mirror of
https://github.com/anchore/syft.git
synced 2026-08-19 16:48:27 +02:00
7745e450fa
The hand-written rockspec parser reads a byte past the end of the buffer in two spots when a comment runs right up to the end of the file. In parseRockspecBlock, when a block starts with a leading comment that consumes the rest of the file, the SkipWhitespace afterward leaves the index at len(data) and the following `c = data[*i]` reads out of range. In parseComment, `data[*i]` is read after the index is advanced to check for a CR/LF pair, so a bare carriage return as the last byte reads past the end. Both cases show up with a rockspec whose final line is a comment ending in a lone \r with no trailing newline. That is malformed but harmless input, and the panic aborts the whole Lua cataloger, so every valid Lua package in the same scan gets dropped. Guard both reads with a length check and return cleanly at EOF. Added table cases covering a comment-only file and a trailing comment, both ending in a bare CR. Signed-off-by: arpitjain099 <arpitjain099@gmail.com>