From b290a445ca65cd4f29b197fb5f2d14970239df89 Mon Sep 17 00:00:00 2001
From: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>
Date: Wed, 23 Nov 2022 17:33:18 -0500
Subject: [PATCH] fix: remove cabal.project.freeze panic on last pkg (#1363)

---
 syft/pkg/cataloger/haskell/parse_cabal_freeze.go          | 8 ++++++++
 .../cataloger/haskell/test-fixtures/cabal.project.freeze  | 4 ++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/syft/pkg/cataloger/haskell/parse_cabal_freeze.go b/syft/pkg/cataloger/haskell/parse_cabal_freeze.go
index b3e9c9c80..80631b61a 100644
--- a/syft/pkg/cataloger/haskell/parse_cabal_freeze.go
+++ b/syft/pkg/cataloger/haskell/parse_cabal_freeze.go
@@ -34,6 +34,14 @@ func parseCabalFreeze(_ source.FileResolver, _ *generic.Environment, reader sour
 
 		line = strings.TrimSpace(line)
 		startPkgEncoding, endPkgEncoding := strings.Index(line, "any.")+4, strings.Index(line, ",")
+		// case where comma not found for last package in constraint list
+		if endPkgEncoding == -1 {
+			endPkgEncoding = len(line)
+		}
+		if startPkgEncoding >= endPkgEncoding || startPkgEncoding < 0 {
+			continue
+		}
+
 		line = line[startPkgEncoding:endPkgEncoding]
 		fields := strings.Split(line, " ==")
 
diff --git a/syft/pkg/cataloger/haskell/test-fixtures/cabal.project.freeze b/syft/pkg/cataloger/haskell/test-fixtures/cabal.project.freeze
index 5c2cb9ac9..f20ce8cb5 100644
--- a/syft/pkg/cataloger/haskell/test-fixtures/cabal.project.freeze
+++ b/syft/pkg/cataloger/haskell/test-fixtures/cabal.project.freeze
@@ -12,6 +12,6 @@ constraints: any.Cabal ==3.2.1.0,
              any.RSA ==2.4.1,
              any.SHA ==1.6.4.4,
              void -safe,
-             any.Spock ==0.14.0.0,
-             
+             any.Spock ==0.14.0.0
+
 index-state: hackage.haskell.org 2022-07-07T01:01:53Z