Bug#933729: dh_girepository: Parsing of the build-dependencies is really fragile

[Laurent Bigonville]

Package: gobject-introspection
Version: 1.58.3-2
Severity: important
File: /usr/bin/dh_girepository

Hello,

It seems that the parsing of the build-dependencies in dh_girepository
is really fragile.

# Get Build-Depends in an array
my @bdeps;
my $cur = 0;
open (my $control, "<", "debian/control") or error ("Cannot open debian/control");
while (<$control>) {
    chomp;
    s/\s+$//;
    if ($cur) {
        if (/^\s+(.*)$/) {
            push @bdeps, split ",",$1;
            if ($1 !~ /,$/) {
                $cur = 0;
            }
        } else {
            $cur = 0;
        }
    }
    if (/^Build-Depends:\s*(.*)$/) {
        push @bdeps, split ",",$1;
        if ($1 =~ /,$/) {
            $cur = 1;
        } else {
            $cur = 0;
        }
    }
}
close $control;

It's not escaping lines with comments and and stops the processing.

It also fails if the 1st build-dependency is not on the same line as the
Build-Depends field like:

Build-Depends:
 build-dep1,
 build-dep2

This is quite annoying as it can generate dependencies with incorrect minimal version.

Kind regards,

Laurent Bigonville

-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'unstable'), (1, 'experimental-debug'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-5-amd64 (SMP w/8 CPU cores)
Locale: LANG=fr_BE.UTF-8, LC_CTYPE=fr_BE.UTF-8 (charmap=UTF-8), LANGUAGE=fr_BE:fr (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages gobject-introspection depends on:
ii  build-essential        12.6
ii  libc6                  2.28-10
ii  libffi6                3.2.1-9
ii  libgirepository-1.0-1  1.58.3-2
ii  libglib2.0-0           2.60.6-1
ii  python3                3.7.3-1
ii  python3-distutils      3.7.4-3
ii  python3-mako           1.0.7+ds1-1
ii  python3-markdown       3.0.1-3

gobject-introspection recommends no packages.

gobject-introspection suggests no packages.

-- no debconf information