Language: C
Label: vulnerable
CWE: NVD-CWE-noinfo \u2014 

Code:
runas_grouplist_matches(const struct sudoers_parse_tree *parse_tree,
    const struct member_list *group_list, struct member **matching_group)
{
    const struct sudoers_context *ctx = parse_tree->ctx;
    int group_matched = UNSPEC;
    struct member *m;
    struct alias *a;
    debug_decl(runas_grouplist_matches, SUDOERS_DEBUG_MATCH);

    if (group_list != NULL) {
	TAILQ_FOREACH_REVERSE(m, group_list, member_list, entries) {
	    switch (m->type) {
		case ALL:
		    group_matched = m->negated ? DENY : ALLOW;
		    break;
		case ALIAS:
		    a = alias_get(parse_tree, m->name, RUNASALIAS);
		    if (a != NULL) {
			const int rc = runas_grouplist_matches(parse_tree,
			    &a->members, matching_group);
			if (rc != UNSPEC) {
			    if (m->negated) {
				group_matched = rc == ALLOW ? DENY : ALLOW;
			    } else {
				group_matched = rc;
			    }
			}
			alias_put(a);
			break;
		    }
		    FALLTHROUGH;
		case WORD:
		    if (group_matches(m->name, ctx->runas.gr))
			group_matched = m->negated ? DENY : ALLOW;
		    break;
	    }
	    if (group_matched != UNSPEC) {
		if (matching_group != NULL && m->type != ALIAS)
		    *matching_group = m;
		break;
	    }
	}
    }
    if (group_matched == UNSPEC) {
	struct gid_list *runas_groups;
	/*
	 * The runas group was not explicitly allowed by sudoers.
	 * Check whether it is one of the target user's groups.
	 */
	if (ctx->runas.pw->pw_gid == ctx->runas.gr->gr_gid) {
	    group_matched = ALLOW;	/* runas group matches passwd db */
	} else if ((runas_groups = runas_getgroups(ctx)) != NULL) {
	    int i;

	    for (i = 0; i < runas_groups->ngids; i++) {
		if (runas_groups->gids[i] == ctx->runas.gr->gr_gid) {
		    group_matched = ALLOW;	/* matched aux group vector */
		    break;
		}
	    }
	    sudo_gidlist_delref(runas_groups);
	}
    }

    debug_return_int(group_matched);
}