Bug 544

Created attachment 333 [details]
patch

I'm running:
FreeBSD lap 9.0-BETA1 FreeBSD 9.0-BETA1 #0: Thu Jul 28 17:15:31 UTC 2011     root@farrell.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  amd64

sudo crashes when running without controlling terminal

Issue is already known - reported here:
http://lists.freebsd.org/pipermail/freebsd-current/2012-March/032420.html

How to reproduce:
$ ssh f@localhost "sudo"
sudo: (malloc) /usr/src/lib/libc/stdlib/malloc.c:2636: Failed assertion: "(run->regs_mask[elm] & (1U << bit)) == 0"

it fails because get_process_ttyname ereallocs() already efreed() buffer:

struct kinfo_proc *ki_proc = NULL;
for (i = 0; tty == NULL && i < 2; i++) {
... 
  ki_proc = erealloc(ki_proc, ....);
...

  efree(ki_proc);
}

I have no idea if this can be used to escalate privileges (probably not, but...), so to be safe I checked "security" severity to increase chances that you will look into this sooner. Sorry if this was wrong.