Zero out sigaction_t before use in case it has non-standard entries.

logging.c

@@ -504,6 +504,7 @@ send_mail(line)
     closefrom(STDERR_FILENO + 1);
 
     /* Ignore SIGPIPE in case mailer exits prematurely (or is missing). */
+    zero_bytes(&sa, sizeof(sa));
     sigemptyset(&sa.sa_mask);
     sa.sa_flags = 0;
     sa.sa_handler = SIG_IGN;

mon_systrace.c

@@ -115,6 +115,7 @@ systrace_attach(pid)
     sigfillset(&set);
     if (sigprocmask(SIG_BLOCK, &set, &oset) != 0)
 	error(1, "sigprocmask");
+    zero_bytes(&sa, sizeof(sa));
     sigemptyset(&sa.sa_mask);
     sa.sa_flags = 0;
     sa.sa_handler = catchsig;
@@ -152,6 +153,7 @@ systrace_attach(pid)
 
     /* set signal state for tracer */
     dodetach = 0;
+    zero_bytes(&sa, sizeof(sa));
     sigemptyset(&sa.sa_mask);
     sa.sa_flags = 0;
     sa.sa_handler = catchsig;

parse.c

@@ -131,6 +131,7 @@ sudo_file_parse(nss)
  * Update the defaults based on what was set by sudoers.
  * If skip_cmnd is 1, skip DEFAULTS_CMND, if it is 0, skip all others.
  * Returns TRUE on success and FALSE on failure.
+ * XXX - move to defaults.c or match.c
  */
 int
 update_defaults(what)

sudo.c

@@ -202,6 +202,7 @@ main(argc, argv, envp)
      *  us at some point and avoid the logging.
      *  Install handler to wait for children when they exit.
      */
+    zero_bytes(&sa, sizeof(sa));
     sigemptyset(&sa.sa_mask);
     sa.sa_flags = SA_RESTART;
     sa.sa_handler = SIG_IGN;

sudo_edit.c

@@ -79,7 +79,6 @@ sudo_edit(argc, argv, envp)
     char **nargv, **ap, *editor, *cp;
     char buf[BUFSIZ];
     int error, i, ac, ofd, tfd, nargc, rval, tmplen, wasblank;
-    sigaction_t sa;
     struct stat sb;
     struct timespec ts1, ts2;
     struct tempfile {
@@ -218,9 +217,6 @@ sudo_edit(argc, argv, envp)
     nargv[ac] = NULL;
 
     /* Allow the editor to be suspended. */
-    sigemptyset(&sa.sa_mask);
-    sa.sa_flags = SA_RESTART;
-    sa.sa_handler = SIG_DFL;
     (void) sigaction(SIGTSTP, &saved_sa_tstp, NULL);
 
     /*

tgetpass.c

@@ -154,6 +154,7 @@ restart:
      * Catch signals that would otherwise cause the user to end
      * up with echo turned off in the shell.
      */
+    zero_bytes(&sa, sizeof(sa));
     sigemptyset(&sa.sa_mask);
     sa.sa_flags = SA_INTERRUPT;	/* don't restart system calls */
     sa.sa_handler = handler;
@@ -260,6 +261,7 @@ sudo_askpass(prompt)
     }
 
     /* Ignore SIGPIPE in case child exits prematurely */
+    zero_bytes(&sa, sizeof(sa));
     sigemptyset(&sa.sa_mask);
     sa.sa_flags = 0;
     sa.sa_handler = SIG_IGN;

visudo.c

@@ -637,6 +637,7 @@ setup_signals()
 	/*
 	 * Setup signal handlers to cleanup nicely.
 	 */
+	zero_bytes(&sa, sizeof(sa));
 	sigemptyset(&sa.sa_mask);
 	sa.sa_flags = SA_RESTART;
 	sa.sa_handler = quit;