sudoreplay: write output records larger than the I/O buffer

[iefa-m]

write_output() advances to the next timing record as soon as the 64KB I/O buffer is drained (off == len), without checking whether the current record still has bytes left to read (iobuf.toread). A record whose byte count is larger than the buffer is truncated to 65536 bytes, and because get_timing_record() then runs with the data file positioned in the middle of the record, every following record is read from the wrong offset and replays as garbage. sudo caps each locally logged record at the 64KB I/O buffer, but sudo_logsrvd writes one record per client IoBuffer, so a log collected from a client that sends a buffer larger than 64KB hits this.

Reset the buffer and reschedule the output event to finish the current record before moving on to the next timing entry. Keeping the check next to the existing off == len handling leaves the common case where a record fits in the buffer unchanged.

Reproduced with a session whose ttyout record is 100000 bytes: before, sudoreplay writes 65536 bytes and drops the remaining 34464 (and a following record then reads from the wrong offset); after, all 100000 bytes replay. A record of exactly 65536 bytes and smaller records are unaffected.

[millert]

Thanks, sudo won't currently create an I/O buffer larger than 64KiB, but sudoreplay should be able to handle it if that changes.