Avoid a clang analyzer false positive.

plugins/sudoers/auth/sudo_auth.c

@@ -295,7 +295,7 @@ verify_user(struct passwd *pw, char *prompt, int validated,
 	    if (success != AUTH_FAILURE)
 		break;
 	}
-	if (!standalone) {
+	if (pass != NULL) {
 	    memset_s(pass, SUDO_CONV_REPL_MAX, 0, strlen(pass));
 	    free(pass);
 	}

plugins/sudoers/ldap.c

@@ -1453,6 +1453,11 @@ sudo_netgroup_lookup_nested(LDAP *ld, char *base, struct timeval *timeout,
 			    ldap_value_free_len(bv);
 			    goto oom;
 			}
+#ifdef __clang_analyzer__
+			/* clang analyzer false positive */
+			if (__builtin_expect(netgroups->stqh_last == NULL, 0))
+			    __builtin_trap();
+#endif
 			STAILQ_INSERT_TAIL(netgroups, ng, entries);
 			DPRINTF1("Found new netgroup %s for %s", ng->name, base);
 		    }