[Ar-maan05]

With an invalid regex in the command arguments, visudo -c says everything is fine:

$ cat bad.sudoers
root ALL = /bin/ls ^[a-z$
root ALL = /bin/cat ^foo(bar$
$ visudo -c -s -f bad.sudoers
bad.sudoers: parsed OK

The same mistake in a command path regex (^/bin/[a-z$) is caught, so it's only the argument case that slips through.

The strict-mode check in the GOTREGEX $ rule compiles sudoerstext, which at that point is just the $ that was matched, so it always passes. The full expression has already been collected in sudoerslval.command.args by fill_args(), so this compiles that instead. toke.c gets the same one-line edit rather than a full regeneration.

After the fix:

$ visudo -c -s -f bad.sudoers
bad.sudoers:1:25: Unmatched [, [^, [:, [., or [=
root ALL = /bin/ls ^[a-z$
                        ^
bad.sudoers:2:29: Unmatched ( or \(
root ALL = /bin/cat ^foo(bar$
                            ^

Valid argument regexes (/bin/ls ^[a-z]+$) still parse OK, and make -C plugins/sudoers check passes.

[millert]

Nice catch, thanks!