fix(packages): bound Alpine metadata entries (#39026)

modules/packages/alpine/metadata_test.go

@@ -8,6 +8,7 @@ import (
 	"bytes"
 	"compress/gzip"
 	"io"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -97,6 +98,15 @@ func TestParsePackage(t *testing.T) {
 
 		assert.Equal(t, "Q1SRYURM5+uQDqfHSwTnNIOIuuDVQ=", p.FileMetadata.Checksum)
 	})
+
+	t.Run("TooManyDependencyEntries", func(t *testing.T) {
+		data := append(createPKGINFOContent(packageName, packageVersion), []byte("\ndepend = item")...)
+		data = append(data, []byte(strings.Repeat("\ndepend = item", maxPackageInfoEntries))...)
+
+		p, err := ParsePackageInfo(bytes.NewReader(data))
+		assert.Nil(t, p)
+		assert.ErrorIs(t, err, ErrPackageInfoTooLarge)
+	})
 }
 
 func TestParsePackageInfo(t *testing.T) {