Language: C
Label: safe
CWE: NVD-CWE-noinfo \u2014 

Code:
host_matches(const struct sudoers_parse_tree *parse_tree,
    const struct passwd *pw, const char *lhost, const char *shost,
    const struct member *m)
{
    struct alias *a;
    int matched = UNSPEC;
    debug_decl(host_matches, SUDOERS_DEBUG_MATCH);

    switch (m->type) {
	case ALL:
	    matched = m->negated ? DENY : ALLOW;
	    break;
	case NETGROUP:
	    if (netgr_matches(parse_tree->nss, m->name, lhost, shost,
		def_netgroup_tuple ? pw->pw_name : NULL))
		matched = m->negated ? DENY : ALLOW;
	    break;
	case NTWKADDR:
	    if (addr_matches(m->name))
		matched = m->negated ? DENY : ALLOW;
	    break;
	case ALIAS:
	    a = alias_get(parse_tree, m->name, HOSTALIAS);
	    if (a != NULL) {
		/* XXX */
		const int rc = hostlist_matches_int(parse_tree, pw, lhost,
		    shost, &a->members);
		if (SPECIFIED(rc)) {
		    if (m->negated) {
			matched = rc == ALLOW ? DENY : ALLOW;
		    } else {
			matched = rc;
		    }
		}
		alias_put(a);
		break;
	    }
	    FALLTHROUGH;
	case WORD:
	    if (hostname_matches(shost, lhost, m->name))
		matched = m->negated ? DENY : ALLOW;
	    break;
    }
    sudo_debug_printf(SUDO_DEBUG_DEBUG,
	"host %s (%s) matches sudoers host %s%s: %s", lhost, shost,
	m->negated ? "!" : "", m->name ? m->name : "ALL",
	matched == true ? "true" : "false");
    debug_return_int(matched);
}