Language: C
Label: safe
CWE: NVD-CWE-noinfo \u2014 

Code:
user_matches(const struct sudoers_parse_tree *parse_tree,
    const struct passwd *pw, const struct member *m)
{
    const struct sudoers_context *ctx = parse_tree->ctx;
    const char *lhost = parse_tree->lhost ? parse_tree->lhost : ctx->runas.host;
    const char *shost = parse_tree->shost ? parse_tree->shost : ctx->runas.shost;
    int matched = UNSPEC;
    struct alias *a;
    debug_decl(user_matches, SUDOERS_DEBUG_MATCH);

    switch (m->type) {
	case ALL:
	    matched = m->negated ? DENY : ALLOW;
	    break;
	case NETGROUP:
	    if (netgr_matches(parse_tree->nss, m->name,
		def_netgroup_tuple ? lhost : NULL,
		def_netgroup_tuple ? shost : NULL, pw->pw_name))
		matched = m->negated ? DENY : ALLOW;
	    break;
	case USERGROUP:
	    if (usergr_matches(m->name, pw->pw_name, pw))
		matched = m->negated ? DENY : ALLOW;
	    break;
	case ALIAS:
	    if ((a = alias_get(parse_tree, m->name, USERALIAS)) != NULL) {
		/* XXX */
		const int rc = userlist_matches(parse_tree, pw, &a->members);
		if (SPECIFIED(rc)) {
		    if (m->negated) {
			matched = rc == ALLOW ? DENY : ALLOW;
		    } else {
			matched = rc;
		    }
		}
		alias_put(a);
		break;
	    }
	    FALLTHROUGH;
	case WORD:
	    if (userpw_matches(m->name, pw->pw_name, pw))
		matched = m->negated ? DENY : ALLOW;
	    break;
    }
    debug_return_int(matched);
}