Hi,

I think I see a possibility of writing outside of array bounds in sudo.c:disable_execute.

The code looks like:

    for (ev = details->envp; *ev != NULL; ev++) {
        if (env_len + 2 > env_size) {
            env_size += 128;
            nenvp = erealloc3(nenvp, env_size, sizeof(char *));
        }

        /* some code removed */

        nenvp[env_len++] = *ev;
    }

    /* some code removed */

    nenvp[env_len++] = cp;
    nenvp[env_len] = NULL;

There is a possibility that env_len + 2 == env_size, so array is not increased and three elements get added.