From fa6ea7b10cc0a0acc2d935cfcabee2d76ebc5704 Mon Sep 17 00:00:00 2001 From: Alex Goodman Date: Tue, 29 Sep 2026 10:25:30 -0400 Subject: [PATCH] test(debian): bound the bomb fixture by ratio, not a fixed 1MB (#5350) go1.27's compress/flate encodes 512MB of zeros to ~1MB (1052690 bytes) where go1.26 gives ~510KB, so the fixture sanity check tripped on newer toolchains before the bound was ever exercised. The decompression bound itself is fine (bounded read allocates ~300KB on both). Signed-off-by: Alex Goodman --- syft/pkg/cataloger/debian/parse_deb_archive_test.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/syft/pkg/cataloger/debian/parse_deb_archive_test.go b/syft/pkg/cataloger/debian/parse_deb_archive_test.go index 7afa0a455..ad8c00ddf 100644 --- a/syft/pkg/cataloger/debian/parse_deb_archive_test.go +++ b/syft/pkg/cataloger/debian/parse_deb_archive_test.go @@ -375,7 +375,7 @@ func Test_processDataTar_capsCopyrightFiles(t *testing.T) { func Test_decompressionStream_failsEarlyInsteadOfBuffering(t *testing.T) { const expanded = 512 * intFile.MB - // a few KB of input expanding to 512MB, so heap is what separates a streaming bound from a + // well under 1% of input expanding to 512MB, so heap is what separates a streaming bound from a // bound checked after the read completes var gz bytes.Buffer gw := gzip.NewWriter(&gz) @@ -386,7 +386,9 @@ func Test_decompressionStream_failsEarlyInsteadOfBuffering(t *testing.T) { remaining -= int64(n) } require.NoError(t, gw.Close()) - require.Less(t, gz.Len(), 1024*1024, "compressed payload should be tiny relative to what it expands to") + // a ratio rather than a fixed size: deflate output for zeros is toolchain dependent (about 510KB on + // go1.26, about 1MB on go1.27), and only the ratio matters to the test + require.Less(t, gz.Len(), expanded/100, "compressed payload should be tiny relative to what it expands to") // both arms use io.ReadAll on purpose. The stream itself never holds much whatever the cap says, // so copying to io.Discard measures nothing; what the cap actually protects is a consumer that