f864d0
diff -up ./plugins/sudoers/editor.c.cve ./plugins/sudoers/editor.c
f864d0
--- ./plugins/sudoers/editor.c.cve	2023-01-16 17:52:37.074066664 +0100
f864d0
+++ ./plugins/sudoers/editor.c	2023-01-16 17:58:06.603774304 +0100
f864d0
@@ -132,7 +132,7 @@ resolve_editor(const char *ed, size_t ed
f864d0
     const char *cp, *ep, *tmp;
f864d0
     const char *edend = ed + edlen;
f864d0
     struct stat user_editor_sb;
f864d0
-    int nargc;
f864d0
+    int nargc = 0;
f864d0
     debug_decl(resolve_editor, SUDOERS_DEBUG_UTIL)
f864d0
 
f864d0
     /*
f864d0
@@ -149,9 +149,7 @@ resolve_editor(const char *ed, size_t ed
f864d0
 
f864d0
     /* If we can't find the editor in the user's PATH, give up. */
f864d0
     if (find_path(editor, &editor_path, &user_editor_sb, getenv("PATH"), 0, allowlist) != FOUND) {
f864d0
-	free(editor);
f864d0
-	errno = ENOENT;
f864d0
-	debug_return_str(NULL);
f864d0
+        goto bad;
f864d0
     }
f864d0
 
f864d0
     /* Count rest of arguments and allocate editor argv. */
f864d0
@@ -171,7 +169,19 @@ resolve_editor(const char *ed, size_t ed
f864d0
 	nargv[nargc] = copy_arg(cp, ep - cp);
f864d0
 	if (nargv[nargc] == NULL)
f864d0
 	    goto oom;
f864d0
+
f864d0
+	/*
f864d0
+	 * We use "--" to separate the editor and arguments from the files
f864d0
+	 * to edit.  The editor arguments themselves may not contain "--".
f864d0
+	 */
f864d0
+	if (strcmp(nargv[nargc], "--") == 0) {
f864d0
+	    sudo_warnx(U_("ignoring editor: %.*s"), (int)edlen, ed);
f864d0
+	    sudo_warnx("%s", U_("editor arguments may not contain \"--\""));
f864d0
+	    errno = EINVAL;
f864d0
+	    goto bad;
f864d0
+	}
f864d0
     }
f864d0
+
f864d0
     if (nfiles != 0) {
f864d0
 	nargv[nargc++] = "--";
f864d0
 	while (nfiles--)
f864d0
@@ -184,6 +194,7 @@ resolve_editor(const char *ed, size_t ed
f864d0
     debug_return_str(editor_path);
f864d0
 oom:
f864d0
     sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
f864d0
+bad:
f864d0
     free(editor);
f864d0
     free(editor_path);
f864d0
     if (nargv != NULL) {
f864d0
diff -up ./plugins/sudoers/sudoers.c.cve ./plugins/sudoers/sudoers.c
f864d0
--- ./plugins/sudoers/sudoers.c.cve	2023-01-16 17:52:37.074066664 +0100
f864d0
+++ ./plugins/sudoers/sudoers.c	2023-01-16 18:02:43.928307505 +0100
f864d0
@@ -634,21 +634,32 @@ sudoers_policy_main(int argc, char * con
f864d0
 
f864d0
     /* Note: must call audit before uid change. */
f864d0
     if (ISSET(sudo_mode, MODE_EDIT)) {
f864d0
-	int edit_argc;
f864d0
-	const char *env_editor;
f864d0
+        const char *env_editor = NULL;
f864d0
+        int edit_argc;
f864d0
 
f864d0
 	free(safe_cmnd);
f864d0
 	safe_cmnd = find_editor(NewArgc - 1, NewArgv + 1, &edit_argc,
f864d0
 	    &edit_argv, NULL, &env_editor, false);
f864d0
 	if (safe_cmnd == NULL) {
f864d0
-	    if (errno != ENOENT)
f864d0
-		goto done;
f864d0
-	    audit_failure(NewArgc, NewArgv, N_("%s: command not found"),
f864d0
-		env_editor ? env_editor : def_editor);
f864d0
-	    sudo_warnx(U_("%s: command not found"),
f864d0
-		env_editor ? env_editor : def_editor);
f864d0
-	    goto bad;
f864d0
-	}
f864d0
+        switch (errno) {
f864d0
+            case ENOENT:
f864d0
+                audit_failure(NewArgc, NewArgv, N_("%s: command not found"),
f864d0
+                              env_editor ? env_editor : def_editor);
f864d0
+                sudo_warnx(U_("%s: command not found"),
f864d0
+                           env_editor ? env_editor : def_editor);
f864d0
+                goto bad;
f864d0
+            case EINVAL:
f864d0
+                if (def_env_editor && env_editor != NULL) {
f864d0
+                    /* User tried to do something funny with the editor. */
f864d0
+                    log_warningx(SLOG_NO_STDERR|SLOG_SEND_MAIL,
f864d0
+                                 "invalid user-specified editor: %s", env_editor);
f864d0
+                    goto bad;
f864d0
+                }
f864d0
+            default:
f864d0
+                goto done;
f864d0
+        }
f864d0
+    }
f864d0
+
f864d0
 	if (audit_success(edit_argc, edit_argv) != 0 && !def_ignore_audit_errors)
f864d0
 	    goto done;
f864d0
 
f864d0
diff -up ./plugins/sudoers/visudo.c.cve ./plugins/sudoers/visudo.c
f864d0
--- ./plugins/sudoers/visudo.c.cve	2019-10-28 13:28:54.000000000 +0100
f864d0
+++ ./plugins/sudoers/visudo.c	2023-01-16 18:03:48.713975354 +0100
f864d0
@@ -308,7 +308,7 @@ static char *
f864d0
 get_editor(int *editor_argc, char ***editor_argv)
f864d0
 {
f864d0
     char *editor_path = NULL, **whitelist = NULL;
f864d0
-    const char *env_editor;
f864d0
+    const char *env_editor = NULL;
f864d0
     static char *files[] = { "+1", "sudoers" };
f864d0
     unsigned int whitelist_len = 0;
f864d0
     debug_decl(get_editor, SUDOERS_DEBUG_UTIL)
f864d0
@@ -342,7 +342,11 @@ get_editor(int *editor_argc, char ***edi
f864d0
     if (editor_path == NULL) {
f864d0
 	if (def_env_editor && env_editor != NULL) {
f864d0
 	    /* We are honoring $EDITOR so this is a fatal error. */
f864d0
-	    sudo_fatalx(U_("specified editor (%s) doesn't exist"), env_editor);
f864d0
+	    if (errno == ENOENT) {
f864d0
+		sudo_warnx(U_("specified editor (%s) doesn't exist"),
f864d0
+		    env_editor);
f864d0
+	    }
f864d0
+	    exit(EXIT_FAILURE);
f864d0
 	}
f864d0
 	sudo_fatalx(U_("no editor found (editor path = %s)"), def_editor);
f864d0
     }