yyvsp[0].string), NETGROUP);
 			    if ((yyval.member) == NULL) {
@@ -2887,11 +2890,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2885 "gram.c"
+#line 2888 "gram.c"
     break;
 
   case 141: /* user: USERGROUP  */
-#line 982 "gram.y"
+#line 985 "gram.y"
                                   {
 			    (yyval.member) = new_member((yyvsp[0].string), USERGROUP);
 			    if ((yyval.member) == NULL) {
@@ -2899,11 +2902,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2897 "gram.c"
+#line 2900 "gram.c"
     break;
 
   case 142: /* user: WORD  */
-#line 989 "gram.y"
+#line 992 "gram.y"
                              {
 			    (yyval.member) = new_member((yyvsp[0].string), WORD);
 			    if ((yyval.member) == NULL) {
@@ -2911,38 +2914,38 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2909 "gram.c"
+#line 2912 "gram.c"
     break;
 
   case 144: /* grouplist: grouplist ',' opgroup  */
-#line 999 "gram.y"
+#line 1002 "gram.y"
                                               {
 			    HLTQ_CONCAT((yyvsp[-2].member), (yyvsp[0].member), entries);
 			    (yyval.member) = (yyvsp[-2].member);
 			}
-#line 2918 "gram.c"
+#line 2921 "gram.c"
     break;
 
   case 145: /* opgroup: group  */
-#line 1005 "gram.y"
+#line 1008 "gram.y"
                               {
 			    (yyval.member) = (yyvsp[0].member);
 			    (yyval.member)->negated = false;
 			}
-#line 2927 "gram.c"
+#line 2930 "gram.c"
     break;
 
   case 146: /* opgroup: '!' group  */
-#line 1009 "gram.y"
+#line 1012 "gram.y"
                                   {
 			    (yyval.member) = (yyvsp[0].member);
 			    (yyval.member)->negated = true;
 			}
-#line 2936 "gram.c"
+#line 2939 "gram.c"
     break;
 
   case 147: /* group: ALIAS  */
-#line 1015 "gram.y"
+#line 1018 "gram.y"
                               {
 			    (yyval.member) = new_member((yyvsp[0].string), ALIAS);
 			    if ((yyval.member) == NULL) {
@@ -2950,11 +2953,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2948 "gram.c"
+#line 2951 "gram.c"
     break;
 
   case 148: /* group: ALL  */
-#line 1022 "gram.y"
+#line 1025 "gram.y"
                             {
 			    (yyval.member) = new_member(NULL, ALL);
 			    if ((yyval.member) == NULL) {
@@ -2962,11 +2965,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2960 "gram.c"
+#line 2963 "gram.c"
     break;
 
   case 149: /* group: WORD  */
-#line 1029 "gram.y"
+#line 1032 "gram.y"
                              {
 			    (yyval.member) = new_member((yyvsp[0].string), WORD);
 			    if ((yyval.member) == NULL) {
@@ -2974,11 +2977,11 @@ yyreduce:
 				YYERROR;
 			    }
 			}
-#line 2972 "gram.c"
+#line 2975 "gram.c"
     break;
 
 
-#line 2976 "gram.c"
+#line 2979 "gram.c"
 
       default: break;
     }
@@ -3172,7 +3175,7 @@ yyreturn:
   return yyresult;
 }
 
-#line 1037 "gram.y"
+#line 1040 "gram.y"
 
 /* Like yyerror() but takes a printf-style format string. */
 void
@@ -3243,6 +3246,7 @@ sudoerserrorf(const char *fmt, ...)
 void
 sudoerserror(const char *s)
 {
+    // -V:sudoerserror:575, 618
     if (s == NULL)
 	sudoerserrorf(NULL);
     else
diff --git a/plugins/sudoers/gram.h b/plugins/sudoers/gram.h
index 1827de81d..97c663862 100644
--- a/plugins/sudoers/gram.h
+++ b/plugins/sudoers/gram.h
@@ -167,7 +167,7 @@ extern int sudoersdebug;
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 union YYSTYPE
 {
-#line 80 "gram.y"
+#line 83 "gram.y"
 
     struct cmndspec *cmndspec;
     struct defaults *defaults;
diff --git a/plugins/sudoers/gram.y b/plugins/sudoers/gram.y
index 714d26eb5..d4dcf0d9b 100644
--- a/plugins/sudoers/gram.y
+++ b/plugins/sudoers/gram.y
@@ -45,6 +45,9 @@
 /* If we last saw a newline the entry is on the preceding line. */
 #define this_lineno	(sudoerschar == '\n' ? sudolineno - 1 : sudolineno)
 
+// PVS Studio suppression
+// -V::1037, 1042
+
 /*
  * Globals
  */
@@ -1104,6 +1107,7 @@ sudoerserrorf(const char *fmt, ...)
 void
 sudoerserror(const char *s)
 {
+    // -V:sudoerserror:575, 618
     if (s == NULL)
 	sudoerserrorf(NULL);
     else
diff --git a/plugins/sudoers/rcstr.c b/plugins/sudoers/rcstr.c
index 4426e094f..04233a385 100644
--- a/plugins/sudoers/rcstr.c
+++ b/plugins/sudoers/rcstr.c
@@ -66,7 +66,7 @@ rcstr_alloc(size_t len)
     rcs->refcnt = 1;
     rcs->str[0] = '\0';
     /* cppcheck-suppress memleak */
-    debug_return_ptr(rcs->str);
+    debug_return_ptr(rcs->str); // -V773
 }
 
 char *
diff --git a/plugins/sudoers/redblack.c b/plugins/sudoers/redblack.c
index 3c837b8ee..a7d023cd9 100644
--- a/plugins/sudoers/redblack.c
+++ b/plugins/sudoers/redblack.c
@@ -109,7 +109,7 @@ rbcreate(int (*compar)(const void *, const void*))
      * Similarly, the fake root node keeps us from having to worry
      * about splitting the root.
      */
-    tree->root.left = tree->root.right = tree->root.parent = &tree->nil;
+    tree->root.left = tree->root.right = tree->root.parent = &tree->nil; // -V778
     tree->root.color = black;
     tree->root.data = NULL;
 
diff --git a/plugins/sudoers/toke.c b/plugins/sudoers/toke.c
index 1e4d9bc44..366f805c0 100644
--- a/plugins/sudoers/toke.c
+++ b/plugins/sudoers/toke.c
@@ -2759,6 +2759,9 @@ char *sudoerstext;
 # define NAMLEN(dirent)	strlen((dirent)->d_name)
 #endif
 
+// PVS Studio suppression
+// -V::519, 1004, 1037
+
 int sudolineno;			/* current sudoers line number. */
 char *sudoers;			/* sudoers file being parsed. */
 struct sudolinebuf sudolinebuf;	/* sudoers line being parsed. */
@@ -2801,7 +2804,7 @@ int (*trace_print)(const char *msg) = sudoers_trace_print;
 
 
 
-#line 2799 "toke.c"
+#line 2802 "toke.c"
 
 #define INITIAL 0
 #define GOTDEFS 1
@@ -3021,9 +3024,9 @@ YY_DECL
 	}
 
 	{
-#line 114 "toke.l"
+#line 117 "toke.l"
 
-#line 3021 "toke.c"
+#line 3024 "toke.c"
 
 	while ( 1 )		/* loops until end-of-file is reached */
 		{
@@ -3083,7 +3086,7 @@ do_action:	/* This label is used only to access EOF actions. */
 
 case 1:
 YY_RULE_SETUP
-#line 115 "toke.l"
+#line 118 "toke.l"
 {
 			    LEXTRACE(", ");
 			    return ',';
@@ -3091,12 +3094,12 @@ YY_RULE_SETUP
 	YY_BREAK
 case 2:
 YY_RULE_SETUP
-#line 120 "toke.l"
+#line 123 "toke.l"
 BEGIN STARTDEFS;
 	YY_BREAK
 case 3:
 YY_RULE_SETUP
-#line 122 "toke.l"
+#line 125 "toke.l"
 {
 			    BEGIN INDEFS;
 			    LEXTRACE("DEFVAR ");
@@ -3108,7 +3111,7 @@ YY_RULE_SETUP
 
 case 4:
 YY_RULE_SETUP
-#line 131 "toke.l"
+#line 134 "toke.l"
 {
 			    BEGIN STARTDEFS;
 			    LEXTRACE(", ");
@@ -3117,7 +3120,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 5:
 YY_RULE_SETUP
-#line 137 "toke.l"
+#line 140 "toke.l"
 {
 			    LEXTRACE("= ");
 			    return '=';
@@ -3125,7 +3128,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 6:
 YY_RULE_SETUP
-#line 142 "toke.l"
+#line 145 "toke.l"
 {
 			    LEXTRACE("+= ");
 			    return '+';
@@ -3133,7 +3136,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 7:
 YY_RULE_SETUP
-#line 147 "toke.l"
+#line 150 "toke.l"
 {
 			    LEXTRACE("-= ");
 			    return '-';
@@ -3141,7 +3144,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 8:
 YY_RULE_SETUP
-#line 152 "toke.l"
+#line 155 "toke.l"
 {
 			    LEXTRACE("BEGINSTR ");
 			    sudoerslval.string = NULL;
@@ -3151,7 +3154,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 9:
 YY_RULE_SETUP
-#line 159 "toke.l"
+#line 162 "toke.l"
 {
 			    LEXTRACE("WORD(2) ");
 			    if (!fill(sudoerstext, sudoersleng))
@@ -3164,7 +3167,7 @@ YY_RULE_SETUP
 case 10:
 /* rule 10 can match eol */
 YY_RULE_SETUP
-#line 168 "toke.l"
+#line 171 "toke.l"
 {
 			    /* Line continuation char followed by newline. */
 			    sudolineno++;
@@ -3173,7 +3176,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 11:
 YY_RULE_SETUP
-#line 174 "toke.l"
+#line 177 "toke.l"
 {
 			    LEXTRACE("ENDSTR ");
 			    BEGIN prev_state;
@@ -3211,7 +3214,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 12:
 YY_RULE_SETUP
-#line 209 "toke.l"
+#line 212 "toke.l"
 {
 			    LEXTRACE("BACKSLASH ");
 			    if (!append(sudoerstext, sudoersleng))
@@ -3220,7 +3223,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 13:
 YY_RULE_SETUP
-#line 215 "toke.l"
+#line 218 "toke.l"
 {
 			    LEXTRACE("STRBODY ");
 			    if (!append(sudoerstext, sudoersleng))
@@ -3231,7 +3234,7 @@ YY_RULE_SETUP
 
 case 14:
 YY_RULE_SETUP
-#line 223 "toke.l"
+#line 226 "toke.l"
 {
 			    /* quoted fnmatch glob char, pass verbatim */
 			    LEXTRACE("QUOTEDCHAR ");
@@ -3242,7 +3245,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 15:
 YY_RULE_SETUP
-#line 231 "toke.l"
+#line 234 "toke.l"
 {
 			    /* quoted sudoers special char, strip backslash */
 			    LEXTRACE("QUOTEDCHAR ");
@@ -3254,7 +3257,7 @@ YY_RULE_SETUP
 case 16:
 /* rule 16 can match eol */
 YY_RULE_SETUP
-#line 239 "toke.l"
+#line 242 "toke.l"
 {
 			    BEGIN INITIAL;
 			    sudoersless(0);
@@ -3264,7 +3267,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 17:
 YY_RULE_SETUP
-#line 246 "toke.l"
+#line 249 "toke.l"
 {
 			    LEXTRACE("ARG ");
 			    if (!fill_args(sudoerstext, sudoersleng, sawspace))
@@ -3275,7 +3278,7 @@ YY_RULE_SETUP
 
 case 18:
 YY_RULE_SETUP
-#line 254 "toke.l"
+#line 257 "toke.l"
 {
 			    /* Only return DIGEST if the length is correct. */
 			    yy_size_t digest_len =
@@ -3293,7 +3296,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 19:
 YY_RULE_SETUP
-#line 269 "toke.l"
+#line 272 "toke.l"
 {
 			    /* Only return DIGEST if the length is correct. */
 			    yy_size_t len, digest_len =
@@ -3318,7 +3321,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 20:
 YY_RULE_SETUP
-#line 291 "toke.l"
+#line 294 "toke.l"
 {
 			    if (continued) {
 				sudoerserror(N_("invalid line continuation"));
@@ -3333,7 +3336,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 21:
 YY_RULE_SETUP
-#line 303 "toke.l"
+#line 306 "toke.l"
 {
 			    if (continued) {
 				sudoerserror(N_("invalid line continuation"));
@@ -3349,7 +3352,7 @@ YY_RULE_SETUP
 case 22:
 /* rule 22 can match eol */
 YY_RULE_SETUP
-#line 315 "toke.l"
+#line 318 "toke.l"
 {
 			    if (continued) {
 				sudoerserror(N_("invalid line continuation"));
@@ -3369,7 +3372,7 @@ YY_RULE_SETUP
 case 23:
 /* rule 23 can match eol */
 YY_RULE_SETUP
-#line 331 "toke.l"
+#line 334 "toke.l"
 {
 			    if (continued) {
 				sudoerserror(N_("invalid line continuation"));
@@ -3388,7 +3391,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 24:
 YY_RULE_SETUP
-#line 347 "toke.l"
+#line 350 "toke.l"
 {
 			    char deftype;
 			    int n;
@@ -3432,7 +3435,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 25:
 YY_RULE_SETUP
-#line 388 "toke.l"
+#line 391 "toke.l"
 {
 			    int n;
 
@@ -3462,7 +3465,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 26:
 YY_RULE_SETUP
-#line 415 "toke.l"
+#line 418 "toke.l"
 {
 				/* cmnd does not require passwd for this user */
 			    	LEXTRACE("NOPASSWD ");
@@ -3471,7 +3474,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 27:
 YY_RULE_SETUP
-#line 421 "toke.l"
+#line 424 "toke.l"
 {
 				/* cmnd requires passwd for this user */
 			    	LEXTRACE("PASSWD ");
@@ -3480,7 +3483,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 28:
 YY_RULE_SETUP
-#line 427 "toke.l"
+#line 430 "toke.l"
 {
 			    	LEXTRACE("NOEXEC ");
 			    	return NOEXEC;
@@ -3488,7 +3491,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 29:
 YY_RULE_SETUP
-#line 432 "toke.l"
+#line 435 "toke.l"
 {
 			    	LEXTRACE("EXEC ");
 			    	return EXEC;
@@ -3496,7 +3499,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 30:
 YY_RULE_SETUP
-#line 437 "toke.l"
+#line 440 "toke.l"
 {
 			    	LEXTRACE("SETENV ");
 			    	return SETENV;
@@ -3504,7 +3507,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 31:
 YY_RULE_SETUP
-#line 442 "toke.l"
+#line 445 "toke.l"
 {
 			    	LEXTRACE("NOSETENV ");
 			    	return NOSETENV;
@@ -3512,7 +3515,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 32:
 YY_RULE_SETUP
-#line 447 "toke.l"
+#line 450 "toke.l"
 {
 			    	LEXTRACE("LOG_OUTPUT ");
 			    	return LOG_OUTPUT;
@@ -3520,7 +3523,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 33:
 YY_RULE_SETUP
-#line 452 "toke.l"
+#line 455 "toke.l"
 {
 			    	LEXTRACE("NOLOG_OUTPUT ");
 			    	return NOLOG_OUTPUT;
@@ -3528,7 +3531,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 34:
 YY_RULE_SETUP
-#line 457 "toke.l"
+#line 460 "toke.l"
 {
 			    	LEXTRACE("LOG_INPUT ");
 			    	return LOG_INPUT;
@@ -3536,7 +3539,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 35:
 YY_RULE_SETUP
-#line 462 "toke.l"
+#line 465 "toke.l"
 {
 			    	LEXTRACE("NOLOG_INPUT ");
 			    	return NOLOG_INPUT;
@@ -3544,7 +3547,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 36:
 YY_RULE_SETUP
-#line 467 "toke.l"
+#line 470 "toke.l"
 {
 			    	LEXTRACE("MAIL ");
 			    	return MAIL;
@@ -3552,7 +3555,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 37:
 YY_RULE_SETUP
-#line 472 "toke.l"
+#line 475 "toke.l"
 {
 			    	LEXTRACE("NOMAIL ");
 			    	return NOMAIL;
@@ -3560,7 +3563,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 38:
 YY_RULE_SETUP
-#line 477 "toke.l"
+#line 480 "toke.l"
 {
 			    	LEXTRACE("FOLLOW ");
 			    	return FOLLOWLNK;
@@ -3568,7 +3571,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 39:
 YY_RULE_SETUP
-#line 482 "toke.l"
+#line 485 "toke.l"
 {
 			    	LEXTRACE("NOFOLLOW ");
 			    	return NOFOLLOWLNK;
@@ -3576,7 +3579,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 40:
 YY_RULE_SETUP
-#line 487 "toke.l"
+#line 490 "toke.l"
 {
 			    if (sudoerstext[0] == '+')
 				sudoerserror(N_("empty netgroup"));
@@ -3588,7 +3591,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 41:
 YY_RULE_SETUP
-#line 496 "toke.l"
+#line 499 "toke.l"
 {
 			    /* netgroup */
 			    if (!fill(sudoerstext, sudoersleng))
@@ -3599,7 +3602,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 42:
 YY_RULE_SETUP
-#line 504 "toke.l"
+#line 507 "toke.l"
 {
 			    /* group */
 			    if (!fill(sudoerstext, sudoersleng))
@@ -3610,7 +3613,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 43:
 YY_RULE_SETUP
-#line 512 "toke.l"
+#line 515 "toke.l"
 {
 			    if (!fill(sudoerstext, sudoersleng))
 				yyterminate();
@@ -3620,7 +3623,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 44:
 YY_RULE_SETUP
-#line 519 "toke.l"
+#line 522 "toke.l"
 {
 			    if (!fill(sudoerstext, sudoersleng))
 				yyterminate();
@@ -3630,7 +3633,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 45:
 YY_RULE_SETUP
-#line 526 "toke.l"
+#line 529 "toke.l"
 {
 			    if (!ipv6_valid(sudoerstext)) {
 				sudoerserror(N_("invalid IPv6 address"));
@@ -3645,7 +3648,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 46:
 YY_RULE_SETUP
-#line 538 "toke.l"
+#line 541 "toke.l"
 {
 			    if (!ipv6_valid(sudoerstext)) {
 				sudoerserror(N_("invalid IPv6 address"));
@@ -3660,7 +3663,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 47:
 YY_RULE_SETUP
-#line 550 "toke.l"
+#line 553 "toke.l"
 {
 			    LEXTRACE("ALL ");
 			    return ALL;
@@ -3669,7 +3672,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 48:
 YY_RULE_SETUP
-#line 556 "toke.l"
+#line 559 "toke.l"
 {
 			    LEXTRACE("CMND_TIMEOUT ");
 			    return CMND_TIMEOUT;
@@ -3677,7 +3680,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 49:
 YY_RULE_SETUP
-#line 561 "toke.l"
+#line 564 "toke.l"
 {
 			    LEXTRACE("NOTBEFORE ");
 			    return NOTBEFORE;
@@ -3685,7 +3688,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 50:
 YY_RULE_SETUP
-#line 566 "toke.l"
+#line 569 "toke.l"
 {
 			    LEXTRACE("NOTAFTER ");
 			    return NOTAFTER;
@@ -3693,7 +3696,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 51:
 YY_RULE_SETUP
-#line 571 "toke.l"
+#line 574 "toke.l"
 {
 			    LEXTRACE("CWD ");
 			    prev_state = YY_START;
@@ -3703,7 +3706,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 52:
 YY_RULE_SETUP
-#line 578 "toke.l"
+#line 581 "toke.l"
 {
 			    LEXTRACE("CHROOT ");
 			    prev_state = YY_START;
@@ -3713,7 +3716,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 53:
 YY_RULE_SETUP
-#line 585 "toke.l"
+#line 588 "toke.l"
 {
 #ifdef HAVE_SELINUX
 			    LEXTRACE("ROLE ");
@@ -3725,7 +3728,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 54:
 YY_RULE_SETUP
-#line 594 "toke.l"
+#line 597 "toke.l"
 {
 #ifdef HAVE_SELINUX
 			    LEXTRACE("TYPE ");
@@ -3737,7 +3740,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 55:
 YY_RULE_SETUP
-#line 602 "toke.l"
+#line 605 "toke.l"
 {
 #ifdef HAVE_PRIV_SET
 			    LEXTRACE("PRIVS ");
@@ -3749,7 +3752,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 56:
 YY_RULE_SETUP
-#line 611 "toke.l"
+#line 614 "toke.l"
 {
 #ifdef HAVE_PRIV_SET
 			    LEXTRACE("LIMITPRIVS ");
@@ -3761,7 +3764,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 57:
 YY_RULE_SETUP
-#line 620 "toke.l"
+#line 623 "toke.l"
 {
 			got_alias:
 			    if (!fill(sudoerstext, sudoersleng))
@@ -3772,7 +3775,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 58:
 YY_RULE_SETUP
-#line 628 "toke.l"
+#line 631 "toke.l"
 {
 			    /* XXX - no way to specify digest for command */
 			    /* no command args allowed for Defaults!/path */
@@ -3784,7 +3787,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 59:
 YY_RULE_SETUP
-#line 637 "toke.l"
+#line 640 "toke.l"
 {
 			    digest_type = SUDO_DIGEST_SHA224;
 			    BEGIN WANTDIGEST;
@@ -3794,7 +3797,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 60:
 YY_RULE_SETUP
-#line 644 "toke.l"
+#line 647 "toke.l"
 {
 			    digest_type = SUDO_DIGEST_SHA256;
 			    BEGIN WANTDIGEST;
@@ -3804,7 +3807,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 61:
 YY_RULE_SETUP
-#line 651 "toke.l"
+#line 654 "toke.l"
 {
 			    digest_type = SUDO_DIGEST_SHA384;
 			    BEGIN WANTDIGEST;
@@ -3814,7 +3817,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 62:
 YY_RULE_SETUP
-#line 658 "toke.l"
+#line 661 "toke.l"
 {
 			    digest_type = SUDO_DIGEST_SHA512;
 			    BEGIN WANTDIGEST;
@@ -3824,7 +3827,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 63:
 YY_RULE_SETUP
-#line 665 "toke.l"
+#line 668 "toke.l"
 {
 			    BEGIN GOTCMND;
 			    LEXTRACE("COMMAND ");
@@ -3834,7 +3837,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 64:
 YY_RULE_SETUP
-#line 672 "toke.l"
+#line 675 "toke.l"
 {
 				BEGIN prev_state;
 				if (!fill(sudoerstext, sudoersleng))
@@ -3845,7 +3848,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 65:
 YY_RULE_SETUP
-#line 680 "toke.l"
+#line 683 "toke.l"
 {
 			    /* directories can't have args... */
 			    if (sudoerstext[sudoersleng - 1] == '/') {
@@ -3862,7 +3865,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 66:
 YY_RULE_SETUP
-#line 694 "toke.l"
+#line 697 "toke.l"
 {
 			    LEXTRACE("BEGINSTR ");
 			    sudoerslval.string = NULL;
@@ -3872,7 +3875,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 67:
 YY_RULE_SETUP
-#line 701 "toke.l"
+#line 704 "toke.l"
 {
 			    /* a word */
 			    if (!fill(sudoerstext, sudoersleng))
@@ -3884,7 +3887,7 @@ YY_RULE_SETUP
 
 case 68:
 YY_RULE_SETUP
-#line 710 "toke.l"
+#line 713 "toke.l"
 {
 			    /* include file/directory */
 			    if (!fill(sudoerstext, sudoersleng))
@@ -3896,7 +3899,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 69:
 YY_RULE_SETUP
-#line 719 "toke.l"
+#line 722 "toke.l"
 {
 			    LEXTRACE("BEGINSTR ");
 			    sudoerslval.string = NULL;
@@ -3907,7 +3910,7 @@ YY_RULE_SETUP
 
 case 70:
 YY_RULE_SETUP
-#line 727 "toke.l"
+#line 730 "toke.l"
 {
 			    LEXTRACE("( ");
 			    return '(';
@@ -3915,7 +3918,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 71:
 YY_RULE_SETUP
-#line 732 "toke.l"
+#line 735 "toke.l"
 {
 			    LEXTRACE(") ");
 			    return ')';
@@ -3923,7 +3926,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 72:
 YY_RULE_SETUP
-#line 737 "toke.l"
+#line 740 "toke.l"
 {
 			    LEXTRACE(", ");
 			    return ',';
@@ -3931,7 +3934,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 73:
 YY_RULE_SETUP
-#line 742 "toke.l"
+#line 745 "toke.l"
 {
 			    LEXTRACE("= ");
 			    return '=';
@@ -3939,7 +3942,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 74:
 YY_RULE_SETUP
-#line 747 "toke.l"
+#line 750 "toke.l"
 {
 			    LEXTRACE(": ");
 			    return ':';
@@ -3947,7 +3950,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 75:
 YY_RULE_SETUP
-#line 752 "toke.l"
+#line 755 "toke.l"
 {
 			    if (sudoersleng & 1) {
 				LEXTRACE("!");
@@ -3958,7 +3961,7 @@ YY_RULE_SETUP
 case 76:
 /* rule 76 can match eol */
 YY_RULE_SETUP
-#line 759 "toke.l"
+#line 762 "toke.l"
 {
 			    if (YY_START == INSTR) {
 				/* re-scan after changing state */
@@ -3977,7 +3980,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 77:
 YY_RULE_SETUP
-#line 775 "toke.l"
+#line 778 "toke.l"
 {			/* throw away space/tabs */
 			    sawspace = true;	/* but remember for fill_args */
 			}
@@ -3985,7 +3988,7 @@ YY_RULE_SETUP
 case 78:
 /* rule 78 can match eol */
 YY_RULE_SETUP
-#line 779 "toke.l"
+#line 782 "toke.l"
 {
 			    sawspace = true;	/* remember for fill_args */
 			    sudolineno++;
@@ -3995,7 +3998,7 @@ YY_RULE_SETUP
 case 79:
 /* rule 79 can match eol */
 YY_RULE_SETUP
-#line 785 "toke.l"
+#line 788 "toke.l"
 {
 			    if (sudoerstext[sudoersleng - 1] == '\n') {
 				/* comment ending in a newline */
@@ -4013,7 +4016,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 80:
 YY_RULE_SETUP
-#line 800 "toke.l"
+#line 803 "toke.l"
 {
 			    LEXTRACE("NOMATCH ");
 			    return NOMATCH;
@@ -4028,7 +4031,7 @@ case YY_STATE_EOF(INSTR):
 case YY_STATE_EOF(WANTDIGEST):
 case YY_STATE_EOF(GOTINC):
 case YY_STATE_EOF(EXPECTPATH):
-#line 805 "toke.l"
+#line 808 "toke.l"
 {
 			    if (!pop_include())
 				yyterminate();
@@ -4036,10 +4039,10 @@ case YY_STATE_EOF(EXPECTPATH):
 	YY_BREAK
 case 81:
 YY_RULE_SETUP
-#line 810 "toke.l"
+#line 813 "toke.l"
 ECHO;
 	YY_BREAK
-#line 4037 "toke.c"
+#line 4040 "toke.c"
 
 	case YY_END_OF_BUFFER:
 		{
@@ -5000,7 +5003,7 @@ void sudoersfree (void * ptr )
 
 #define YYTABLES_NAME "yytables"
 
-#line 810 "toke.l"
+#line 813 "toke.l"
 
 
 struct path_list {
diff --git a/plugins/sudoers/toke.l b/plugins/sudoers/toke.l
index 5903dcdfc..cf5a7d40f 100644
--- a/plugins/sudoers/toke.l
+++ b/plugins/sudoers/toke.l
@@ -50,6 +50,9 @@
 # define NAMLEN(dirent)	strlen((dirent)->d_name)
 #endif
 
+// PVS Studio suppression
+// -V::519, 1004, 1037
+
 int sudolineno;			/* current sudoers line number. */
 char *sudoers;			/* sudoers file being parsed. */
 struct sudolinebuf sudolinebuf;	/* sudoers line being parsed. */
diff --git a/plugins/sudoers/toke_util.c b/plugins/sudoers/toke_util.c
index 22cad9e10..5307666eb 100644
--- a/plugins/sudoers/toke_util.c
+++ b/plugins/sudoers/toke_util.c
@@ -117,7 +117,7 @@ fill_cmnd(const char *src, size_t len)
     *dst = '\0';
 
     /* Check for sudoedit specified as a fully-qualified path. */
-    if ((dst = strrchr(sudoerslval.command.cmnd, '/')) != NULL) {
+    if ((dst = strrchr(sudoerslval.command.cmnd, '/')) != NULL) { // -V575
 	if (strcmp(dst, "/sudoedit") == 0) {
 	    if (sudoers_strict) {
 		sudoerserror(
diff --git a/plugins/sudoers/visudo.c b/plugins/sudoers/visudo.c
index e09297bb9..6fd3c8386 100644
--- a/plugins/sudoers/visudo.c
+++ b/plugins/sudoers/visudo.c
@@ -477,7 +477,7 @@ edit_sudoers(struct sudoersfile *sp, char *editor, int editor_argc,
     ac = editor_argc - 3;
     if (lineno > 0) {
 	(void)snprintf(linestr, sizeof(linestr), "+%d", lineno);
-	editor_argv[ac++] = linestr;
+	editor_argv[ac++] = linestr; // -V507
     }
     editor_argv[ac++] = "--";
     editor_argv[ac++] = sp->tpath;
diff --git a/src/exec_common.c b/src/exec_common.c
index 909d364ac..32834de08 100644
--- a/src/exec_common.c
+++ b/src/exec_common.c
@@ -99,7 +99,7 @@ preload_dso(char *envp[], const char *dso_file)
      * whether it was dynamically allocated. [TODO: plugin API]
      */
     if (preload_idx == -1 || !enabled) {
-	const int env_size = env_len + 1 + (preload_idx == -1) + enabled;
+	const int env_size = env_len + 1 + (preload_idx == -1) + enabled; // -V547
 
 	char **nenvp = reallocarray(NULL, env_size, sizeof(*envp));
 	if (nenvp == NULL)
diff --git a/src/sesh.c b/src/sesh.c
index 5f8f984b4..f8f465439 100644
--- a/src/sesh.c
+++ b/src/sesh.c
@@ -348,7 +348,7 @@ sesh_sudoedit(int argc, char *argv[])
     if (argv[2] != NULL && strcmp(argv[2], "-h") == 0) {
 	argv++;
 	argc--;
-	CLR(edit_flags, CD_SUDOEDIT_FOLLOW);
+	CLR(edit_flags, CD_SUDOEDIT_FOLLOW); // -V753
     }
 
     /* Check for -w flag (disallow directories writable by the user). */
@@ -399,7 +399,7 @@ sesh_sudoedit(int argc, char *argv[])
      */
     run_cred.uid = run_cred.euid = geteuid();
     run_cred.gid = run_cred.egid = getegid();
-    run_cred.ngroups = getgroups(0, NULL);
+    run_cred.ngroups = getgroups(0, NULL); // -V575
     if (run_cred.ngroups > 0) {
 	run_cred.groups = reallocarray(NULL, run_cred.ngroups,
 	    sizeof(GETGROUPS_T));
diff --git a/src/sudo.c b/src/sudo.c
index f2d8d666e..4c6c60e1e 100644
--- a/src/sudo.c
+++ b/src/sudo.c
@@ -434,7 +434,8 @@ get_user_groups(const char *user, struct sudo_cred *cred)
 	    maxgroups = NGROUPS_MAX;
 
 	/* Note that macOS may return ngroups > NGROUPS_MAX. */
-	if ((cred->ngroups = getgroups(0, NULL)) > 0) {
+	cred->ngroups = getgroups(0, NULL); // -V575
+	if (cred->ngroups > 0) {
 	    /* Use groups from kernel if not at limit or source is static. */
 	    if (cred->ngroups != maxgroups || group_source == GROUP_SOURCE_STATIC) {
 		cred->groups = reallocarray(NULL, cred->ngroups, sizeof(GETGROUPS_T));
diff --git a/src/sudo_edit.c b/src/sudo_edit.c
index e65808148..842eca307 100644
--- a/src/sudo_edit.c
+++ b/src/sudo_edit.c
@@ -81,7 +81,7 @@ set_tmpdir(struct sudo_cred *user_cred)
     saved_cred.euid = geteuid();
     saved_cred.gid = getgid();
     saved_cred.egid = getegid();
-    saved_cred.ngroups = getgroups(0, NULL);
+    saved_cred.ngroups = getgroups(0, NULL); // -V575
     if (saved_cred.ngroups > 0) {
 	saved_cred.groups =
 	    reallocarray(NULL, saved_cred.ngroups, sizeof(GETGROUPS_T));
@@ -216,7 +216,7 @@ sudo_edit_create_tfiles(struct command_details *command_details,
 	    continue;
 	}
 	tf[j].ofile = files[i];
-	tf[j].osize = sb.st_size;
+	tf[j].osize = sb.st_size; // -V614
 	mtim_get(&sb, tf[j].omtim);
 	sudo_debug_printf(SUDO_DEBUG_INFO|SUDO_DEBUG_LINENO,
 	    "seteuid(%u)", (unsigned int)user_details.cred.uid);