x/vuln: govulncheck seg faults when used against project using 1.22.0

[elambert]

We have a go project that we build using go1.21.6. We've been using govulncheck to check the project for vulnerabilities.

Today, we upgraded from 1.21.6 to 1.22.0. Now when we run govulncheck we see a stack trace.

% govulncheck -version
Go: go1.22.0
Scanner: govulncheck@v1.0.4
DB: https://vuln.go.dev
DB updated: 2024-02-07 04:19:28 +0000 UTC

No vulnerabilities found.
% govulncheck ./...
Scanning your code and 608 packages across 118 dependent modules for known vulnerabilities...

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x28 pc=0x10115154c]

goroutine 9467 [running]:
golang.org/x/tools/go/ssa.memberFromObject(0x1403764dc00, {0x0, 0x0?}, {0x1013282a0, 0x1401ac69500}, {0x0, 0x0})
	/Users/lambere/go/pkg/mod/golang.org/x/tools@v0.17.0/go/ssa/create.go:55 +0x3c
golang.org/x/tools/go/ssa.membersFromDecl(0x1403764dc00, {0x101329798?, 0x1401ac69500?}, {0x0, 0x0})
	/Users/lambere/go/pkg/mod/golang.org/x/tools@v0.17.0/go/ssa/create.go:184 +0xf4
golang.org/x/tools/go/ssa.(*Program).CreatePackage(0x140108b1380, 0x1401ac6c900, {0x140193f8cb0, 0x1, 0x1}, 0x1401aaee230, 0x1)
	/Users/lambere/go/pkg/mod/golang.org/x/tools@v0.17.0/go/ssa/create.go:250 +0x7e8
golang.org/x/vuln/internal/vulncheck.buildSSA.func1(0x0?)
	/Users/lambere/go/pkg/mod/golang.org/x/vuln@v1.0.4/internal/vulncheck/utils.go:38 +0xc0
golang.org/x/vuln/internal/vulncheck.buildSSA({0x140004f0600, 0x59, 0x14001380798?}, 0x14000158740)
	/Users/lambere/go/pkg/mod/golang.org/x/vuln@v1.0.4/internal/vulncheck/utils.go:46 +0x268
golang.org/x/vuln/internal/vulncheck.source.func1()
	/Users/lambere/go/pkg/mod/golang.org/x/vuln@v1.0.4/internal/vulncheck/source.go:54 +0x88
created by golang.org/x/vuln/internal/vulncheck.source in goroutine 35
	/Users/lambere/go/pkg/mod/golang.org/x/vuln@v1.0.4/internal/vulncheck/source.go:52 +0x204

If i down grade the project back to 1.21.6, govuln works as expected

% govulncheck -version
Go: go1.21.6
Scanner: govulncheck@v1.0.4
DB: https://vuln.go.dev
DB updated: 2024-02-07 04:19:28 +0000 UTC

No vulnerabilities found.
% govulncheck ./...
Scanning your code and 605 packages across 118 dependent modules for known vulnerabilities...

No vulnerabilities found.

Go version details

% go version
go version go1.22.0 darwin/arm64

[Zxilly]

Try clone https://github.com/golang/vuln, bump the version of golang.org/x/tools to v0.17.1-0.20240207215834-5fcc6273f47e then rebuild it.

[elambert]

Thanks for looking into this.

Still seeing a seg fault

% ../vuln/cmd/govulncheck/govulncheck ./...
Scanning your code and 608 packages across 118 dependent modules for known vulnerabilities...

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x28 pc=0x102c9d78c]

goroutine 9482 [running]:
golang.org/x/tools/go/ssa.memberFromObject(0x14034b5ca80, {0x0, 0x0?}, {0x102e74300, 0x14016daaf90}, {0x0, 0x0})
	/Users/lambere/go/pkg/mod/golang.org/x/tools@v0.17.1-0.20240207215834-5fcc6273f47e/go/ssa/create.go:55 +0x3c
golang.org/x/tools/go/ssa.membersFromDecl(0x14034b5ca80, {0x102e75820?, 0x14016daaf90?}, {0x0, 0x0})
	/Users/lambere/go/pkg/mod/golang.org/x/tools@v0.17.1-0.20240207215834-5fcc6273f47e/go/ssa/create.go:184 +0xf4
golang.org/x/tools/go/ssa.(*Program).CreatePackage(0x14008fa5c70, 0x14016da9f20, {0x140165f8960, 0x1, 0x1}, 0x14016dc2320, 0x1)
	/Users/lambere/go/pkg/mod/golang.org/x/tools@v0.17.1-0.20240207215834-5fcc6273f47e/go/ssa/create.go:250 +0x7e8
golang.org/x/vuln/internal/vulncheck.buildSSA.func1(0x1400018aa20?)
	/Users/lambere/git/vuln/internal/vulncheck/utils.go:38 +0xc0
golang.org/x/vuln/internal/vulncheck.buildSSA({0x14028bee000, 0x59, 0x0?}, 0x1400007e940)
	/Users/lambere/git/vuln/internal/vulncheck/utils.go:46 +0x268
golang.org/x/vuln/internal/vulncheck.source.func1()
	/Users/lambere/git/vuln/internal/vulncheck/source.go:54 +0x88
created by golang.org/x/vuln/internal/vulncheck.source in goroutine 6
	/Users/lambere/git/vuln/internal/vulncheck/source.go:52 +0x204
% ../vuln/cmd/govulncheck/govulncheck -version
Go: go1.22.0
Scanner: govulncheck@v0.0.0-5507063454b1-20240206192649
DB: https://vuln.go.dev
DB updated: 2024-02-07 04:19:28 +0000 UTC

% git rev-parse HEAD
5507063454b1b8c930db99818a88b52f1f143418
% git diff
diff --git a/go.mod b/go.mod
index 1e785be..a712287 100644
--- a/go.mod
+++ b/go.mod
@@ -7,7 +7,7 @@ require (
        github.com/google/go-cmp v0.5.8
        golang.org/x/mod v0.14.0
        golang.org/x/sync v0.6.0
-       golang.org/x/tools v0.17.0
+       golang.org/x/tools v0.17.1-0.20240207215834-5fcc6273f47e
        mvdan.cc/unparam v0.0.0-20230312165513-e84e2d14e3b8
 )

diff --git a/go.sum b/go.sum
index 815313c..869e3d1 100644
--- a/go.sum
+++ b/go.sum
@@ -9,7 +9,7 @@ golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
 golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/tools v0.17.0 h1:FvmRgNOcs3kOa+T20R1uhfP9F6HgG2mfxDv1vrx1Htc=
-golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
+golang.org/x/tools v0.17.1-0.20240207215834-5fcc6273f47e h1:08FJDFVdwBsn3UF8mUh+vR3DphhU2WWxblaXSioh32o=
+golang.org/x/tools v0.17.1-0.20240207215834-5fcc6273f47e/go.mod h1:ngPhXSzq5toGRGmVELsotoOaTqvj1Ojf/H79cbjAGfw=
 mvdan.cc/unparam v0.0.0-20230312165513-e84e2d14e3b8 h1:VuJo4Mt0EVPychre4fNlDWDuE5AjXtPJpRUWqZDQhaI=
 mvdan.cc/unparam v0.0.0-20230312165513-e84e2d14e3b8/go.mod h1:Oh/d7dEtzsNHGOq1Cdv8aMm3KdKhVvPbRQcM8WFpBR8=

[zpavlinovic]

It seems this is a bug in the ssa dependency. Could you provide steps to reproduce this?

[elambert]

65590.zip
I can reproduce with a very simple go file and corresponding go.mod which are included in the attached 65590.zip zip file. To reproduce:

• unzip the file
• cd into 65590 directory
• run govulncheck

% unzip ./65590.zip
Archive:  ./65590.zip
 extracting: 65590/go.mod
  inflating: 65590/main.go
% cd 65590
% ls
go.mod	main.go
% ~/git/vuln/cmd/govulncheck/govulncheck ./...
Scanning your code and 44 packages across 1 dependent module for known vulnerabilities...

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x28 pc=0x100b2d78c]

goroutine 619 [running]:
golang.org/x/tools/go/ssa.memberFromObject(0x140033cfe00, {0x0, 0x0?}, {0x100d04300, 0x140075e6ea0}, {0x0, 0x0})
	/Users/lambere/go/pkg/mod/golang.org/x/tools@v0.17.1-0.20240207215834-5fcc6273f47e/go/ssa/create.go:55 +0x3c
golang.org/x/tools/go/ssa.membersFromDecl(0x140033cfe00, {0x100d05820?, 0x140075e6ea0?}, {0x0, 0x0})
	/Users/lambere/go/pkg/mod/golang.org/x/tools@v0.17.1-0.20240207215834-5fcc6273f47e/go/ssa/create.go:184 +0xf4
golang.org/x/tools/go/ssa.(*Program).CreatePackage(0x14004848000, 0x140064202a0, {0x140074db5b8, 0x1, 0x1}, 0x14002ce9040, 0x0)
	/Users/lambere/go/pkg/mod/golang.org/x/tools@v0.17.1-0.20240207215834-5fcc6273f47e/go/ssa/create.go:250 +0x7e8
golang.org/x/vuln/internal/vulncheck.buildSSA({0x140074db5d8, 0x1, 0x14000052798?}, 0x14000118280)
	/Users/lambere/git/vuln/internal/vulncheck/utils.go:54 +0x37c
golang.org/x/vuln/internal/vulncheck.source.func1()
	/Users/lambere/git/vuln/internal/vulncheck/source.go:54 +0x88
created by golang.org/x/vuln/internal/vulncheck.source in goroutine 6
	/Users/lambere/git/vuln/internal/vulncheck/source.go:52 +0x204
[65590.zip](https://github.com/golang/go/files/14213979/65590.zip)
% ~/git/vuln/cmd/govulncheck/govulncheck -version
Go: go1.22.0
Scanner: govulncheck@v0.0.0-5507063454b1-20240206192649
DB: https://vuln.go.dev
DB updated: 2024-02-07 04:19:28 +0000 UTC

No vulnerabilities found.

Note, in the snippet above I used the version of govulncheck built with x/tools v0.17.1-0.20240207215834-5fcc6273f47e but I also see the same behavior with the 1.0.4 release.

I suspect this is something unique to my environment? Though I should point out that at least two other colleagues of mine have encountered this on their machines (one on Darwin/amd64 and the other on Darwin/arm64) Let me if there is more info you need.

[timothy-king]

Possibly a duplicate of #65608 ?

[findleyr]

Unfortunately that reproducer did not reproduce for me:

[roam:65590]> go install golang.org/x/vuln/cmd/govulncheck@latest
[roam:65590]> govulncheck ./...
Scanning your code and 45 packages across 1 dependent module for known vulnerabilities...

No vulnerabilities found.
[roam:65590]> go version
go version go1.22.0 linux/amd64

[elambert]

Unfortunately that reproducer did not reproduce for me:

[roam:65590]> go install golang.org/x/vuln/cmd/govulncheck@latest
[roam:65590]> govulncheck ./...
Scanning your code and 45 packages across 1 dependent module for known vulnerabilities...

No vulnerabilities found.
[roam:65590]> go version
go version go1.22.0 linux/amd64

Perhaps an environment issue on my machine .. here's my go env

% go env
GO111MODULE=''
GOARCH='arm64'
GOBIN=''
GOCACHE='/Users/lambere/Library/Caches/go-build'
GOENV='/Users/lambere/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='arm64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMODCACHE='/Users/lambere/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='darwin'
GOPATH='/Users/lambere/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/Users/lambere/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.0.darwin-arm64'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/Users/lambere/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.0.darwin-arm64/pkg/tool/darwin_arm64'
GOVCS=''
GOVERSION='go1.22.0'
GCCGO='gccgo'
AR='ar'
CC='clang'
CXX='clang++'
CGO_ENABLED='1'
GOMOD='/Users/lambere/65590-steps/65590/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -arch arm64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -ffile-prefix-map=/var/folders/5g/vcbxp4bn64v09lrd7cnrfy8h0000gp/T/go-build1218479303=/tmp/go-build -gno-record-gcc-switches -fno-common'

[andresvia]

I also have a darwin/arm64 and can reproduce the bug. When running with a linux container I can't reproduce, I can't say much about since I don't know much (nothing!) about ssa

this is fine

docker build --progress=plain --platform=linux/amd64 --file - . <<'EOF'
FROM golang:1.22.0
WORKDIR /65590
RUN echo 'module test' >  go.mod
RUN echo 'go 1.22.0'   >> go.mod
RUN echo 'package main'                 > main.go
RUN echo 'import "fmt"'                 >> main.go
RUN echo 'func main () {'               >> main.go
RUN echo '  fmt.Println("Hello World")' >> main.go
RUN echo '}'                            >> main.go
RUN go fmt ./...
RUN go run main.go
RUN go install -v golang.org/x/vuln/cmd/govulncheck@v1.0.4 
RUN govulncheck
RUN govulncheck ./...
EOF

this is also fine

docker build --progress=plain --platform=linux/arm64 --file - . <<'EOF'
FROM golang:1.22.0
WORKDIR /65590
RUN echo 'module test' >  go.mod
RUN echo 'go 1.22.0'   >> go.mod
RUN echo 'package main'                 > main.go
RUN echo 'import "fmt"'                 >> main.go
RUN echo 'func main () {'               >> main.go
RUN echo '  fmt.Println("Hello World")' >> main.go
RUN echo '}'                            >> main.go
RUN go fmt ./...
RUN go run main.go
RUN go install -v golang.org/x/vuln/cmd/govulncheck@v1.0.4 
RUN govulncheck
RUN govulncheck ./...
EOF

[H0llyW00dzZ]

this panic as well for me

$ govulncheck -version
Go: go1.22.0
Scanner: govulncheck@v1.0.1
DB: https://vuln.go.dev
DB updated: 2024-02-07 04:19:28 +0000 UTC

No vulnerabilities found.

Share feedback at https://go.dev/s/govulncheck-feedback.

$ govulncheck ./...
Scanning your code and 386 packages across 30 dependent modules for known vulnerabilities...

panic: runtime error: invalid memory address or nil pointer dereference
[signal 0xc0000005 code=0x0 addr=0x28 pc=0x5be12a]

goroutine 4517 [running]:
golang.org/x/tools/go/ssa.memberFromObject(0xc009efdf00, {0x0, 0x0?}, {0x0, 0x0})
        C:/Users/erian/go/pkg/mod/golang.org/x/tools@v0.12.1-0.20230815132531-74c255bcf846/go/ssa/create.go:53 +0x4a
golang.org/x/tools/go/ssa.membersFromDecl(0xc009efdf00, {0x795250?, 0xc00e25c380?})
        C:/Users/erian/go/pkg/mod/golang.org/x/tools@v0.12.1-0.20230815132531-74c255bcf846/go/ssa/create.go:141 +0x373
golang.org/x/tools/go/ssa.(*Program).CreatePackage(0xc02179a180, 0xc00b1d2660, {0xc009110540, 0x3, 0x3}, 0xc00e26a140, 0x1)
        C:/Users/erian/go/pkg/mod/golang.org/x/tools@v0.12.1-0.20230815132531-74c255bcf846/go/ssa/create.go:222 +0x77c
golang.org/x/vuln/internal/vulncheck.buildSSA.func1(0xc000232040?)
        C:/Users/erian/go/pkg/mod/golang.org/x/vuln@v1.0.1/internal/vulncheck/utils.go:37 +0xe5
golang.org/x/vuln/internal/vulncheck.buildSSA({0xc006062640, 0x7, 0xc0005e7f90?}, 0x293aa5?)
        C:/Users/erian/go/pkg/mod/golang.org/x/vuln@v1.0.1/internal/vulncheck/utils.go:45 +0x128
golang.org/x/vuln/internal/vulncheck.Source.func1()
        C:/Users/erian/go/pkg/mod/golang.org/x/vuln@v1.0.1/internal/vulncheck/source.go:63 +0x8f
created by golang.org/x/vuln/internal/vulncheck.Source in goroutine 6
        C:/Users/erian/go/pkg/mod/golang.org/x/vuln@v1.0.1/internal/vulncheck/source.go:61 +0x2d9

env:

$ go env
set GO111MODULE=
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\erian\AppData\Local\go-build
set GOENV=C:\Users\erian\AppData\Roaming\go\env
set GOEXE=.exe
set GOEXPERIMENT=
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=C:\Users\erian\go\pkg\mod
set GONOPROXY=
set GONOSUMDB=
set GOOS=windows
set GOPATH=C:\Users\erian\go
set GOPRIVATE=
set GOPROXY=https://proxy.golang.org,direct
set GOROOT=C:\Program Files\Go
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLCHAIN=auto
set GOTOOLDIR=C:\Program Files\Go\pkg\tool\windows_amd64
set GOVCS=
set GOVERSION=go1.22.0
set GCCGO=gccgo
set GOAMD64=v1
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=0
set GOMOD=C:\h0llyw00dz\GoGenAI-Terminal-Chat\go.mod
set GOWORK=
set CGO_CFLAGS=-O2 -g
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-O2 -g
set CGO_FFLAGS=-O2 -g
set CGO_LDFLAGS=-O2 -g
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -fno-caret-diagnostics -Qunused-arguments -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=C:\Users\erian\AppData\Local\Temp\go-build2961088783=/tmp/go-build -gno-record-gcc-switches

[H0llyW00dzZ]

Latest version it fix

$ govulncheck ./...
Scanning your code and 386 packages across 32 dependent modules for known vulnerabilities...

No vulnerabilities found.

$ govulncheck -version
Go: go1.22.0
Scanner: govulncheck@v1.0.4
DB: https://vuln.go.dev
DB updated: 2024-02-07 04:19:28 +0000 UTC

No vulnerabilities found.