diff --git a/syft/pkg/cataloger/lua/rockspec_parser.go b/syft/pkg/cataloger/lua/rockspec_parser.go
index 56c9a87f2..be8630293 100644
--- a/syft/pkg/cataloger/lua/rockspec_parser.go
+++ b/syft/pkg/cataloger/lua/rockspec_parser.go
@@ -76,6 +76,9 @@ func parseRockspecBlock(data []byte, i *int, locals map[string]string) ([]rocksp
 	if c == '-' {
 		parseComment(data, i)
 		parsing.SkipWhitespace(data, i)
+		if *i >= len(data) {
+			return out, nil
+		}
 		c = data[*i]
 	}
 
@@ -424,7 +427,7 @@ func parseComment(data []byte, i *int) {
 		// Rest of a line is a comment. Deals with CR, LF and CR/LF
 		if c == '\n' {
 			break
-		} else if c == '\r' && data[*i] == '\n' {
+		} else if c == '\r' && *i < len(data) && data[*i] == '\n' {
 			*i++
 			break
 		}
diff --git a/syft/pkg/cataloger/lua/rockspec_parser_test.go b/syft/pkg/cataloger/lua/rockspec_parser_test.go
index 0914d2695..aca545e00 100644
--- a/syft/pkg/cataloger/lua/rockspec_parser_test.go
+++ b/syft/pkg/cataloger/lua/rockspec_parser_test.go
@@ -185,6 +185,14 @@ end
 test = "blah"
 `,
 		},
+		{
+			name:    "comment only ending in bare carriage return at EOF",
+			content: "--\r",
+		},
+		{
+			name:    "trailing comment ending in bare carriage return at EOF",
+			content: "foo = \"bar\"\n-- x\r",
+		},
 		{
 			name:    "invalid complex syntax",
 			wantErr: require.Error,