[PATCH 2/2] test: add regression test for an empty .deb control member

Crafts a .deb whose control.tar holds a zero-length ./control member and
checks that apt-cache show reports it as an ordinary "no Package: header"
parse error instead of reading past the control buffer. Aborts under ASan
without the preceding GetContent guard.
---
 .../test-github-empty-deb-control-oob         | 28 +++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100755 test/integration/test-github-empty-deb-control-oob

diff --git a/test/integration/test-github-empty-deb-control-oob b/test/integration/test-github-empty-deb-control-oob
new file mode 100755
index 0000000..04797e4
--- /dev/null
+++ b/test/integration/test-github-empty-deb-control-oob
@@ -0,0 +1,28 @@
+#!/bin/sh
+set -e
+
+TESTDIR="$(readlink -f "$(dirname "$0")")"
+. "$TESTDIR/framework"
+setupenvironment
+configarchitecture "amd64"
+
+# A .deb whose control.tar holds a zero-length ./control member used to crash:
+# debDebPkgFileIndex::GetContent() trims trailing newlines and then scans
+# forward over the control buffer assuming a NUL terminator. For an empty
+# control member the buffer is only 2 bytes (both appended '\n') with no
+# terminator, so the forward whitespace skip and the following stream
+# insertion read past the allocation (heap-buffer-overflow read under ASan).
+# It must be reported as an ordinary "no Package: header" parse error instead.
+
+msgtest 'Build a .deb with an' 'empty control member'
+mkdir -p empty-control empty-data
+: > empty-control/control
+: > empty-data/x
+tar --format=gnu -C empty-control -cf control.tar ./control
+tar --format=gnu -C empty-data -cf data.tar ./x
+gzip -n control.tar data.tar
+echo '2.0' > debian-binary
+if ar -qc empty-control.deb debian-binary control.tar.gz data.tar.gz 2>/dev/null; then msgpass; else msgfail; fi
+
+testfailure aptcache show ./empty-control.deb
+testsuccess grep '^E: Encountered a section with no Package: header$' rootdir/tmp/testfailure.output
-- 
2.53.0