Don't free the private copy of the environment until the close function.

We may need to use it when logging from the audit reject function.

plugins/sudoers/sudoers.c

@@ -756,16 +756,16 @@ bad:
     ret = false;
 
 done:
-    /* Store settings to pass back to front-end. */
-    if (ret != -1) {
+    if (ret == -1) {
+	/* Free stashed copy of the environment. */
+	(void)env_init(NULL);
+    } else {
+	/* Store settings to pass back to front-end. */
 	if (!sudoers_policy_store_result(ret, NewArgv, env_get(), cmnd_umask,
 		iolog_path, closure))
 	    ret = -1;
     }
 
-    /* Zero out stashed copy of environment, it is owned by the front-end. */
-    (void)env_init(NULL);
-
     if (!rewind_perms())
 	ret = -1;