x/vuln: govulncheck panic: interface conversion: types.Type is types.Interface, not types.Array #57174

sixcolors · 2022-12-08T17:28:48Z

What version of Go are you using (`go version`)?

$ go version
go version go1.19.3 darwin/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (`go env`)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/sixcolors/Library/Caches/go-build"
GOENV="/Users/sixcolors/Library/Application Support/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/sixcolors/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/sixcolors/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/Cellar/go/1.19.3/libexec"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/Cellar/go/1.19.3/libexec/pkg/tool/darwin_amd64"
GOVCS=""
GOVERSION="go1.19.3"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/Users/sixcolors/maintainer/go.mod"
GOWORK=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/jl/xzdcwhj92pdfdqnp_z8cmbc40000gn/T/go-build2239372547=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

~/maintainer (main) » govulncheck ./...         sixcolors@Jason-McNeils-Mac-Pro
govulncheck is an experimental tool. Share feedback at https://go.dev/s/govulncheck-feedback.

Scanning for dependencies with known vulnerabilities...
panic: interface conversion: types.Type is *types.Interface, not *types.Array

goroutine 1 [running]:
golang.org/x/tools/go/callgraph/vta.sliceArrayElem({0x1554540, 0xc06db65790})
	/Users/sixcolors/go/pkg/mod/golang.org/x/tools@v0.4.0/go/callgraph/vta/utils.go:126 +0x1bd
golang.org/x/tools/go/callgraph/vta.(*builder).indexAddr(0xc096eff790?, 0xc06db6c660)
	/Users/sixcolors/go/pkg/mod/golang.org/x/tools@v0.4.0/go/callgraph/vta/graph.go:481 +0x38
golang.org/x/tools/go/callgraph/vta.(*builder).instr(0xc096eff678?, {0x1557d58?, 0xc06db6c660?})
	/Users/sixcolors/go/pkg/mod/golang.org/x/tools@v0.4.0/go/callgraph/vta/graph.go:355 +0x165
golang.org/x/tools/go/callgraph/vta.(*builder).fun(...)
	/Users/sixcolors/go/pkg/mod/golang.org/x/tools@v0.4.0/go/callgraph/vta/graph.go:299
golang.org/x/tools/go/callgraph/vta.(*builder).visit(0xc096eff790, 0x280?)
	/Users/sixcolors/go/pkg/mod/golang.org/x/tools@v0.4.0/go/callgraph/vta/graph.go:291 +0x1e5
golang.org/x/tools/go/callgraph/vta.typePropGraph(...)
	/Users/sixcolors/go/pkg/mod/golang.org/x/tools@v0.4.0/go/callgraph/vta/graph.go:265
golang.org/x/tools/go/callgraph/vta.CallGraph(0xc096effb70?, 0xc0873d7560)
	/Users/sixcolors/go/pkg/mod/golang.org/x/tools@v0.4.0/go/callgraph/vta/vta.go:75 +0xe5
golang.org/x/vuln/vulncheck.callGraph(0xc03c0f9200, {0xc0873e0000, 0x165, 0x80?})
	/Users/sixcolors/go/pkg/mod/golang.org/x/vuln@v0.0.0-20221208170415-d970d6cd0f6e/vulncheck/utils.go:70 +0x2b9
golang.org/x/vuln/vulncheck.Source({0x15564d0, 0xc0001ae008}, {0xc029b26800?, 0x14, 0x20}, 0xc03c89bd78)
	/Users/sixcolors/go/pkg/mod/golang.org/x/vuln@v0.0.0-20221208170415-d970d6cd0f6e/vulncheck/source.go:80 +0x4cd
golang.org/x/vuln/internal/govulncheck.Source({0x15564d0?, 0xc0001ae008?}, 0xc000217eb0?, {0xc029b26800, 0x14, 0x20})
	/Users/sixcolors/go/pkg/mod/golang.org/x/vuln@v0.0.0-20221208170415-d970d6cd0f6e/internal/govulncheck/run.go:31 +0x94
main.doGovulncheck({0xc0001b4010?, 0x1, 0x1}, 0x1)
	/Users/sixcolors/go/pkg/mod/golang.org/x/vuln@v0.0.0-20221208170415-d970d6cd0f6e/cmd/govulncheck/main.go:114 +0x35b
main.main()
	/Users/sixcolors/go/pkg/mod/golang.org/x/vuln@v0.0.0-20221208170415-d970d6cd0f6e/cmd/govulncheck/main.go:69 +0x127

What did you expect to see?

working scan

What did you see instead?

Type error panic.

The text was updated successfully, but these errors were encountered:

zpavlinovic · 2022-12-08T17:43:21Z

Thanks for reporting this! Do you have a minimal reproducible example? Or do you have some code in general we can use to reproduce the issue?

sixcolors · 2022-12-08T17:59:08Z

Thanks for reporting this! Do you have a minimal reproducible example? Or do you have some code in general where we can use to reproduce the issue?

Trying to get that now. The project triggering this on is closed source.

sixcolors · 2022-12-08T18:17:30Z

Okay, this one has the issue: https://github.com/sixcolors/fiber-boilerplate

sixcolors · 2022-12-08T18:37:51Z

Note: no panic when run with go version go1.19.4 darwin/amd64 or go version go1.19.4 linux/amd64 installed

zpavlinovic · 2022-12-08T18:46:51Z

Same here, I get no errors for the newer version, but do get it for, say, 1.19.1.

This is likely related to changes to the type checker, which ultimately affect call graph construction. Will investigate. Thanks for the info!

klauspost · 2022-12-09T12:17:50Z

Another repro: https://github.com/minio/mc/actions/runs/3656601095/jobs/6179226117 - fails on github.com/minio/mc master branch)

go version go1.19.4 linux/amd64

gopherbot · 2022-12-10T01:49:35Z

Change https://go.dev/cl/456436 mentions this issue: vulncheck: add support for generics

harshavardhana · 2022-12-12T19:25:10Z

It seems to still fail after installing the latest govulncheck

govulncheck ./...
govulncheck is an experimental tool. Share feedback at https://go.dev/s/govulncheck-feedback.

Scanning for dependencies with known vulnerabilities...
panic: in github.com/minio/minio/internal/config.Error: cannot convert *t0 (PT) to T

goroutine 15209 [running]:
golang.org/x/tools/go/ssa.emitConv(0xc0246a9680, {0x95c460, 0xc09ed746c0}, {0x958470?, 0xc0345660c0})
        /home/harsha/go/pkg/mod/golang.org/x/tools@v0.4.0/go/ssa/emit.go:295 +0x9f4
golang.org/x/tools/go/ssa.(*builder).stmt(0x0?, 0xc0246a9680, {0x959a18?, 0xc013685640?})
        /home/harsha/go/pkg/mod/golang.org/x/tools@v0.4.0/go/ssa/builder.go:2220 +0x1831
golang.org/x/tools/go/ssa.(*builder).stmtList(0x864600?, 0x1?, {0xc02cdc57c0?, 0x3, 0x657605?})
        /home/harsha/go/pkg/mod/golang.org/x/tools@v0.4.0/go/ssa/builder.go:946 +0x67
golang.org/x/tools/go/ssa.(*builder).stmt(0xc0246a9680?, 0xc0246a9680, {0x959478?, 0xc0330cf7d0?})
        /home/harsha/go/pkg/mod/golang.org/x/tools@v0.4.0/go/ssa/builder.go:2277 +0xe7d
golang.org/x/tools/go/ssa.(*builder).buildFunctionBody(0x656cd1?, 0xc0246a9680)
        /home/harsha/go/pkg/mod/golang.org/x/tools@v0.4.0/go/ssa/builder.go:2391 +0x4ba
golang.org/x/tools/go/ssa.(*builder).buildFunction(0x656d20?, 0xc0246a9680)
        /home/harsha/go/pkg/mod/golang.org/x/tools@v0.4.0/go/ssa/builder.go:2326 +0x2e
golang.org/x/tools/go/ssa.(*builder).buildCreated(0xc048f45df0)
        /home/harsha/go/pkg/mod/golang.org/x/tools@v0.4.0/go/ssa/builder.go:2413 +0x25
golang.org/x/tools/go/ssa.(*Package).build(0xc04763fa80)
        /home/harsha/go/pkg/mod/golang.org/x/tools@v0.4.0/go/ssa/builder.go:2606 +0xcd4
sync.(*Once).doSlow(0xc026e4a7b0?, 0x0?)
        /home/harsha/sdk/go1.19.3/src/sync/once.go:74 +0xc2
sync.(*Once).Do(...)
        /home/harsha/sdk/go1.19.3/src/sync/once.go:65
golang.org/x/tools/go/ssa.(*Package).Build(...)
        /home/harsha/go/pkg/mod/golang.org/x/tools@v0.4.0/go/ssa/builder.go:2477
golang.org/x/tools/go/ssa.(*Program).Build.func1(0x0?)
        /home/harsha/go/pkg/mod/golang.org/x/tools@v0.4.0/go/ssa/builder.go:2462 +0x4c
created by golang.org/x/tools/go/ssa.(*Program).Build
        /home/harsha/go/pkg/mod/golang.org/x/tools@v0.4.0/go/ssa/builder.go:2461 +0x19c

This did not happen like last week, nothing changed in this area of code.

zpavlinovic · 2022-12-12T19:32:32Z

That is a different issue. It is related to the ssa package. I will investigate and see if there is a simple fix. If not, I will open a separate issue. Can you tell me the Go version you are using?

harshavardhana · 2022-12-12T19:42:49Z

That is a different issue. It is related to the ssa package. I will investigate and see if there is a simple fix. If not, I will open a separate issue. Can you tell me the Go version you are using?

its go1.19.3 @zpavlinovic

go version -m `which govulncheck`
/home/harsha/go/bin/govulncheck: go1.19.3
        path    golang.org/x/vuln/cmd/govulncheck
        mod     golang.org/x/vuln       (devel)
        dep     golang.org/x/exp        v0.0.0-20220722155223-a9213eeb770e      h1:+WEEuIdZHnUeJJmEUjyYC2gfUMj69yZXw17EnHg/otA=
        dep     golang.org/x/mod        v0.7.0  h1:LapD9S96VoQRhi/GrNTqeBJFrUjs5UHCAtTlgwA5oZA=
        dep     golang.org/x/sys        v0.3.0  h1:w8ZOecv6NaNa/zC8944JTU3vz4u6Lagfk4RPQxv92NQ=
        dep     golang.org/x/tools      v0.4.0  h1:7mTAgkunk3fr4GAloyyCasadO6h9zSsQZbwvcaIciV4=
        build   -compiler=gc
        build   CGO_ENABLED=1
        build   CGO_CFLAGS=
        build   CGO_CPPFLAGS=
        build   CGO_CXXFLAGS=
        build   CGO_LDFLAGS=
        build   GOARCH=amd64
        build   GOOS=linux
        build   GOAMD64=v1
        build   vcs=git
        build   vcs.revision=af59454a8a0a42ff9d84df1a73c4248f60a5d9b6
        build   vcs.time=2022-12-12T18:28:31Z
        build   vcs.modified=false

Make ssa instantiate generics. Fixes golang/go#57174 Change-Id: I2d2e28a48e3a64df3d4d415b4629fe3e0a1ba28d Reviewed-on: https://go-review.googlesource.com/c/vuln/+/456436 Reviewed-by: Fnu Harshavardhana <hrshvardhana@gmail.com> Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Jonathan Amsterdam <jba@google.com>

gopherbot added the vulncheck or vulndb Issues for the x/vuln or x/vulndb repo label Dec 8, 2022

gopherbot modified the milestones: Unreleased, vuln/unplanned Dec 8, 2022

zpavlinovic self-assigned this Dec 8, 2022

gopherbot closed this as completed in golang/vuln@42b5c9d Dec 12, 2022

zpavlinovic mentioned this issue Dec 13, 2022

x/tools/go/ssa: emitConv panic on generics #57272

Closed

zpavlinovic mentioned this issue Jan 23, 2023

x/vuln/vulncheck: panic - interface conversion: types.Type is *types.Interface, not *types.Struct #57298

Closed

prattmic mentioned this issue Apr 21, 2023

x/vuln: "panic: interface conversion: types.Type is *types.Interface, not *types.Array" #59754

Closed

golang locked and limited conversation to collaborators Dec 12, 2023

gopherbot added the FrozenDueToAge label Dec 12, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

x/vuln: govulncheck panic: interface conversion: types.Type is types.Interface, not types.Array #57174

x/vuln: govulncheck panic: interface conversion: types.Type is types.Interface, not types.Array #57174

sixcolors commented Dec 8, 2022

zpavlinovic commented Dec 8, 2022 •

edited

sixcolors commented Dec 8, 2022 •

edited

sixcolors commented Dec 8, 2022

sixcolors commented Dec 8, 2022

zpavlinovic commented Dec 8, 2022 •

edited

klauspost commented Dec 9, 2022

gopherbot commented Dec 10, 2022

harshavardhana commented Dec 12, 2022 •

edited

zpavlinovic commented Dec 12, 2022

harshavardhana commented Dec 12, 2022

x/vuln: govulncheck panic: interface conversion: types.Type is *types.Interface, not *types.Array #57174

x/vuln: govulncheck panic: interface conversion: types.Type is *types.Interface, not *types.Array #57174

Comments

sixcolors commented Dec 8, 2022

What version of Go are you using (go version)?

Does this issue reproduce with the latest release?

What operating system and processor architecture are you using (go env)?

What did you do?

What did you expect to see?

What did you see instead?

zpavlinovic commented Dec 8, 2022 • edited

sixcolors commented Dec 8, 2022 • edited

sixcolors commented Dec 8, 2022

sixcolors commented Dec 8, 2022

zpavlinovic commented Dec 8, 2022 • edited

klauspost commented Dec 9, 2022

gopherbot commented Dec 10, 2022

harshavardhana commented Dec 12, 2022 • edited

zpavlinovic commented Dec 12, 2022

harshavardhana commented Dec 12, 2022

x/vuln: govulncheck panic: interface conversion: types.Type is types.Interface, not types.Array #57174

x/vuln: govulncheck panic: interface conversion: types.Type is types.Interface, not types.Array #57174

What version of Go are you using (`go version`)?

What operating system and processor architecture are you using (`go env`)?

zpavlinovic commented Dec 8, 2022 •

edited

sixcolors commented Dec 8, 2022 •

edited

zpavlinovic commented Dec 8, 2022 •

edited

harshavardhana commented Dec 12, 2022 •

edited