oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-12 06:07:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

test(snap): bound the kernel changelog bomb fixture by ratio, not a fixed 1MB (#5352)

Browse Source 
Same issue as #5350: go1.27's compress/flate encodes this 512MB fixture to just over 1MB, so the fixture sanity check tripped before the bound was exercised. The line bound itself is fine.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
This commit is contained in:
Alex Goodman
2026-09-29 11:19:17 -04:00
committed by GitHub
parent fa6ea7b10c
commit 236ab25393
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
syft/pkg/cataloger/snap/parse_kernel_changelog_test.go
+3 -1
View File
@@ -330,7 +330,9 @@ func TestParseKernelChangelog_gzipBombStaysBounded(t *testing.T) {
remaining -= n
}
require.NoError(t, gw.Close())
require.Less(t, gz.Len(), 1024*1024, "compressed payload should be tiny relative to what it expands to")
// compress/flate output for this input varies by Go version (about 510KB on go1.26, 1MB on go1.27), so
// bound the fixture by ratio rather than a fixed size
require.Less(t, gz.Len(), expanded/100, "compressed payload should be tiny relative to what it expands to")
// prove the fixture is a bomb: the same stream read without a line bound costs its full size
unbounded := testutils.MeasureAlloc(t, func() {