fix panic parsing a rockspec comment that ends at EOF (#5053)

The hand-written rockspec parser reads a byte past the end of the buffer
in two spots when a comment runs right up to the end of the file.

In parseRockspecBlock, when a block starts with a leading comment that
consumes the rest of the file, the SkipWhitespace afterward leaves the
index at len(data) and the following `c = data[*i]` reads out of range.
In parseComment, `data[*i]` is read after the index is advanced to check
for a CR/LF pair, so a bare carriage return as the last byte reads past
the end.

Both cases show up with a rockspec whose final line is a comment ending
in a lone \r with no trailing newline. That is malformed but harmless
input, and the panic aborts the whole Lua cataloger, so every valid Lua
package in the same scan gets dropped. Guard both reads with a length
check and return cleanly at EOF. Added table cases covering a
comment-only file and a trailing comment, both ending in a bare CR.

Signed-off-by: arpitjain099 <arpitjain099@gmail.com>

syft/pkg/cataloger/lua/rockspec_parser.go

@@ -76,6 +76,9 @@ func parseRockspecBlock(data []byte, i *int, locals map[string]string) ([]rocksp
 	if c == '-' {
 		parseComment(data, i)
 		parsing.SkipWhitespace(data, i)
+		if *i >= len(data) {
+			return out, nil
+		}
 		c = data[*i]
 	}
 
@@ -424,7 +427,7 @@ func parseComment(data []byte, i *int) {
 		// Rest of a line is a comment. Deals with CR, LF and CR/LF
 		if c == '\n' {
 			break
-		} else if c == '\r' && data[*i] == '\n' {
+		} else if c == '\r' && *i < len(data) && data[*i] == '\n' {
 			*i++
 			break
 		}

syft/pkg/cataloger/lua/rockspec_parser_test.go

@@ -185,6 +185,14 @@ end
 test = "blah"
 `,
 		},
+		{
+			name:    "comment only ending in bare carriage return at EOF",
+			content: "--\r",
+		},
+		{
+			name:    "trailing comment ending in bare carriage return at EOF",
+			content: "foo = \"bar\"\n-- x\r",
+		},
 		{
 			name:    "invalid complex syntax",
 			wantErr: require.Error,