oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-08-19 08:38:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(apk): allow large installed db fields (#5100)

Browse Source 
Signed-off-by: cyphercodes <cyphercodes@users.noreply.github.com>
Co-authored-by: cyphercodes <cyphercodes@users.noreply.github.com>
This commit is contained in:
Rayan Salhab 2026-07-27 17:36:56 +03:00 committed by GitHub
parent 12b8ba47fb
commit 2dcf5163b8
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
syft/pkg/cataloger/alpine/parse_apk_db.go
View File

@ -32,12 +32,15 @@ type parsedData struct {
pkg.ApkDBEntry
}
const maxApkDBFieldSize = 10 * 1024 * 1024
// parseApkDB parses packages from a given APK "installed" flat-file DB. For more
// information on specific fields, see https://wiki.alpinelinux.org/wiki/Apk_spec.
//
//nolint:funlen
func parseApkDB(ctx context.Context, resolver file.Resolver, env *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
scanner := bufio.NewScanner(reader)
scanner.Buffer(nil, maxApkDBFieldSize)
var errs error
var apks []parsedData

19
syft/pkg/cataloger/alpine/parse_apk_db_test.go
View File

@ -719,6 +719,25 @@ func Test_processChecksum(t *testing.T) {
}
}
func TestParseApkDBAllowsLargeFieldValues(t *testing.T) {
contents := strings.Join([]string{
"P:large-description",
"V:1.0-r0",
"A:x86_64",
"S:1",
"I:1",
"T:" + strings.Repeat("a", 70*1024),
"",
}, "\n")
reader := file.NewLocationReadCloser(file.NewLocation("large-installed-db"), io.NopCloser(strings.NewReader(contents)))
pkgs, _, err := parseApkDB(context.Background(), nil, new(generic.Environment), reader)
require.NoError(t, err)
require.Len(t, pkgs, 1)
assert.Equal(t, "large-description", pkgs[0].Name)
}
func Test_parseApkDB_expectedPkgNames(t *testing.T) {
tests := []struct {
fixture string