Crash when scanning sbom with cyclonedx output format

[davidgiga1993]

Description

When scanning a cyclonedx sbom file and using cyclonedx as output format, trivy crashes.

Desired Behavior

Should not crash

Actual Behavior

It crashes, table output works fine

Reproduction Steps

1. `trivy sbom cyclonedx.json -f cyclonedx`

Target

SBOM

Scanner

Vulnerability

Output Format

CycloneDX

Mode

Standalone

Debug Output

trivy sbom cyclonedx.json -f cyclonedx --debug
2024-06-27T10:46:43+02:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-06-27T10:46:43+02:00       DEBUG   Ignore statuses statuses=[]
2024-06-27T10:46:43+02:00       INFO    "--format cyclonedx" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the CycloneDX report.
2024-06-27T10:46:43+02:00       DEBUG   Cache dir       dir="/home/david/.cache/trivy"
2024-06-27T10:46:43+02:00       DEBUG   Enabling misconfiguration scanners      scanners=[]
2024-06-27T10:46:43+02:00       INFO    Detected SBOM format    format="cyclonedx-json"
2024-06-27T10:46:43+02:00       DEBUG   Unmarshalling CycloneDX JSON...
2024-06-27T10:46:43+02:00       WARN    Third-party SBOM may lead to inaccurate vulnerability detection
2024-06-27T10:46:43+02:00       WARN    Recommend using Trivy to generate SBOMs
2024-06-27T10:46:43+02:00       DEBUG   Skipping a component with an unsupported type   name="python" version="" type="generic"
2024-06-27T10:46:43+02:00       INFO    Detected OS     family="debian" version="10.13"
2024-06-27T10:46:43+02:00       INFO    Number of language-specific files       num=2
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x68f802a]

goroutine 1 [running]:
github.com/aquasecurity/trivy/pkg/sbom/core.(*BOM).setupComponent(0xc002857da0, 0x0)
        /home/runner/work/trivy/trivy/pkg/sbom/core/bom.go:222 +0x2a
github.com/aquasecurity/trivy/pkg/sbom/core.(*BOM).AddComponent(...)
        /home/runner/work/trivy/trivy/pkg/sbom/core/bom.go:233
github.com/aquasecurity/trivy/pkg/sbom/io.(*Encoder).Encode(_, {0x2, {0xc197679cd0b4b004, 0x2b322be3, 0xd652d60}, {0x7ffe7d0162f3, 0xe}, {0x83f8c80, 0x9}, {0x0, ...}, ...})
        /home/runner/work/trivy/trivy/pkg/sbom/io/encode.go:38 +0x19a
github.com/aquasecurity/trivy/pkg/sbom/cyclonedx.(*Marshaler).MarshalReport(_, {_, _}, {0x2, {0xc197679cd0b4b004, 0x2b322be3, 0xd652d60}, {0x7ffe7d0162f3, 0xe}, {0x83f8c80, ...}, ...})
        /home/runner/work/trivy/trivy/pkg/sbom/cyclonedx/marshal.go:52 +0xa6
github.com/aquasecurity/trivy/pkg/report/cyclonedx.Writer.Write({{_, _}, _, {{_, _}, _, _}}, {_, _}, {0x2, ...})
        /home/runner/work/trivy/trivy/pkg/report/cyclonedx/cyclonedx.go:31 +0xa6
github.com/aquasecurity/trivy/pkg/report.Write({_, _}, {0x2, {0xc197679cd0b4b004, 0x2b322be3, 0xd652d60}, {0x7ffe7d0162f3, 0xe}, {0x83f8c80, 0x9}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/report/writer.go:101 +0x8e6
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).Report(_, {_, _}, {{{0x8401f7e, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:281 +0x92
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x8401f7e, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0xc000c1a000, ...}, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:451 +0xf2e
github.com/aquasecurity/trivy/pkg/commands.NewSBOMCommand.func2(0xc0022f6908, {0xc003754080, 0x1, 0x4})
        /home/runner/work/trivy/trivy/pkg/commands/app.go:1221 +0x19c
github.com/spf13/cobra.(*Command).execute(0xc0022f6908, {0xc003754040, 0x4, 0x4})
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:983 +0xaca
github.com/spf13/cobra.(*Command).ExecuteC(0xc000a12f08)
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1115 +0x3ff
github.com/spf13/cobra.(*Command).Execute(0x846afa3?)
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1039 +0x13
main.run()
        /home/runner/work/trivy/trivy/cmd/trivy/main.go:39 +0x113
main.main()
        /home/runner/work/trivy/trivy/cmd/trivy/main.go:19 +0x1f

Operating System

Ubuntu 22

Version

Version: 0.52.2
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-06-27 06:11:43.124342311 +0000 UTC
  NextUpdate: 2024-06-27 12:11:43.12434205 +0000 UTC
  DownloadedAt: 2024-06-27 08:15:54.144018613 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @davidgiga1993
Thanks for your report!

Can you send your (or test file with same bug) CycloneDX file to research?

Regards, Dmitriy

[DmitriyLewen]

I was able to reproduce error.

Created #7050 for this bug.

[davidgiga1993]

Wow that was quick, thanks a lot!