oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-05 17:06:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(debian): bound the decompressed members of a .deb archive (#5293)

Browse Source
This commit is contained in:
Alex Goodman
2026-09-14 18:17:56 -04:00
committed by GitHub
parent 2be26a1af9
commit b4ee6e4696
7 changed files with 498 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
syft/pkg/cataloger/debian/package.go
+10 -2
View File
@@ -202,7 +202,11 @@ func getAdditionalFileListing(resolver file.Resolver, dbLocation file.Location,
if md5Reader != nil && md5Location != nil {
defer internal.CloseAndLogError(md5Reader, md5Location.AccessPath)
// attach the file list
files = append(files, parseDpkgMD5Info(md5Reader)...)
records, err := parseDpkgMD5Info(md5Reader)
if err != nil {
log.Debugf("dpkg md5sums file %q: %v", md5Location.RealPath, err)
}
files = append(files, records...)
// keep a record of the file where this was discovered
locations = append(locations, *md5Location)
@@ -213,7 +217,11 @@ func getAdditionalFileListing(resolver file.Resolver, dbLocation file.Location,
if conffilesReader != nil && conffilesLocation != nil {
defer internal.CloseAndLogError(conffilesReader, conffilesLocation.AccessPath)
// attach the file list
files = append(files, parseDpkgConffileInfo(conffilesReader)...)
records, err := parseDpkgConffileInfo(conffilesReader)
if err != nil {
log.Debugf("dpkg conffiles file %q: %v", conffilesLocation.RealPath, err)
}
files = append(files, records...)
// keep a record of the file where this was discovered
locations = append(locations, *conffilesLocation)