do_syslog_sudo, do_logfile_sudo: escape control chars in submituser

[iefa-m]

new_logline escapes control characters in every field it formats, but the submit user is not one of them: do_logfile_sudo prepends it with asprintf and do_syslog_sudo hands it to syslog, both unescaped. In the sudoers plugin that name comes from the password database, while sudo_logsrvd fills it from the submituser key of a client AcceptMessage and never inspects the bytes, so on a log server it is whatever the client decided to send. A submituser containing a newline ends the record early and starts a second, well-formed one, so with log_format at its default of sudo a client sending "nobody\nJan 1 00:00:00 : root : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/sh" gets an entry for a root shell that never ran, written straight into the event log file or passed on to syslog. Every other field on that line is already escaped, which leaves the submit user as the one way to break out of it. sudoreplay gets the identical prefix right: list_session builds "date : user : " through sudo_lbuf_append_esc with LBUF_ESC_CNTRL. Both callers now escape the same way, so a newline comes out as #12 like the rest of the line and ordinary user names are unchanged. send_mail is left alone because EVLOG_MAIL is only set by the sudoers plugin, where the name comes from getpwuid.

[millert]

Thanks for this. Most of the logging code dates from before logsrvd was written and it shows.