Skip to content

fix(lua-rockspec): handle empty and whitespace-only rockspec files gracefully#4827

Merged
kzantow merged 1 commit into
anchore:mainfrom
aki1770-del:fix/lua-rockspec-empty-file
Apr 24, 2026
Merged

fix(lua-rockspec): handle empty and whitespace-only rockspec files gracefully#4827
kzantow merged 1 commit into
anchore:mainfrom
aki1770-del:fix/lua-rockspec-empty-file

Conversation

@aki1770-del
Copy link
Copy Markdown
Contributor

Closes #4824.

Problem

Scanning a container image that contains an empty .rockspec file causes syft to panic with runtime error: index out of range [0] with length 0.

The bug is in parseRockspecBlock at syft/pkg/cataloger/lua/rockspec_parser.go:66:

if *i >= len(data) && len(out) > 0 {
    return nil, fmt.Errorf("unexpected end of block at %d", *i)
}
c := data[*i]

The guard condition requires len(out) > 0 — for an empty file, out is empty and data is empty, so the guard falls through to c := data[0], which panics.

Fix

Split the guard so empty input returns gracefully:

if *i >= len(data) {
    if len(out) > 0 {
        return nil, fmt.Errorf("unexpected end of block at %d", *i)
    }
    return out, nil
}
c := data[*i]

Preserves the existing "unexpected end of block" error for partial content; returns an empty block cleanly for empty or whitespace-only input.

Tests

Added two cases to rockspec_parser_test.go: empty file and whitespace only — both expect no error and empty result.

…acefully

Empty or whitespace-only .rockspec files cause parseRockspecBlock to
panic with "index out of range" because the existing end-of-data guard
requires len(out) > 0 before returning the "unexpected end of block"
error, letting the bare data[*i] access on the next line crash.

Split the guard so that:
  - partial content at end of data still returns the existing error
  - empty data (or whitespace-only) returns an empty block cleanly

Closes anchore#4824.

Co-Authored-By: Claude and aki1770-del <aki1770@gmail.com>
Signed-off-by: Akihiko Komada <aki1770@gmail.com>
@kzantow kzantow merged commit 3562dab into anchore:main Apr 24, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

empty rockspec causes index out of range

2 participants