syft is now throwing panic with version 0.66.1

[aeg]

Please provide a set of steps on how to reproduce the issue
Run syft version 0.66.1 with certain Mach-O binaries, an error occurs .

syft packages dir:/home/xxx

What happened:

 ? Cataloging packages     [packages 0]panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x38 pc=0xd43b7a]

goroutine 39 [running]:
github.com/anchore/syft/syft/pkg/cataloger/java.nativeImageMachO.fetchPkgs({0xc004a7675e?})
        /home/runner/work/syft/syft/syft/pkg/cataloger/java/graalvm_native_image_cataloger.go:325 +0x5a
github.com/anchore/syft/syft/pkg/cataloger/java.fetchPkgs({0x7fb613711f20?, 0xc008cd3f38?}, {0xc004a7675e, 0x80})
        /home/runner/work/syft/syft/syft/pkg/cataloger/java/graalvm_native_image_cataloger.go:521 +0x23e
github.com/anchore/syft/syft/pkg/cataloger/java.(*NativeImageCataloger).Catalog(0xc0005f43c0?, {0x145dd18, 0xc000210230})
        /home/runner/work/syft/syft/syft/pkg/cataloger/java/graalvm_native_image_cataloger.go:551 +0x4e5
github.com/anchore/syft/syft/pkg/cataloger.runCataloger({0x14561b0, 0x1d55e10}, {0x145dd18?, 0xc000210230})
        /home/runner/work/syft/syft/syft/pkg/cataloger/catalog.go:57 +0x188
github.com/anchore/syft/syft/pkg/cataloger.Catalog.func1()
        /home/runner/work/syft/syft/syft/pkg/cataloger/catalog.go:127 +0x105
created by github.com/anchore/syft/syft/pkg/cataloger.Catalog
        /home/runner/work/syft/syft/syft/pkg/cataloger/catalog.go:122 +0x2aa

What you expected to happen:

Scan should proceed with results produced.

Anything else we need to know?:

The file that caused the panic is "go/pkg/mod/golang.org/x/tools@v0.0.0-20191109212701-97ad0ed33101/cmd/splitdwarf/internal/macho/testdata/gcc-amd64-darwin-exec-debug".

I traced this error.
When the panic has occured, syft/pkg/cataloger/java/graalvm_native_image_cataloger.go: L.325
bi.Symtab is nil .

L.325 	for _, s := range bi.Symtab.Syms {

I put in the check code to try it out and it completed with no problems.

	if bi.Symtab == nil {
		log.Debugf("native-image cataloger: %v.", nativeImageMissingSymbolsError)
		return nil, errors.New(nativeImageMissingSymbolsError)
	}

Environment:

• Output of syft version: 0.66.1
• OS (e.g: cat /etc/os-release or similar):20.04.5 LTS (Focal Fossa)

[erik-bershel]

Got the same issue for macOS 11.7.2 (20G1020)

[kzantow]

Thanks for the report -- is there a public image you could provide that exhibited this problem?

[erik-bershel]

@kzantow public runner image of macOS 11 for example. I have tried on latest one. It happens with different files.
Another two examples:


Add:
And the same for macOS12. Found that only last minute.

[aeg]

Thanks for responding.

% wget https://raw.githubusercontent.com/blacktop/go-macho/master/internal/testdata/gcc-amd64-darwin-exec-debug.base64
% base64 -d gcc-amd64-darwin-exec-debug.base64  > gcc-amd64-darwin-exec-debug
% file gcc-amd64-darwin-exec-debug
gcc-amd64-darwin-exec-debug: Mach-O 64-bit x86_64 dSYM companion file
% syft packages file:./gcc-amd64-darwin-exec-debug

I'm not sure whether "gcc-amd64-darwin-exec-debug" is correct binary or not,but it causes panic.