Define YYERROR_VERBOSE for bison and rename COMMENT -> '\n'

This results in better error messages when there is a parse error

plugins/sudoers/gram.h

@@ -29,24 +29,23 @@
 #define FOLLOWLNK 284
 #define NOFOLLOWLNK 285
 #define ALL 286
-#define COMMENT 287
+#define HOSTALIAS 287
-#define HOSTALIAS 288
+#define CMNDALIAS 288
-#define CMNDALIAS 289
+#define USERALIAS 289
-#define USERALIAS 290
+#define RUNASALIAS 290
-#define RUNASALIAS 291
+#define ERROR 291
-#define ERROR 292
+#define TYPE 292
-#define TYPE 293
+#define ROLE 293
-#define ROLE 294
+#define PRIVS 294
-#define PRIVS 295
+#define LIMITPRIVS 295
-#define LIMITPRIVS 296
+#define CMND_TIMEOUT 296
-#define CMND_TIMEOUT 297
+#define NOTBEFORE 297
-#define NOTBEFORE 298
+#define NOTAFTER 298
-#define NOTAFTER 299
+#define MYSELF 299
-#define MYSELF 300
+#define SHA224_TOK 300
-#define SHA224_TOK 301
+#define SHA256_TOK 301
-#define SHA256_TOK 302
+#define SHA384_TOK 302
-#define SHA384_TOK 303
+#define SHA512_TOK 303
-#define SHA512_TOK 304
 #ifndef YYSTYPE_DEFINED
 #define YYSTYPE_DEFINED
 typedef union {

plugins/sudoers/gram.y

@@ -38,8 +38,12 @@
 #include "sudo_digest.h"
 #include "toke.h"
 
+#ifdef YYBISON
+# define YYERROR_VERBOSE
+#endif
+
 /* If we last saw a newline the entry is on the preceding line. */
-#define this_lineno	(last_token == COMMENT ? sudolineno - 1 : sudolineno)
+#define this_lineno	(last_token == '\n' ? sudolineno - 1 : sudolineno)
 
 /*
  * Globals
@@ -66,6 +70,7 @@ static bool add_defaults(int, struct member *, struct defaults *);
 static bool add_userspec(struct member *, struct privilege *);
 static struct defaults *new_default(char *, char *, short);
 static struct member *new_member(char *, int);
+static struct sudo_command *new_command(char *, char *);
 static struct command_digest *new_digest(int, char *);
 %}
 
@@ -115,13 +120,13 @@ static struct command_digest *new_digest(int, char *);
 %token <tok>	 FOLLOWLNK		/* follow symbolic links */
 %token <tok>	 NOFOLLOWLNK		/* don't follow symbolic links */
 %token <tok>	 ALL			/* ALL keyword */
-%token <tok>	 COMMENT		/* comment and/or carriage return */
 %token <tok>	 HOSTALIAS		/* Host_Alias keyword */
 %token <tok>	 CMNDALIAS		/* Cmnd_Alias keyword */
 %token <tok>	 USERALIAS		/* User_Alias keyword */
 %token <tok>	 RUNASALIAS		/* Runas_Alias keyword */
 %token <tok>	 ':' '=' ',' '!' '+' '-' /* union member tokens */
 %token <tok>	 '(' ')'		/* runas tokens */
+%token <tok>	 '\n'			/* newline (with optional comment) */
 %token <tok>	 ERROR			/* error from lexer */
 %token <tok>	 TYPE			/* SELinux type */
 %token <tok>	 ROLE			/* SELinux role */
@@ -181,10 +186,10 @@ line		:	entry
 		|	line entry
 		;
 
-entry		:	COMMENT {
+entry		:	'\n' {
 			    ;
 			}
-                |       error COMMENT {
+                |       error '\n' {
 			    yyerrok;
 			}
 		|	include {
@@ -241,7 +246,7 @@ entry		:	COMMENT {
 			}
 		;
 
-include		:	INCLUDE WORD COMMENT {
+include		:	INCLUDE WORD '\n' {
 			    $$ = $2;
 			}
 		|	INCLUDE WORD END {
@@ -249,7 +254,7 @@ include		:	INCLUDE WORD COMMENT {
 			}
 		;
 
-includedir	:	INCLUDEDIR WORD COMMENT {
+includedir	:	INCLUDEDIR WORD '\n' {
 			    $$ = $2;
 			}
 		|	INCLUDEDIR WORD END {
@@ -1046,6 +1051,7 @@ new_member(char *name, int type)
 
     debug_return_ptr(m);
 }
+
 static struct sudo_command *
 new_command(char *cmnd, char *args)
 {

plugins/sudoers/toke.c

@@ -9,7 +9,7 @@
 
 #define  YY_INT_ALIGNED short int
 
-/*	$OpenBSD: flex.skl,v 1.16 2017/05/02 19:16:19 millert Exp $	*/
+/*	$OpenBSD: flex.skl,v 1.17 2020/08/06 17:23:29 deraadt Exp $	*/
 
 /* A lexical scanner generated by flex */
 
@@ -2458,11 +2458,13 @@ YY_DECL
 		if ( ! (yy_start) )
 			(yy_start) = 1;	/* first start state */
 
-		if ( ! sudoersin )
+		if ( ! sudoersin ) {
 			sudoersin = stdin;
+		}
 
-		if ( ! sudoersout )
+		if ( ! sudoersout ) {
 			sudoersout = stdout;
+		}
 
 		if ( ! YY_CURRENT_BUFFER ) {
 			sudoersensure_buffer_stack ();
@@ -2476,7 +2478,7 @@ YY_DECL
 	{
 #line 119 "toke.l"
 
-#line 2474 "toke.c"
+#line 2476 "toke.c"
 
 	while ( 1 )		/* loops until end-of-file is reached */
 		{
@@ -3392,7 +3394,7 @@ YY_RULE_SETUP
 			    sudolineno++;
 			    continued = false;
 			    LEXTRACE("\n");
-			    LEXRETURN(COMMENT);
+			    LEXRETURN('\n');
 			}			/* return newline */
 	YY_BREAK
 case 74:
@@ -3428,7 +3430,7 @@ YY_RULE_SETUP
 				LEXRETURN(ERROR);
 			    }
 			    LEXTRACE("#\n");
-			    LEXRETURN(COMMENT);
+			    LEXRETURN('\n');
 			}			/* comment, not uid/gid */
 	YY_BREAK
 case 77:
@@ -3463,7 +3465,7 @@ YY_RULE_SETUP
 #line 796 "toke.l"
 ECHO;
 	YY_BREAK
-#line 3461 "toke.c"
+#line 3463 "toke.c"
 
 	case YY_END_OF_BUFFER:
 		{

plugins/sudoers/toke.l

@@ -750,7 +750,7 @@ sudoedit		{
 			    sudolineno++;
 			    continued = false;
 			    LEXTRACE("\n");
-			    LEXRETURN(COMMENT);
+			    LEXRETURN('\n');
 			}			/* return newline */
 
 <*>[[:blank:]]+		{			/* throw away space/tabs */
@@ -775,7 +775,7 @@ sudoedit		{
 				LEXRETURN(ERROR);
 			    }
 			    LEXTRACE("#\n");
-			    LEXRETURN(COMMENT);
+			    LEXRETURN('\n');
 			}			/* comment, not uid/gid */
 
 <*>.			{