mirror of
https://github.com/anchore/syft.git
synced 2026-11-03 07:56:36 +01:00
Arpit Jain
12b8ba47fb
parseErlangString advances past a backslash escape and then checks len(data) >= *i before reading the escaped byte. That condition is almost always true (it only turns false once *i runs off the end), so the intended out-of-range guard fires on the very first escape character it sees instead of only at EOF. Any rebar.lock or OTP resource file containing a backslash in a quoted string (a Windows git path, an escaped quote, anything) fails to parse and the whole file, and every package in it, gets dropped. Flip the comparison to *i >= len(data) so the guard only trips when the escape is genuinely truncated, and add a regression test for a string with an escaped quote. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>