goroutine stack problems

[Carlson-JLQ]

What happened:
report bug:
runtime: goroutine stack exceeds 1000000000-byte limit
runtime: sp=0xc022486328 stack=[0xc022486000, 0xc042486000]
fatal error: stack overflow

runtime stack:
runtime.throw({0x199c660?, 0x0?})
/opt/hostedtoolcache/go/1.22.5/x64/src/runtime/panic.go:1023 +0x5c fp=0xc000c0be18 sp=0xc000c0bde8 pc=0x43debc
runtime.newstack()
/opt/hostedtoolcache/go/1.22.5/x64/src/runtime/stack.go:1103 +0x5bd fp=0xc000c0bfc8 sp=0xc000c0be18 pc=0x45ad9d
runtime.morestack()
/opt/hostedtoolcache/go/1.22.5/x64/src/runtime/asm_amd64.s:616 +0x7a fp=0xc000c0bfd0 sp=0xc000c0bfc8 pc=0x47779a

goroutine 131 gp=0xc000682a80 m=23 mp=0xc000781808 [running]:
runtime.makeslice(0x16bec40?, 0x0?, 0x0?)
/opt/hostedtoolcache/go/1.22.5/x64/src/runtime/slice.go:92 +0xb3 fp=0xc022486338 sp=0xc022486330 pc=0x4587d3
github.com/scylladb/go-set/strset.(*Set).List(...)

What you expected to happen:
When I use Syft to scan a folder, I want to obtain the dependency components inside the folder, but the above error occurs.
Steps to reproduce the issue:
syft_1.11.0/./syft scan /Deb/src/bnd-debian-5.0.1-3
Anything else we need to know?:

Environment: ubuntu 20.04

• Output of syft version: syft 1.11.0
• OS (e.g: cat /etc/os-release or similar): ubuntu 20.04

[kzantow]

hey @Carlson-JLQ could you expand on the steps to reproduce this issue? syft_1.11.0/./syft scan /Deb/src/bnd-debian-5.0.1-3 could be quite a lot of different things, we really don't know what that directory contains.

[Carlson-JLQ]

hey @Carlson-JLQ could you expand on the steps to reproduce this issue? could be quite a lot of different things, we really don't know what that directory contains.syft_1.11.0/./syft scan /Deb/src/bnd-debian-5.0.1-3
hey@kzantow ,please follow the steps:

1. download the package : wget https://salsa.debian.org/java-team/bnd/-/archive/debian/5.0.1-3/bnd-debian-5.0.1-3.zip
2. unzip bnd-debian-5.0.1-3.zip
3. syft_1.11.0/./syft scan bnd-debian-5.0.1-3

more information about the package : https://salsa.debian.org/java-team/bnd.git

[Carlson-JLQ]

I look forward to your reply and hope to resolve this issue.

[willmurphyscode]

Hi @Carlson-JLQ,

This issue no longer happens for me on Syft 1.15.0. I believe it was fixed by #3170, which was released in https://github.com/anchore/syft/releases/tag/v1.12.2.

I'm going to close this for now, since I believe the issue is fixed. Please let us know if we've missed something.