What version of Go are you using (go version)?

$ go version
go version go1.19.9 darwin/arm64

Does this issue reproduce at the latest version of golang.org/x/vuln?

Yes

What operating system and processor architecture are you using (go env)?

Darwin

What did you do?

I have a rather big project.

I was using go 1.19.9. Then, this vulnerability was published

https://pkg.go.dev/vuln/GO-2023-1840

When I run govulncheck ./..., it eats 8 cores for 5 minutes.

That is not normal. Go vulncheck should not take that much longer than code build. When before this vuln, it took seconds.

I know that I am using an old go version, which I did not notice. But then govulncheck should warn me, not hang.

Below is the actual issue in the govulncheck code.

When doing pprof, I figured out it's collecting all the traces where any function from runtime was used, and spending all the time on sorting slices.

The issue is at func CallStacks(res *Result) map[*Vuln][]CallStack {

It seems that the for _, vuln := range res.Vulns { is run 2052 times, and for each one, there is about 50000 of them for each.

When I made a small adjustment to the code, it fixed it instantly. That is, in witness.go - https://go.googlesource.com/vuln/+/refs/heads/master/internal/vulncheck/witness.go , instead of

		for _, cs := range callsites(f.CallSites, seen) {
			nStack := &callChain{f: cs.Parent, call: cs, child: c}
			if entries[cs.Parent] {
				stacks = append(stacks, nStack.CallStack())
			}
			queue.PushBack(nStack)
		}

I added (very dumb)

		for _, cs := range callsites(f.CallSites, seen) {
			nStack := &callChain{f: cs.Parent, call: cs, child: c}
			if entries[cs.Parent] {
				stacks = append(stacks, nStack.CallStack())
                                 if len(stacks)>10 {return stacks}
			}
			queue.PushBack(nStack)
		}

it worked well.

I think govulncheck is trying to get all the usages of all runtime functions, which then tries to somehow sort thousands of call stacks over and over. (2000 times getting and sorting 50.000 call stacks, I guess)

The simple fix is to just limit how many stacks will this collect. As the user still sees just 27 stacks....

What did you expect to see?

See above

What did you see instead?

See above