mirror of
https://github.com/anchore/syft.git
synced 2026-10-30 22:12:28 +01:00
Alex Goodman
27655c2be0
a negative `MaxDepth` really was unbounded, and nothing noticed an archive nested inside a copy of itself. A zip quine at `-1` recursed until memory, disk or file descriptors ran out, running the full sub-pipeline at every level. - the walk keeps a stack of the digests of the archives it's inside, and an archive identical to one of them is recorded as an unknown instead of being entered - negative depth now stops at 16 levels (docs and CLI description updated) - cancellation is checked between candidates, so a cancelled scan stops walking instead of finishing the archive tree the three unknown-recording blocks in `processArchive` became a one-line helper to stay under `funlen`. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>