From 7745e450fad93ba0986d5e1b06bea5ff7c2d26e7 Mon Sep 17 00:00:00 2001 From: Arpit Jain <3242828+arpitjain099@users.noreply.github.com> Date: Mon, 13 Jul 2026 23:45:12 +0900 Subject: [PATCH] fix panic parsing a rockspec comment that ends at EOF (#5053) The hand-written rockspec parser reads a byte past the end of the buffer in two spots when a comment runs right up to the end of the file. In parseRockspecBlock, when a block starts with a leading comment that consumes the rest of the file, the SkipWhitespace afterward leaves the index at len(data) and the following `c = data[*i]` reads out of range. In parseComment, `data[*i]` is read after the index is advanced to check for a CR/LF pair, so a bare carriage return as the last byte reads past the end. Both cases show up with a rockspec whose final line is a comment ending in a lone \r with no trailing newline. That is malformed but harmless input, and the panic aborts the whole Lua cataloger, so every valid Lua package in the same scan gets dropped. Guard both reads with a length check and return cleanly at EOF. Added table cases covering a comment-only file and a trailing comment, both ending in a bare CR. Signed-off-by: arpitjain099 --- syft/pkg/cataloger/lua/rockspec_parser.go | 5 ++++- syft/pkg/cataloger/lua/rockspec_parser_test.go | 8 ++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/syft/pkg/cataloger/lua/rockspec_parser.go b/syft/pkg/cataloger/lua/rockspec_parser.go index 56c9a87f2..be8630293 100644 --- a/syft/pkg/cataloger/lua/rockspec_parser.go +++ b/syft/pkg/cataloger/lua/rockspec_parser.go @@ -76,6 +76,9 @@ func parseRockspecBlock(data []byte, i *int, locals map[string]string) ([]rocksp if c == '-' { parseComment(data, i) parsing.SkipWhitespace(data, i) + if *i >= len(data) { + return out, nil + } c = data[*i] } @@ -424,7 +427,7 @@ func parseComment(data []byte, i *int) { // Rest of a line is a comment. Deals with CR, LF and CR/LF if c == '\n' { break - } else if c == '\r' && data[*i] == '\n' { + } else if c == '\r' && *i < len(data) && data[*i] == '\n' { *i++ break } diff --git a/syft/pkg/cataloger/lua/rockspec_parser_test.go b/syft/pkg/cataloger/lua/rockspec_parser_test.go index 0914d2695..aca545e00 100644 --- a/syft/pkg/cataloger/lua/rockspec_parser_test.go +++ b/syft/pkg/cataloger/lua/rockspec_parser_test.go @@ -185,6 +185,14 @@ end test = "blah" `, }, + { + name: "comment only ending in bare carriage return at EOF", + content: "--\r", + }, + { + name: "trailing comment ending in bare carriage return at EOF", + content: "foo = \"bar\"\n-- x\r", + }, { name: "invalid complex syntax", wantErr: require.Error,