Dpkg::Deps: Make the dependency parser more strict

Do not allow obviously broken dependencies.

Closes: #784806

debian/changelog

@@ -74,6 +74,7 @@ dpkg (1.18.5) UNRELEASED; urgency=medium
       regex or a string match. Closes: #780906
       Base on a patch by Daniel Dehennin <daniel.dehennin@baby-gnu.org>.
     - Add new functions to validate and parse architecture names in Dpkg::Arch.
+    - Make the dependency parser more strict in Dpkg::Deps. Closes: #784806
   * Build system:
     - Fix building development documentation.
     - Remove unused UA_LIBS variable.

scripts/Dpkg/Deps.pm

@@ -602,18 +602,20 @@ sub parse_string {
               (?:                           # start of optional part
                 \s* \(                      # open parenthesis for version part
                 \s* (<<|<=|=|>=|>>|[<>])    # relation part
-                \s* (.*?)                   # do not attempt to parse version
+                \s* ([^\)]+)                # do not attempt to parse version
                 \s* \)                      # closing parenthesis
               )?                            # end of optional part
               (?:                           # start of optional architecture
                 \s* \[                      # open bracket for architecture
-                \s* (.*?)                   # don't parse architectures now
+                \s* ([^\]]+)                # don't parse architectures now
                 \s* \]                      # closing bracket
               )?                            # end of optional architecture
-              (?:                           # start of optional restriction
+              (
+                (?:                         # start of optional restriction
                 \s* <                       # open bracket for restriction
-                \s* (.*)                    # do not parse restrictions now
+                \s* [^>]+                   # do not parse restrictions now
                 \s* >                       # closing bracket
+                )+
               )?                            # end of optional restriction
               \s*$                          # trailing spaces at end
             }x;

scripts/t/Dpkg_Deps.t

@@ -16,7 +16,7 @@
 use strict;
 use warnings;
 
-use Test::More tests => 45;
+use Test::More tests => 47;
 
 use Dpkg::Arch qw(get_host_arch);
 use Dpkg::Version;
@@ -189,8 +189,16 @@ my $dep_empty2 = deps_parse(' , , ', union => 1);
 is($dep_empty2->output(), '', "' , , ' is also an empty dependency");
 
 $SIG{__WARN__} = sub {};
+
+my $dep_bad_version = deps_parse('package (= 1.0) (>= 2.0)');
+is($dep_bad_version, undef, 'Bogus repeated version restriction');
+
+my $dep_bad_arch = deps_parse('package [alpha] [amd64]');
+is($dep_bad_arch, undef, 'Bogus repeated arch restriction');
+
 my $dep_bad_multiline = deps_parse("a, foo\nbar, c");
 ok(!defined($dep_bad_multiline), 'invalid dependency split over multiple line');
+
 delete $SIG{__WARN__};
 
 my $dep_iter = deps_parse('a, b:armel, c | d:armhf, d:mips (>> 1.2)');