panic: when analysing dockerfile

[zetaab]

Description

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x2e43ec9]

goroutine 3793 [running]:
github.com/aquasecurity/trivy/pkg/fanal/analyzer/imgconf/dockerfile.(*historyAnalyzer).Analyze(0xc00179da00, {0x45b1858, 0xc000138000}, {{{0x0, 0x0}, {0x0, 0x0}, 0x0, 0x0}, 0xc00602ae00})
        /runner/_work/image-scanner/image-scanner/vendor/github.com/aquasecurity/trivy/pkg/fanal/analyzer/imgconf/dockerfile/dockerfile.go:54 +0x489
github.com/aquasecurity/trivy/pkg/fanal/analyzer.(*ConfigAnalyzerGroup).AnalyzeImageConfig(0xc001fef968, {0x45b1858, 0xc000138000}, {{0x0, 0x0}, {0x0, 0x0}, 0x0, 0x0}, 0xc00602ae00)
        /runner/_work/image-scanner/image-scanner/vendor/github.com/aquasecurity/trivy/pkg/fanal/analyzer/config_analyzer.go:115 +0x1c2
github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.inspectConfig({{0x45ca8d0, 0xc00491d4c0}, {0x7f15fa7992e0, 0xc00179d8c0}, {{{0x0, 0x0, 0x0}, {0xc00491d580, 0x3, 0x4}, ...}, ...}, ...}, ...)
        /runner/_work/image-scanner/image-scanner/vendor/github.com/aquasecurity/trivy/pkg/fanal/artifact/image/image.go:447 +0xa6
github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.inspect({{0x45ca8d0, 0xc00491d4c0}, {0x7f15fa7992e0, 0xc00179d8c0}, {{{0x0, 0x0, 0x0}, {0xc00491d580, 0x3, 0x4}, ...}, ...}, ...}, ...)
        /runner/_work/image-scanner/image-scanner/vendor/github.com/aquasecurity/trivy/pkg/fanal/artifact/image/image.go:266 +0x33f
github.com/aquasecurity/trivy/pkg/fanal/artifact/image.Artifact.Inspect({{0x45ca8d0, 0xc00491d4c0}, {0x7f15fa7992e0, 0xc00179d8c0}, {{{0x0, 0x0, 0x0}, {0xc00491d580, 0x3, 0x4}, ...}, ...}, ...}, ...)
        /runner/_work/image-scanner/image-scanner/vendor/github.com/aquasecurity/trivy/pkg/fanal/artifact/image/image.go:138 +0x877
github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0xc00179da80, 0x2, 0x2}, {0xc0187f1d60, ...}, ...})
        /runner/_work/image-scanner/image-scanner/vendor/github.com/aquasecurity/trivy/pkg/scanner/scan.go:144 +0x103
foobar.com/sre/image-scanner/pkg/scanner.scanArtifact({_, _}, _, {_, _})
        /runner/_work/image-scanner/image-scanner/pkg/scanner/trivy.go:139 +0x26e
foobar.com/sre/image-scanner/pkg/scanner.scanSettings.scanImage({{0xc00005604a, 0x11}, {0xc00005c010, 0x8}, {0xc00005a090, _}}, {_, _}, {0xc004500a00, 0x77}, ...)
        /runner/_work/image-scanner/image-scanner/pkg/scanner/trivy.go:175 +0x1c5
foobar.com/sre/image-scanner/pkg/scanner.Run.func3.1()
        /runner/_work/image-scanner/image-scanner/pkg/scanner/run.go:193 +0x365
golang.org/x/sync/errgroup.(*Group).Go.func1()
        /runner/_work/image-scanner/image-scanner/vendor/golang.org/x/sync/errgroup/errgroup.go:75 +0x64
created by golang.org/x/sync/errgroup.(*Group).Go
        /runner/_work/image-scanner/image-scanner/vendor/golang.org/x/sync/errgroup/errgroup.go:72 +0xa5

What did you expect to happen?

I expect that trivy does not exit with panic

What happened instead?

It is exiting with panic

Output of run with -debug:

not available

Output of trivy -v:

0.38.3

Additional details (base image name, container registry info...):

possible breaking PR for this is #3831 (https://github.com/aquasecurity/trivy/blob/v0.38.3/pkg/fanal/analyzer/imgconf/dockerfile/dockerfile.go#L54) cc @DmitriyLewen

[zetaab]

examples of healthchecks that are failing:

HEALTHCHECK &{["CMD-SHELL" "curl -fSs http://localhost:8008/health || exit 1"] "15s" "5s" "5s" '\x00'}

that another image where it is failing does not even have HEALTHCHECK so its weird.

[zetaab]

seems that 0.38.2 works, but 0.38.3 does not

[DmitriyLewen]

Hello @zetaab
Thanks for your report and PR.

Can you share some test image with this problem?
Because this case is strange.
You have HEALTHCHECK line, then input.Config.Config.Healthcheck should be filled in.
Perhaps we need to parse HEALTHCHECK line to avoid false positive and errors.