Increase max token size for APK index scan.

pkg/apk/apkindex.go

@@ -97,6 +97,10 @@ func ParsePackageIndex(apkIndexUnpacked io.Reader) ([]*Package, error) {
 
 	indexScanner := bufio.NewScanner(apkIndexUnpacked)
 
+	// Increase max token size from default of 64 KiB to account for large dependency lists.
+	maxTokenSize := 1 << 20 // 1 MiB
+	indexScanner.Buffer(make([]byte, maxTokenSize), maxTokenSize)
+
 	pkg := &Package{}
 	linenr := 1
 

pkg/apk/apkindex_test.go

@@ -243,3 +243,60 @@ func TestEmptyRepeatedFields(t *testing.T) {
 	require.Len(t, pkg.Provides, 0, "Expected no provides")
 	require.Len(t, pkg.Dependencies, 0, "Expected no dependencies")
 }
+
+func TestLargeDependencyList(t *testing.T) {
+	assert := assert.New(t)
+
+	apkIndexContents := heredoc.Doc(`
+		C:Q1Pi7+Lp0TdU9DNxeZKvFbOSjmncw=
+		P:a-pkg
+		V:1.2.3-r1
+		A:x86_64
+		S:9180
+		I:40960
+		T:A sample package
+		U:http://a.package.org
+		L:Apache-2.0
+		o:a-pkg
+		m:maintainer <maint@iner.org>
+		t:1600096848
+		c:af13bd168c9d86ede4ad1be5c4ceac79253a7e26
+		D:LARGE_DEPENDENCY_LIST
+		p:LARGE_PROVIDE_LIST
+		i:abc xyz
+		k:9001
+
+		C:Q1Pi7+Lp0TdU9DNxeZKvFbOSjmncw=
+		P:b-pkg
+		V:1.1.1-r1
+		A:x86_64
+		S:5243
+		I:11392
+		T:Another package
+		U:http://b.package.org
+		L:Apache-2.0
+		o:b-pkg
+		m:maintainer <maint@iner.org>
+		t:1600096848
+		c:af13bd168c9d86ede4ad1be5c4ceac79253a7e26
+		D:so:libc.musl-x86_64.so.1
+		p:thing3 thing4
+		i:def uvw
+		k:9002
+
+	`)
+
+	apkIndexContents = strings.ReplaceAll(
+		apkIndexContents, "LARGE_DEPENDENCY_LIST", strings.Repeat("fake-dependency ", 10_000))
+	apkIndexContents = strings.ReplaceAll(
+		apkIndexContents, "LARGE_PROVIDE_LIST", strings.Repeat("fake-provide ", 10_000))
+
+	apkIndexFile := strings.NewReader(apkIndexContents)
+
+	packages, _ := ParsePackageIndex(io.NopCloser(apkIndexFile))
+
+	require.Len(t, packages, 2, "Expected exactly 2 package")
+
+	assert.Equal("a-pkg", packages[0].Name)
+	assert.Equal("b-pkg", packages[1].Name)
+}

pkg/apk/installed.go

@@ -239,6 +239,10 @@ func ParseInstalled(installed io.Reader) ([]*InstalledPackage, error) { //nolint
 
 	indexScanner := bufio.NewScanner(installed)
 
+	// Increase max token size from default of 64 KiB to account for large dependency lists.
+	maxTokenSize := 1 << 20 // 1 MiB
+	indexScanner.Buffer(make([]byte, maxTokenSize), maxTokenSize)
+
 	pkg := &InstalledPackage{}
 	linenr := 1
 	var lastDir, lastFile *tar.Header

pkg/apk/installed_test.go

@@ -39,6 +39,7 @@ var testInstalledPackages = []*Package{
 	{Name: "alpine-baselayout", Version: "3.2.0-r22"},
 	{Name: "alpine-keys", Version: "2.4-r1"},
 	{Name: "ca-certificates-bundle", Version: "20220614-r0"},
+	{Name: "coq", Version: "8.19.1-r3"},
 	{Name: "libcrypto1.1", Version: "1.1.1q-r0"},
 	{Name: "libssl1.1", Version: "1.1.1q-r0"},
 	{Name: "ssl_client", Version: "1.35.0-r17"},