Trivy: Crash following interrupted DB download

Created on 19 Nov 2019 · 5Comments · Source: aquasecurity/trivy

Description
Fresh install of trivy (on Mac, but I doubt that matters). On first run, it started doing the database download and I interrupted it part way through. The next run of trivy crashes.

What happened instead?
seg fault

Output of run with -debug:

 ~  trivy --debug                                                                                        ✔
2019-11-19T13:20:44.924-0800    DEBUG   cache dir:  /Users/liz/Library/Caches/trivy
unexpected fault address 0x9b58008
fatal error: fault
[signal SIGSEGV: segmentation violation code=0x1 addr=0x9b58008 pc=0x1123e27]

goroutine 1 [running]:
runtime.throw(0x19ccab3, 0x5)
    /usr/local/go/src/runtime/panic.go:774 +0x72 fp=0xc00027d580 sp=0xc00027d550 pc=0x102de92
runtime.sigpanic()
    /usr/local/go/src/runtime/signal_unix.go:401 +0x3de fp=0xc00027d5b0 sp=0xc00027d580 pc=0x1042aae
github.com/etcd-io/bbolt.(*freelist).read(0xc0003cc880, 0x9b58000)
    /go/pkg/mod/github.com/etcd-io/[email protected]/freelist.go:265 +0x37 fp=0xc00027d640 sp=0xc00027d5b0 pc=0x1123e27
github.com/etcd-io/bbolt.(*DB).loadFreelist.func1()
    /go/pkg/mod/github.com/etcd-io/[email protected]/db.go:316 +0xcf fp=0xc00027d678 sp=0xc00027d640 pc=0x112e0bf
sync.(*Once).doSlow(0xc000408368, 0xc00027d728)
    /usr/local/go/src/sync/once.go:66 +0xe3 fp=0xc00027d718 sp=0xc00027d678 pc=0x1077143
sync.(*Once).Do(...)
    /usr/local/go/src/sync/once.go:57
github.com/etcd-io/bbolt.(*DB).loadFreelist(0xc000408200)
    /go/pkg/mod/github.com/etcd-io/[email protected]/db.go:309 +0x6a fp=0xc00027d748 sp=0xc00027d718 pc=0x111f0da
github.com/etcd-io/bbolt.Open(0xc00042c0f0, 0x2b, 0xc000000180, 0x2103540, 0x0, 0x0, 0x0)
    /go/pkg/mod/github.com/etcd-io/[email protected]/db.go:286 +0x35e fp=0xc00027d830 sp=0xc00027d748 pc=0x111eb8e
github.com/aquasecurity/trivy-db/pkg/db.Init(0xc0003cacc0, 0x1f, 0x19d1ffc, 0xe)
    /go/pkg/mod/github.com/aquasecurity/[email protected]/pkg/db/db.go:62 +0x13c fp=0xc00027d898 sp=0xc00027d830 pc=0x137050c
github.com/aquasecurity/trivy/pkg.Run(0xc000418b00, 0xc000418b00, 0xc00027db9f)
    /home/circleci/project/pkg/run.go:41 +0x2ef fp=0xc00027dba0 sp=0xc00027d898 pc=0x17b783f
github.com/urfave/cli.HandleAction(0x1868da0, 0x1a047f0, 0xc000418b00, 0xc0003d6780, 0x0)
    /go/pkg/mod/github.com/urfave/[email protected]/app.go:490 +0xc8 fp=0xc00027dbc8 sp=0xc00027dba0 pc=0x13cf008
github.com/urfave/cli.(*App).Run(0xc0003ea340, 0xc0000ac020, 0x2, 0x2, 0x0, 0x0)
    /go/pkg/mod/github.com/urfave/[email protected]/app.go:264 +0x58c fp=0xc00027df00 sp=0xc00027dbc8 pc=0x13cd20c
main.main()
    /home/circleci/project/cmd/trivy/main.go:17 +0x6f fp=0xc00027df60 sp=0xc00027df00 pc=0x17b8eff
runtime.main()
    /usr/local/go/src/runtime/proc.go:203 +0x21e fp=0xc00027dfe0 sp=0xc00027df60 pc=0x102f81e
runtime.goexit()
    /usr/local/go/src/runtime/asm_amd64.s:1357 +0x1 fp=0xc00027dfe8 sp=0xc00027dfe0 pc=0x105ad81

goroutine 18 [syscall]:
os/signal.signal_recv(0x0)
    /usr/local/go/src/runtime/sigqueue.go:144 +0x96
os/signal.loop()
    /usr/local/go/src/os/signal/signal_unix.go:23 +0x22
created by os/signal.init.0
    /usr/local/go/src/os/signal/signal_unix.go:29 +0x41

Output of trivy -v:

trivy version 0.2.1

Additional details (base image name, container registry info...):

 ~  trivy                                                                                       ✔  3m 55s
zsh: correct 'trivy' to 'tidy' [nyae]? n
[======>             ] Downloading Full DB file... ^C
 ~  trivy                                                                                       INT ✘  4s
unexpected fault address 0x99f8008
fatal error: fault
[signal SIGSEGV: segmentation violation code=0x1 addr=0x99f8008 pc=0x1123e27]

goroutine 1 [running]:
runtime.throw(0x19ccab3, 0x5)
    /usr/local/go/src/runtime/panic.go:774 +0x72 fp=0xc00024f580 sp=0xc00024f550 pc=0x102de92
runtime.sigpanic()
    /usr/local/go/src/runtime/signal_unix.go:401 +0x3de fp=0xc00024f5b0 sp=0xc00024f580 pc=0x1042aae
github.com/etcd-io/bbolt.(*freelist).read(0xc0003a0800, 0x99f8000)
    /go/pkg/mod/github.com/etcd-io/[email protected]/freelist.go:265 +0x37 fp=0xc00024f640 sp=0xc00024f5b0 pc=0x1123e27
github.com/etcd-io/bbolt.(*DB).loadFreelist.func1()
    /go/pkg/mod/github.com/etcd-io/[email protected]/db.go:316 +0xcf fp=0xc00024f678 sp=0xc00024f640 pc=0x112e0bf
sync.(*Once).doSlow(0xc0003d6368, 0xc00024f728)
    /usr/local/go/src/sync/once.go:66 +0xe3 fp=0xc00024f718 sp=0xc00024f678 pc=0x1077143
sync.(*Once).Do(...)
    /usr/local/go/src/sync/once.go:57
github.com/etcd-io/bbolt.(*DB).loadFreelist(0xc0003d6200)
    /go/pkg/mod/github.com/etcd-io/[email protected]/db.go:309 +0x6a fp=0xc00024f748 sp=0xc00024f718 pc=0x111f0da
github.com/etcd-io/bbolt.Open(0xc0003fa120, 0x2b, 0xc000000180, 0x2103540, 0x0, 0xc00024f800, 0x100984b)
    /go/pkg/mod/github.com/etcd-io/[email protected]/db.go:286 +0x35e fp=0xc00024f830 sp=0xc00024f748 pc=0x111eb8e
github.com/aquasecurity/trivy-db/pkg/db.Init(0xc00039eea0, 0x1f, 0x19d1ffc, 0xe)
    /go/pkg/mod/github.com/aquasecurity/[email protected]/pkg/db/db.go:62 +0x13c fp=0xc00024f898 sp=0xc00024f830 pc=0x137050c
github.com/aquasecurity/trivy/pkg.Run(0xc0003e6b00, 0xc0003e6b00, 0xc00024fb9f)
    /home/circleci/project/pkg/run.go:41 +0x2ef fp=0xc00024fba0 sp=0xc00024f898 pc=0x17b783f
github.com/urfave/cli.HandleAction(0x1868da0, 0x1a047f0, 0xc0003e6b00, 0xc0003aa7e0, 0x0)
    /go/pkg/mod/github.com/urfave/[email protected]/app.go:490 +0xc8 fp=0xc00024fbc8 sp=0xc00024fba0 pc=0x13cf008
github.com/urfave/cli.(*App).Run(0xc0003b04e0, 0xc0000301d0, 0x1, 0x1, 0x0, 0x0)
    /go/pkg/mod/github.com/urfave/[email protected]/app.go:264 +0x58c fp=0xc00024ff00 sp=0xc00024fbc8 pc=0x13cd20c
main.main()
    /home/circleci/project/cmd/trivy/main.go:17 +0x6f fp=0xc00024ff60 sp=0xc00024ff00 pc=0x17b8eff
runtime.main()
    /usr/local/go/src/runtime/proc.go:203 +0x21e fp=0xc00024ffe0 sp=0xc00024ff60 pc=0x102f81e
runtime.goexit()
    /usr/local/go/src/runtime/asm_amd64.s:1357 +0x1 fp=0xc00024ffe8 sp=0xc00024ffe0 pc=0x105ad81

goroutine 6 [syscall]:
os/signal.signal_recv(0x0)
    /usr/local/go/src/runtime/sigqueue.go:144 +0x96
os/signal.loop()
    /usr/local/go/src/os/signal/signal_unix.go:23 +0x22
created by os/signal.init.0
    /usr/local/go/src/os/signal/signal_unix.go:29 +0x41

kinbug

Source