From c8bf59104285cc26a716e8e7aa20ae2bb474167e Mon Sep 17 00:00:00 2001
From: "Todd C. Miller" <Todd.Miller@sudo.ws>
Date: Thu, 10 Feb 2022 16:09:44 -0700
Subject: [PATCH] Clear sudoers_errstr after it is used. This way we avoid
 printing the same error message more than once if there are multiple ERROR
 tokens returned from the lexer.

---
 plugins/sudoers/gram.c | 11 +++++++----
 plugins/sudoers/gram.y | 11 +++++++----
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/plugins/sudoers/gram.c b/plugins/sudoers/gram.c
index 7b6044fd0..66bccad86 100644
--- a/plugins/sudoers/gram.c
+++ b/plugins/sudoers/gram.c
@@ -3344,10 +3344,7 @@ sudoerserrorf(const char *fmt, ...)
 	    sudoers_setlocale(SUDOERS_LOCALE_USER, &oldlocale);
 
 	    va_start(ap, fmt);
-	    if (sudoerschar == ERROR) {
-		/* Use error string from lexer. */
-		s = _(sudoers_errstr);
-	    } else if (strcmp(fmt, "%s") == 0) {
+	    if (strcmp(fmt, "%s") == 0) {
 		/* Optimize common case, a single string. */
 		s = _(va_arg(ap, char *));
 	    } else {
@@ -3389,6 +3386,12 @@ sudoerserrorf(const char *fmt, ...)
 void
 sudoerserror(const char *s)
 {
+    if (sudoerschar == ERROR) {
+	/* Use error string from lexer. */
+	s = sudoers_errstr;
+	sudoers_errstr = NULL;
+    }
+
     // -V:sudoerserror:575, 618
     if (s == NULL)
 	sudoerserrorf(NULL);
diff --git a/plugins/sudoers/gram.y b/plugins/sudoers/gram.y
index 6a4d8fa22..63bb5adff 100644
--- a/plugins/sudoers/gram.y
+++ b/plugins/sudoers/gram.y
@@ -1188,10 +1188,7 @@ sudoerserrorf(const char *fmt, ...)
 	    sudoers_setlocale(SUDOERS_LOCALE_USER, &oldlocale);
 
 	    va_start(ap, fmt);
-	    if (sudoerschar == ERROR) {
-		/* Use error string from lexer. */
-		s = _(sudoers_errstr);
-	    } else if (strcmp(fmt, "%s") == 0) {
+	    if (strcmp(fmt, "%s") == 0) {
 		/* Optimize common case, a single string. */
 		s = _(va_arg(ap, char *));
 	    } else {
@@ -1233,6 +1230,12 @@ sudoerserrorf(const char *fmt, ...)
 void
 sudoerserror(const char *s)
 {
+    if (sudoerschar == ERROR) {
+	/* Use error string from lexer. */
+	s = sudoers_errstr;
+	sudoers_errstr = NULL;
+    }
+
     // -V:sudoerserror:575, 618
     if (s == NULL)
 	sudoerserrorf(NULL);