Segfault on trivy 0.59.0

[wwuck]

Description

I upgraded to trivy 0.59.0 and I now get a segfault when running trivy filesystem.

Desired Behavior

trivy should not segfault.

Actual Behavior

trivy exits with a segfault.

Reproduction Steps

1. Clone example repository: https://github.com/wwuck/trivy-0.59.0-segfault
2. Run `trivy filesystem .`
3. trivy will segfault

Target

Filesystem

Scanner

None

Output Format

None

Mode

Standalone

Debug Output

$ trivy filesystem --debug .
2025-01-31T12:05:40+11:00	DEBUG	No plugins loaded
2025-01-31T12:05:40+11:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2025-01-31T12:05:40+11:00	DEBUG	Cache dir	dir="/home/user/.cache/trivy"
2025-01-31T12:05:40+11:00	DEBUG	Cache dir	dir="/home/user/.cache/trivy"
2025-01-31T12:05:40+11:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-01-31T12:05:40+11:00	DEBUG	Ignore statuses	statuses=[]
2025-01-31T12:05:40+11:00	DEBUG	DB update was skipped because the local DB is the latest
2025-01-31T12:05:40+11:00	DEBUG	DB info	schema=2 updated_at=2025-01-30T18:16:28.949490285Z next_update=2025-01-31T18:16:28.949489103Z downloaded_at=2025-01-31T00:18:11.769353959Z
2025-01-31T12:05:40+11:00	DEBUG	[pkg] Package types	types=[os library]
2025-01-31T12:05:40+11:00	DEBUG	[pkg] Package relationships	relationships=[unknown root workspace direct indirect]
2025-01-31T12:05:40+11:00	INFO	[vuln] Vulnerability scanning is enabled
2025-01-31T12:05:40+11:00	INFO	[secret] Secret scanning is enabled
2025-01-31T12:05:40+11:00	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-31T12:05:40+11:00	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.59/docs/scanner/secret#recommendation for faster secret detection
2025-01-31T12:05:40+11:00	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-01-31T12:05:40+11:00	DEBUG	Initializing scan cache...	type="memory"
2025-01-31T12:05:40+11:00	DEBUG	[secret] No secret config detected	config_path="trivy-secret.yaml"
2025-01-31T12:05:40+11:00	DEBUG	[fs] Analyzing...	root="."
2025-01-31T12:05:40+11:00	DEBUG	[fs] Using the latest commit hash for calculating cache key	commit_hash="2fdcf2dbdad79d8bee85bfd7c8b137497233dfc3"
2025-01-31T12:05:40+11:00	DEBUG	Skipping path	path=".git"
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x28 pc=0x3e0197a]

goroutine 1 [running]:
github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/python/poetry.directDeps({{{{{...}}, 0x0?}}})
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/language/python/poetry/poetry.go:124 +0x3a
github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/python/poetry.poetryAnalyzer.mergePyProject({0xc000f19530?, 0x90ce2a0?, {0x60bc880?, 0xc000fc6940?}}, {0x60b4800, 0xc0008ea2e8}, {0x60958b0?, 0xc000fc6940?}, 0xc001532980)
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/language/python/poetry/poetry.go:107 +0x193
github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/python/poetry.poetryAnalyzer.PostAnalyze.func2({0xc00099a160, 0xb}, {0xb?, 0x46ffdd?}, {0x60b3ce0?, 0xc000fc6010?})
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/language/python/poetry/poetry.go:61 +0x156
github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/python/poetry.poetryAnalyzer.PostAnalyze.WalkDir.func3({0xc00099a160, 0xb}, {0x6113578, 0xc0013ea0a0}, {0x0?, 0x0?})
	/home/runner/work/trivy/trivy/pkg/utils/fsutils/fs.go:88 +0x214
io/fs.walkDir({0x60b4800, 0xc0008ea2e8}, {0xc00099a160, 0xb}, {0x6113578, 0xc0013ea0a0}, 0xc001496450)
	/opt/hostedtoolcache/go/1.23.4/x64/src/io/fs/walk.go:73 +0x6c
io/fs.walkDir({0x60b4800, 0xc0008ea2e8}, {0x60958b0, 0x1}, {0x6112bb0, 0xc0018cf600}, 0xc001496450)
	/opt/hostedtoolcache/go/1.23.4/x64/src/io/fs/walk.go:95 +0x2bf
io/fs.WalkDir({0x60b4800, 0xc0008ea2e8}, {0x60958b0, 0x1}, 0xc001496450)
	/opt/hostedtoolcache/go/1.23.4/x64/src/io/fs/walk.go:122 +0x9a
github.com/aquasecurity/trivy/pkg/utils/fsutils.WalkDir(...)
	/home/runner/work/trivy/trivy/pkg/utils/fsutils/fs.go:75
github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/python/poetry.poetryAnalyzer.PostAnalyze({0xc000f19530?, 0x90ce2a0?, {0x60bc880?, 0xc000fc6940?}}, {0x4f9fded?, 0x6?}, {{0x60b4800, 0xc0008ea2e8}, {0x0, 0x0}})
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/language/python/poetry/poetry.go:51 +0x11a
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.PostAnalyze({0xc000d0d820, {0xc000c87600, 0x1f, 0x20}, {0xc00120da00, 0xf, 0x10}, 0xc0012fb320, {0x4fa5c1e, 0x7}}, ...)
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/analyzer.go:505 +0x2e2
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect({{0x7ffd37fbf1a8, 0x1}, 0xc00145a090, {0x7fdc21cbbb40, 0xc000a0ad00}, {0x60b4720, 0x90ce2a0}, {0xc000d0d820, {0xc000c87600, 0x1f, ...}, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/fanal/artifact/local/fs.go:204 +0x789
github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0xc000af6fa0, 0x2, 0x2}, {0xc0006fb680, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/scanner/scan.go:156 +0x103
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan(_, {_, _}, {{{0x4fbd3fa, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:627 +0x377
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x4fbd3fa, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:259 +0xa5
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanFS(_, {_, _}, {{{0x4fbd3fa, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:204 +0xb4
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanFilesystem(_, {_, _}, {{{0x4fbd3fa, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:184 +0x205
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x4fbd3fa, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0xc000e1a198, ...}, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:400 +0x8dd
github.com/aquasecurity/trivy/pkg/commands.NewFilesystemCommand.func2(0xc000d8a008, {0xc0001ef900, 0x1, 0x2})
	/home/runner/work/trivy/trivy/pkg/commands/app.go:383 +0x177
github.com/spf13/cobra.(*Command).execute(0xc000d8a008, {0xc0001ef8e0, 0x2, 0x2})
	/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:985 +0xaaa
github.com/spf13/cobra.(*Command).ExecuteC(0xc0008d5208)
	/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:1117 +0x3ff
github.com/spf13/cobra.(*Command).Execute(0x50132e1?)
	/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:1041 +0x13
main.run()
	/home/runner/work/trivy/trivy/cmd/trivy/main.go:45 +0x113
main.main()
	/home/runner/work/trivy/trivy/cmd/trivy/main.go:19 +0x1f

Operating System

Devuan 5 (Debian 12.7)

Version

Version: 0.59.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-01-30 18:16:28.949490285 +0000 UTC
  NextUpdate: 2025-01-31 18:16:28.949489103 +0000 UTC
  DownloadedAt: 2025-01-31 00:18:11.769353959 +0000 UTC
Check Bundle:
  Digest: sha256:550f6438225e011fb3b3f0895c1cb93477e81898210af8e9a184644cb7295b63
  DownloadedAt: 2025-01-22 03:15:21.617624952 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[nikpivkin]

Track #8322