From 295767f214a3875e7a35eb838b18484fc0612e06 Mon Sep 17 00:00:00 2001 From: iefa m Date: Wed, 14 Oct 2026 14:13:17 +0530 Subject: [PATCH] sudoreplay: write output records larger than the I/O buffer write_output() moved on to the next timing record as soon as the 64KB I/O buffer was drained, without checking whether the current record still had bytes left to read. A record whose size exceeds the buffer was truncated and the rest of the session was then read from the wrong offset. Reset the buffer and finish the record before advancing. --- plugins/sudoers/sudoreplay.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/plugins/sudoers/sudoreplay.c b/plugins/sudoers/sudoreplay.c index 91c64399ee..e3f71f042b 100644 --- a/plugins/sudoers/sudoreplay.c +++ b/plugins/sudoers/sudoreplay.c @@ -1162,6 +1162,17 @@ write_output(int fd, int what, void *v) } if (iobuf->off == iobuf->len) { + if (iobuf->toread != 0) { + /* + * Record is larger than the I/O buffer, reset the buffer and + * reschedule to write the rest of the record before advancing. + */ + iobuf->off = 0; + iobuf->len = 0; + if (sudo_ev_add(NULL, closure->output_ev, NULL, false) == -1) + sudo_fatal("%s", U_("unable to add event to queue")); + debug_return; + } /* Write complete, go to next timing entry if possible. */ switch (get_timing_record(closure)) { case 0: