mirror of
https://github.com/anchore/syft.git
synced 2026-08-20 17:18:30 +02:00
cd57b0704e
Four rules covering the bug classes behind a batch of parser hardening work: allocations sized from a header field, decompression with no ceiling, bounds checks that wrap on unsigned operands, and reads that report end-of-file as success. This currently fails with 19 findings, all triaged. Every real one has a fix in flight on a sibling branch, so this should land last. Suppressions are deliberately left out for now. Several sites keep firing once correctly fixed, mostly because the decompression rule flags a constructor and cannot see the limit applied on the next line. That is a reason to refine the rule rather than bulk-add nolints. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>