cmd/govulncheck: add test for "more call stacks available" Change-Id: Ib7031e6a32fb67aaf044e38828535244212c86fa Reviewed-on: https://go-review.googlesource.com/c/vuln/+/426579 Run-TryBot: Jonathan Amsterdam <jba@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Julie Qiu <julieqiu@google.com>
diff --git a/cmd/govulncheck/main_command_118_test.go b/cmd/govulncheck/main_command_118_test.go index f22c0b6..d3f0be7 100644 --- a/cmd/govulncheck/main_command_118_test.go +++ b/cmd/govulncheck/main_command_118_test.go
@@ -60,6 +60,7 @@ out, err := cmd.CombinedOutput() out = filterGoFilePaths(out) out = filterStdlibVersions(out) + out = filterHeapGo(out) return out, err } @@ -95,6 +96,7 @@ var ( goFileRegexp = regexp.MustCompile(`[^\s"]*\.go[\s":]`) stdlibVersionRegexp = regexp.MustCompile(`("Path": "stdlib",\s*"Version": ")v[^\s]+"`) + heapGoRegexp = regexp.MustCompile(`heap\.go:(\d+)`) ) // filterGoFilePaths modifies paths to Go files by replacing their directory with "...". @@ -115,3 +117,9 @@ func filterStdlibVersions(data []byte) []byte { return stdlibVersionRegexp.ReplaceAll(data, []byte(`${1}"`)) } + +// There was a one-line change in container/heap/heap.go between 1.18 +// and 1.19 that makes the stack traces different. Ignore it. +func filterHeapGo(data []byte) []byte { + return heapGoRegexp.ReplaceAll(data, []byte(`N`)) +}
diff --git a/cmd/govulncheck/testdata/modules/module3/go.mod b/cmd/govulncheck/testdata/modules/module3/go.mod new file mode 100644 index 0000000..bf8f7dc --- /dev/null +++ b/cmd/govulncheck/testdata/modules/module3/go.mod
@@ -0,0 +1,5 @@ +module module3 + +go 1.18 + +require github.com/shiyanhui/dht v0.0.0-20201219151056-5a20f3199263
diff --git a/cmd/govulncheck/testdata/modules/module3/go.sum b/cmd/govulncheck/testdata/modules/module3/go.sum new file mode 100644 index 0000000..8895f3b --- /dev/null +++ b/cmd/govulncheck/testdata/modules/module3/go.sum
@@ -0,0 +1,2 @@ +github.com/shiyanhui/dht v0.0.0-20201219151056-5a20f3199263 h1:bn/DPt4KK08FERSZhW2ZowG2t7zcLKYBnRze+mBgOL4= +github.com/shiyanhui/dht v0.0.0-20201219151056-5a20f3199263/go.mod h1:fw+pXaoy8a8A3OvcOLLlhr4Ty8+pWnPXs89FHHdiZBY=
diff --git a/cmd/govulncheck/testdata/modules/module3/main.go b/cmd/govulncheck/testdata/modules/module3/main.go new file mode 100644 index 0000000..01da09b --- /dev/null +++ b/cmd/govulncheck/testdata/modules/module3/main.go
@@ -0,0 +1,43 @@ +// This program prints peers in a bittorrent DHT. +package main + +import ( + "fmt" + "log" + "os" + "time" + + "github.com/shiyanhui/dht" +) + +func main() { + d := dht.New(nil) + nPeers := 0 + d.OnGetPeersResponse = func(infoHash string, peer *dht.Peer) { + fmt.Printf("GOT PEER: <%s:%d>\n", peer.IP, peer.Port) + nPeers++ + if nPeers >= 10 { + fmt.Printf("Done.\n") + os.Exit(0) + } + } + + go func() { + for { + // ubuntu-14.04.2-desktop-amd64.iso + err := d.GetPeers("546cf15f724d19c4319cc17b179d7e035f89c1f4") + if err != nil && err != dht.ErrNotReady { + log.Fatal(err) + } + + if err == dht.ErrNotReady { + time.Sleep(time.Second * 1) + continue + } + + break + } + }() + + d.Run() +}
diff --git a/cmd/govulncheck/testdata/more-stacks.ct b/cmd/govulncheck/testdata/more-stacks.ct new file mode 100644 index 0000000..d5354ad --- /dev/null +++ b/cmd/govulncheck/testdata/more-stacks.ct
@@ -0,0 +1,1133 @@ +$ cdmodule module3 +$ govulncheck -v . --> FAIL 3 +govulncheck is an experimental tool. Share feedback at https://go.dev/s/govulncheck-feedback. + +Scanning for dependencies with known vulnerabilities... +Found 1 known vulnerability. + +Vulnerability #1: GO-2020-0040 + Due to unchecked type assertions, maliciously crafted messages + can cause panics, which may be used as a denial of service + vector. + Call stacks in your code: + #1: for function DHT.GetPeers + module3.main + .../main.go:25:2 + module3.main$2 + .../main.go:28:21 + github.com/shiyanhui/dht.DHT.GetPeers + #2: for function DHT.IsCrawlMode + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:524:23 + github.com/shiyanhui/dht.DHT.IsCrawlMode + #3: for function DHT.IsStandardMode + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:270:10 + github.com/shiyanhui/dht.DHT.join + .../dht.go:207:34 + github.com/shiyanhui/dht.transactionManager.findNode + .../krpc.go:343:22 + github.com/shiyanhui/dht.DHT.id + .../dht.go:232:23 + github.com/shiyanhui/dht.DHT.IsStandardMode + #4: for function DHT.Run + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + #5: for function DHT.id + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:270:10 + github.com/shiyanhui/dht.DHT.join + .../dht.go:207:34 + github.com/shiyanhui/dht.transactionManager.findNode + .../krpc.go:343:22 + github.com/shiyanhui/dht.DHT.id + #6: for function DHT.init + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + #7: for function DHT.join + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:270:10 + github.com/shiyanhui/dht.DHT.join + #8: for function DHT.listen + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:269:12 + github.com/shiyanhui/dht.DHT.listen + #9: for function Decode + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:280:10 + github.com/shiyanhui/dht.handle + .../krpc.go:762:2 + github.com/shiyanhui/dht.handle$1 + .../krpc.go:771:22 + github.com/shiyanhui/dht.Decode + #10: for function DecodeDict + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:280:10 + github.com/shiyanhui/dht.handle + .../krpc.go:762:2 + github.com/shiyanhui/dht.handle$1 + .../krpc.go:771:22 + github.com/shiyanhui/dht.Decode + .../bencode.go:193:29 + github.com/shiyanhui/dht.decodeItem + .../bencode.go:93:25 + github.com/shiyanhui/dht.DecodeDict + #11: for function DecodeInt + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:280:10 + github.com/shiyanhui/dht.handle + .../krpc.go:762:2 + github.com/shiyanhui/dht.handle$1 + .../krpc.go:771:22 + github.com/shiyanhui/dht.Decode + .../bencode.go:193:29 + github.com/shiyanhui/dht.decodeItem + .../bencode.go:93:25 + github.com/shiyanhui/dht.DecodeInt + #12: for function DecodeList + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:280:10 + github.com/shiyanhui/dht.handle + .../krpc.go:762:2 + github.com/shiyanhui/dht.handle$1 + .../krpc.go:771:22 + github.com/shiyanhui/dht.Decode + .../bencode.go:193:29 + github.com/shiyanhui/dht.decodeItem + .../bencode.go:93:25 + github.com/shiyanhui/dht.DecodeList + #13: for function DecodeString + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:280:10 + github.com/shiyanhui/dht.handle + .../krpc.go:762:2 + github.com/shiyanhui/dht.handle$1 + .../krpc.go:771:22 + github.com/shiyanhui/dht.Decode + .../bencode.go:193:29 + github.com/shiyanhui/dht.decodeItem + .../bencode.go:93:25 + github.com/shiyanhui/dht.DecodeString + #14: for function Encode + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:193:2 + github.com/shiyanhui/dht.transactionManager.run + .../krpc.go:310:4 + github.com/shiyanhui/dht.transactionManager.query + .../krpc.go:285:17 + github.com/shiyanhui/dht.send + .../krpc.go:131:45 + github.com/shiyanhui/dht.Encode + #15: for function EncodeDict + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:193:2 + github.com/shiyanhui/dht.transactionManager.run + .../krpc.go:310:4 + github.com/shiyanhui/dht.transactionManager.query + .../krpc.go:285:17 + github.com/shiyanhui/dht.send + .../krpc.go:131:45 + github.com/shiyanhui/dht.Encode + .../bencode.go:259:20 + github.com/shiyanhui/dht.EncodeDict + #16: for function EncodeInt + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:193:2 + github.com/shiyanhui/dht.transactionManager.run + .../krpc.go:310:4 + github.com/shiyanhui/dht.transactionManager.query + .../krpc.go:285:17 + github.com/shiyanhui/dht.send + .../krpc.go:131:45 + github.com/shiyanhui/dht.Encode + .../bencode.go:255:19 + github.com/shiyanhui/dht.EncodeInt + #17: for function EncodeList + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:193:2 + github.com/shiyanhui/dht.transactionManager.run + .../krpc.go:310:4 + github.com/shiyanhui/dht.transactionManager.query + .../krpc.go:285:17 + github.com/shiyanhui/dht.send + .../krpc.go:131:45 + github.com/shiyanhui/dht.Encode + .../bencode.go:257:20 + github.com/shiyanhui/dht.EncodeList + #18: for function EncodeString + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:193:2 + github.com/shiyanhui/dht.transactionManager.run + .../krpc.go:310:4 + github.com/shiyanhui/dht.transactionManager.query + .../krpc.go:285:17 + github.com/shiyanhui/dht.send + .../krpc.go:131:45 + github.com/shiyanhui/dht.Encode + .../bencode.go:253:22 + github.com/shiyanhui/dht.EncodeString + #19: for function New + module3.main + .../main.go:14:14 + github.com/shiyanhui/dht.New + #20: for function NewStandardConfig + module3.main + .../main.go:14:14 + github.com/shiyanhui/dht.New + .../dht.go:135:29 + github.com/shiyanhui/dht.NewStandardConfig + #21: for function ParseKey + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:280:10 + github.com/shiyanhui/dht.handle + .../krpc.go:762:2 + github.com/shiyanhui/dht.handle$1 + .../krpc.go:776:32 + github.com/shiyanhui/dht.parseMessage + .../krpc.go:416:21 + github.com/shiyanhui/dht.ParseKeys + .../krpc.go:401:21 + github.com/shiyanhui/dht.ParseKey + #22: for function ParseKeys + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:280:10 + github.com/shiyanhui/dht.handle + .../krpc.go:762:2 + github.com/shiyanhui/dht.handle$1 + .../krpc.go:776:32 + github.com/shiyanhui/dht.parseMessage + .../krpc.go:416:21 + github.com/shiyanhui/dht.ParseKeys + #23: for function bitmap.Bit + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:187:36 + github.com/shiyanhui/dht.newRoutingTable + .../routingtable.go:351:50 + github.com/shiyanhui/dht.bitmap.String + .../bitmap.go:144:42 + github.com/shiyanhui/dht.bitmap.Bit + #24: for function bitmap.Compare + module3.main + .../main.go:25:2 + module3.main$2 + .../main.go:28:21 + github.com/shiyanhui/dht.DHT.GetPeers + .../dht.go:256:44 + github.com/shiyanhui/dht.routingTable.GetNeighbors + .../routingtable.go:426:22 + github.com/shiyanhui/dht.getTopK + .../routingtable.go:583:28 + github.com/shiyanhui/dht.bitmap.Compare + #25: for function bitmap.RawString + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:270:10 + github.com/shiyanhui/dht.DHT.join + .../dht.go:209:25 + github.com/shiyanhui/dht.bitmap.RawString + #26: for function bitmap.String + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:187:36 + github.com/shiyanhui/dht.newRoutingTable + .../routingtable.go:351:50 + github.com/shiyanhui/dht.bitmap.String + #27: for function bitmap.Xor + module3.main + .../main.go:25:2 + module3.main$2 + .../main.go:28:21 + github.com/shiyanhui/dht.DHT.GetPeers + .../dht.go:256:44 + github.com/shiyanhui/dht.routingTable.GetNeighbors + .../routingtable.go:426:22 + github.com/shiyanhui/dht.getTopK + .../routingtable.go:580:21 + github.com/shiyanhui/dht.bitmap.Xor + #28: for function blackList.clear + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:195:2 + github.com/shiyanhui/dht.blackList.clear + #29: for function blackList.genKey + module3.main + .../main.go:14:14 + github.com/shiyanhui/dht.New + .../dht.go:152:21 + github.com/shiyanhui/dht.blackList.insert + .../blacklist.go:47:23 + github.com/shiyanhui/dht.blackList.genKey + #30: for function blackList.in + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:280:10 + github.com/shiyanhui/dht.handle + .../krpc.go:762:2 + github.com/shiyanhui/dht.handle$1 + .../krpc.go:767:22 + github.com/shiyanhui/dht.blackList.in + #31: for function blackList.insert + module3.main + .../main.go:14:14 + github.com/shiyanhui/dht.New + .../dht.go:152:21 + github.com/shiyanhui/dht.blackList.insert + #32: for function decodeItem + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:280:10 + github.com/shiyanhui/dht.handle + .../krpc.go:762:2 + github.com/shiyanhui/dht.handle$1 + .../krpc.go:771:22 + github.com/shiyanhui/dht.Decode + .../bencode.go:193:29 + github.com/shiyanhui/dht.decodeItem + #33: for function encodeItem + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:193:2 + github.com/shiyanhui/dht.transactionManager.run + .../krpc.go:310:4 + github.com/shiyanhui/dht.transactionManager.query + .../krpc.go:285:17 + github.com/shiyanhui/dht.send + .../krpc.go:131:45 + github.com/shiyanhui/dht.Encode + .../bencode.go:257:20 + github.com/shiyanhui/dht.EncodeList + .../bencode.go:229:25 + github.com/shiyanhui/dht.encodeItem + #34: for function find + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:280:10 + github.com/shiyanhui/dht.handle + .../krpc.go:762:2 + github.com/shiyanhui/dht.handle$1 + .../krpc.go:771:22 + github.com/shiyanhui/dht.Decode + .../bencode.go:193:29 + github.com/shiyanhui/dht.decodeItem + .../bencode.go:93:25 + github.com/shiyanhui/dht.DecodeString + .../bencode.go:32:11 + github.com/shiyanhui/dht.find + #35: for function genAddress + module3.main + .../main.go:14:14 + github.com/shiyanhui/dht.New + .../dht.go:152:21 + github.com/shiyanhui/dht.blackList.insert + .../blacklist.go:47:23 + github.com/shiyanhui/dht.blackList.genKey + .../blacklist.go:36:19 + github.com/shiyanhui/dht.genAddress + #36: for function getLocalIPs + module3.main + .../main.go:14:14 + github.com/shiyanhui/dht.New + .../dht.go:155:2 + github.com/shiyanhui/dht.New$1 + .../dht.go:156:33 + github.com/shiyanhui/dht.getLocalIPs + #37: for function getRemoteIP + module3.main + .../main.go:14:14 + github.com/shiyanhui/dht.New + .../dht.go:155:2 + github.com/shiyanhui/dht.New$1 + .../dht.go:160:25 + github.com/shiyanhui/dht.getRemoteIP + #38: for function getTopK + module3.main + .../main.go:25:2 + module3.main$2 + .../main.go:28:21 + github.com/shiyanhui/dht.DHT.GetPeers + .../dht.go:256:44 + github.com/shiyanhui/dht.routingTable.GetNeighbors + .../routingtable.go:426:22 + github.com/shiyanhui/dht.getTopK + #39: for function handle + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:280:10 + github.com/shiyanhui/dht.handle + #40: for function int2bytes + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:270:10 + github.com/shiyanhui/dht.DHT.join + .../dht.go:207:34 + github.com/shiyanhui/dht.transactionManager.findNode + .../krpc.go:342:14 + github.com/shiyanhui/dht.transactionManager.sendQuery + .../krpc.go:326:33 + github.com/shiyanhui/dht.transactionManager.genTransID + .../krpc.go:180:25 + github.com/shiyanhui/dht.int2bytes + #41: for function kbucket.LastChanged + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:508:32 + github.com/shiyanhui/dht.kbucket.LastChanged + #42: for function kbucket.RandomChildID + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:517:64 + github.com/shiyanhui/dht.kbucket.RandomChildID + #43: for function kbucket.Replace + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:526:13 + github.com/shiyanhui/dht.routingTable.Remove + .../routingtable.go:488:17 + github.com/shiyanhui/dht.kbucket.Replace + #44: for function kbucket.UpdateTimestamp + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:526:13 + github.com/shiyanhui/dht.routingTable.Remove + .../routingtable.go:488:17 + github.com/shiyanhui/dht.kbucket.Replace + .../routingtable.go:209:24 + github.com/shiyanhui/dht.kbucket.UpdateTimestamp + #45: for function syncedList.Back + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:526:13 + github.com/shiyanhui/dht.routingTable.Remove + .../routingtable.go:488:17 + github.com/shiyanhui/dht.kbucket.Replace + .../routingtable.go:215:54 + github.com/shiyanhui/dht.syncedList.Back + #46: for function keyedDeque.Delete + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:526:13 + github.com/shiyanhui/dht.routingTable.Remove + .../routingtable.go:488:17 + github.com/shiyanhui/dht.kbucket.Replace + .../routingtable.go:208:21 + github.com/shiyanhui/dht.keyedDeque.Delete + #47: for function keyedDeque.Get + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:526:13 + github.com/shiyanhui/dht.routingTable.Remove + .../routingtable.go:487:39 + github.com/shiyanhui/dht.routingTable.GetNodeKBucktByID + .../routingtable.go:461:37 + github.com/shiyanhui/dht.keyedDeque.Get + #48: for function syncedList.InsertBefore + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:526:13 + github.com/shiyanhui/dht.routingTable.Remove + .../routingtable.go:488:17 + github.com/shiyanhui/dht.kbucket.Replace + .../routingtable.go:222:29 + github.com/shiyanhui/dht.syncedList.InsertBefore + #49: for function syncedList.Iter + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:506:39 + github.com/shiyanhui/dht.syncedList.Iter + #50: for function syncedList.Len + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:509:20 + github.com/shiyanhui/dht.syncedList.Len + #51: for function keyedDeque.Push + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:187:36 + github.com/shiyanhui/dht.newRoutingTable + .../routingtable.go:351:24 + github.com/shiyanhui/dht.keyedDeque.Push + #52: for function syncedList.PushBack + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:518:27 + github.com/shiyanhui/dht.syncedList.PushBack + #53: for function keyedDeque.Remove + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:526:13 + github.com/shiyanhui/dht.routingTable.Remove + .../routingtable.go:488:17 + github.com/shiyanhui/dht.kbucket.Replace + .../routingtable.go:215:31 + github.com/shiyanhui/dht.keyedDeque.Remove + #54: for function makeQuery + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:270:10 + github.com/shiyanhui/dht.DHT.join + .../dht.go:207:34 + github.com/shiyanhui/dht.transactionManager.findNode + .../krpc.go:342:14 + github.com/shiyanhui/dht.transactionManager.sendQuery + .../krpc.go:326:19 + github.com/shiyanhui/dht.makeQuery + #55: for function newBitmap + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:187:36 + github.com/shiyanhui/dht.newRoutingTable + .../routingtable.go:339:39 + github.com/shiyanhui/dht.newBitmap + #56: for function newBitmapFromBytes + module3.main + .../main.go:14:14 + github.com/shiyanhui/dht.New + .../dht.go:138:22 + github.com/shiyanhui/dht.newNode + .../routingtable.go:33:34 + github.com/shiyanhui/dht.newBitmapFromString + .../bitmap.go:57:27 + github.com/shiyanhui/dht.newBitmapFromBytes + #57: for function newBitmapFromString + module3.main + .../main.go:14:14 + github.com/shiyanhui/dht.New + .../dht.go:138:22 + github.com/shiyanhui/dht.newNode + .../routingtable.go:33:34 + github.com/shiyanhui/dht.newBitmapFromString + #58: for function newBlackList + module3.main + .../main.go:14:14 + github.com/shiyanhui/dht.New + .../dht.go:146:29 + github.com/shiyanhui/dht.newBlackList + #59: for function newKBucket + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:187:36 + github.com/shiyanhui/dht.newRoutingTable + .../routingtable.go:339:29 + github.com/shiyanhui/dht.newRoutingTableNode + .../routingtable.go:253:23 + github.com/shiyanhui/dht.newKBucket + #60: for function newKeyedDeque + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:187:36 + github.com/shiyanhui/dht.newRoutingTable + .../routingtable.go:346:32 + github.com/shiyanhui/dht.newKeyedDeque + #61: for function newNode + module3.main + .../main.go:14:14 + github.com/shiyanhui/dht.New + .../dht.go:138:22 + github.com/shiyanhui/dht.newNode + #62: for function newPeersManager + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:188:36 + github.com/shiyanhui/dht.newPeersManager + #63: for function newRoutingTable + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:187:36 + github.com/shiyanhui/dht.newRoutingTable + #64: for function newRoutingTableNode + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:187:36 + github.com/shiyanhui/dht.newRoutingTable + .../routingtable.go:339:29 + github.com/shiyanhui/dht.newRoutingTableNode + #65: for function newSyncedList + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:187:36 + github.com/shiyanhui/dht.newRoutingTable + .../routingtable.go:348:32 + github.com/shiyanhui/dht.newSyncedList + #66: for function newSyncedMap + module3.main + .../main.go:14:14 + github.com/shiyanhui/dht.New + .../dht.go:146:29 + github.com/shiyanhui/dht.newBlackList + .../blacklist.go:25:29 + github.com/shiyanhui/dht.newSyncedMap + #67: for function newTokenManager + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:189:36 + github.com/shiyanhui/dht.newTokenManager + #68: for function newTransactionManager + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:190:48 + github.com/shiyanhui/dht.newTransactionManager + #69: for function parseMessage + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:280:10 + github.com/shiyanhui/dht.handle + .../krpc.go:762:2 + github.com/shiyanhui/dht.handle$1 + .../krpc.go:776:32 + github.com/shiyanhui/dht.parseMessage + #70: for function randomString + module3.main + .../main.go:14:14 + github.com/shiyanhui/dht.New + .../dht.go:138:35 + github.com/shiyanhui/dht.randomString + #71: for function routingTable.Fresh + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + #72: for function routingTable.GetNeighbors + module3.main + .../main.go:25:2 + module3.main$2 + .../main.go:28:21 + github.com/shiyanhui/dht.DHT.GetPeers + .../dht.go:256:44 + github.com/shiyanhui/dht.routingTable.GetNeighbors + #73: for function routingTable.GetNodeKBucktByID + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:526:13 + github.com/shiyanhui/dht.routingTable.Remove + .../routingtable.go:487:39 + github.com/shiyanhui/dht.routingTable.GetNodeKBucktByID + #74: for function routingTable.Len + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:282:27 + github.com/shiyanhui/dht.routingTable.Len + #75: for function routingTable.Remove + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:526:13 + github.com/shiyanhui/dht.routingTable.Remove + #76: for function routingTable.RemoveByAddr + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:193:2 + github.com/shiyanhui/dht.transactionManager.run + .../krpc.go:310:4 + github.com/shiyanhui/dht.transactionManager.query + .../krpc.go:299:35 + github.com/shiyanhui/dht.routingTable.RemoveByAddr + #77: for function routingTableNode.Child + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:526:13 + github.com/shiyanhui/dht.routingTable.Remove + .../routingtable.go:487:39 + github.com/shiyanhui/dht.routingTable.GetNodeKBucktByID + .../routingtable.go:459:20 + github.com/shiyanhui/dht.routingTableNode.Child + #78: for function routingTableNode.KBucket + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:526:13 + github.com/shiyanhui/dht.routingTable.Remove + .../routingtable.go:487:39 + github.com/shiyanhui/dht.routingTable.GetNodeKBucktByID + .../routingtable.go:461:25 + github.com/shiyanhui/dht.routingTableNode.KBucket + #79: for function send + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:193:2 + github.com/shiyanhui/dht.transactionManager.run + .../krpc.go:310:4 + github.com/shiyanhui/dht.transactionManager.query + .../krpc.go:285:17 + github.com/shiyanhui/dht.send + #80: for function syncedList.Clear + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:530:21 + github.com/shiyanhui/dht.syncedList.Clear + #81: for function syncedList.Remove + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:187:36 + github.com/shiyanhui/dht.newRoutingTable + .../routingtable.go:351:24 + github.com/shiyanhui/dht.keyedDeque.Push + .../container.go:229:26 + github.com/shiyanhui/dht.syncedList.Remove + #82: for function syncedMap.Delete + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:285:5 + github.com/shiyanhui/dht.routingTable.Fresh + .../routingtable.go:526:13 + github.com/shiyanhui/dht.routingTable.Remove + .../routingtable.go:489:24 + github.com/shiyanhui/dht.syncedMap.Delete + #83: for function syncedMap.DeleteMulti + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:194:2 + github.com/shiyanhui/dht.tokenManager.clear + .../krpc.go:82:17 + github.com/shiyanhui/dht.syncedMap.DeleteMulti + #84: for function syncedMap.Get + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:280:10 + github.com/shiyanhui/dht.handle + .../krpc.go:762:2 + github.com/shiyanhui/dht.handle$1 + .../krpc.go:767:22 + github.com/shiyanhui/dht.blackList.in + .../blacklist.go:61:25 + github.com/shiyanhui/dht.syncedMap.Get + #85: for function syncedMap.Iter + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:194:2 + github.com/shiyanhui/dht.tokenManager.clear + .../krpc.go:76:28 + github.com/shiyanhui/dht.syncedMap.Iter + #86: for function syncedMap.Len + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:284:40 + github.com/shiyanhui/dht.transactionManager.len + .../krpc.go:229:28 + github.com/shiyanhui/dht.syncedMap.Len + #87: for function syncedMap.Set + module3.main + .../main.go:14:14 + github.com/shiyanhui/dht.New + .../dht.go:152:21 + github.com/shiyanhui/dht.blackList.insert + .../blacklist.go:47:13 + github.com/shiyanhui/dht.syncedMap.Set + #88: for function tokenManager.clear + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:194:2 + github.com/shiyanhui/dht.tokenManager.clear + #89: for function topKHeap.Len + module3.main + .../main.go:25:2 + module3.main$2 + .../main.go:28:21 + github.com/shiyanhui/dht.DHT.GetPeers + .../dht.go:256:44 + github.com/shiyanhui/dht.routingTable.GetNeighbors + .../routingtable.go:426:22 + github.com/shiyanhui/dht.getTopK + .../routingtable.go:581:18 + github.com/shiyanhui/dht.topKHeap.Len + #90: for function topKHeap.Less + module3.main + .../main.go:25:2 + module3.main$2 + .../main.go:28:21 + github.com/shiyanhui/dht.DHT.GetPeers + .../dht.go:256:44 + github.com/shiyanhui/dht.routingTable.GetNeighbors + .../routingtable.go:426:22 + github.com/shiyanhui/dht.getTopK + .../routingtable.go:588:14 + container/heap.Push + .../N:4 + container/heap.up + .../N:23 + github.com/shiyanhui/dht.topKHeap.Less + #91: for function topKHeap.Pop + module3.main + .../main.go:25:2 + module3.main$2 + .../main.go:28:21 + github.com/shiyanhui/dht.DHT.GetPeers + .../dht.go:256:44 + github.com/shiyanhui/dht.routingTable.GetNeighbors + .../routingtable.go:426:22 + github.com/shiyanhui/dht.getTopK + .../routingtable.go:589:13 + container/heap.Pop + .../N:14 + github.com/shiyanhui/dht.topKHeap.Pop + #92: for function topKHeap.Push + module3.main + .../main.go:25:2 + module3.main$2 + .../main.go:28:21 + github.com/shiyanhui/dht.DHT.GetPeers + .../dht.go:256:44 + github.com/shiyanhui/dht.routingTable.GetNeighbors + .../routingtable.go:426:22 + github.com/shiyanhui/dht.getTopK + .../routingtable.go:588:14 + container/heap.Push + .../N:8 + github.com/shiyanhui/dht.topKHeap.Push + #93: for function topKHeap.Swap + module3.main + .../main.go:25:2 + module3.main$2 + .../main.go:28:21 + github.com/shiyanhui/dht.DHT.GetPeers + .../dht.go:256:44 + github.com/shiyanhui/dht.routingTable.GetNeighbors + .../routingtable.go:426:22 + github.com/shiyanhui/dht.getTopK + .../routingtable.go:589:13 + container/heap.Pop + .../N:8 + github.com/shiyanhui/dht.topKHeap.Swap + #94: for function transactionManager.delete + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:193:2 + github.com/shiyanhui/dht.transactionManager.run + .../krpc.go:310:4 + github.com/shiyanhui/dht.transactionManager.query + .../krpc.go:281:2 + github.com/shiyanhui/dht.transactionManager.delete + #95: for function transactionManager.findNode + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:270:10 + github.com/shiyanhui/dht.DHT.join + .../dht.go:207:34 + github.com/shiyanhui/dht.transactionManager.findNode + #96: for function transactionManager.genIndexKey + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:270:10 + github.com/shiyanhui/dht.DHT.join + .../dht.go:207:34 + github.com/shiyanhui/dht.transactionManager.findNode + .../krpc.go:342:14 + github.com/shiyanhui/dht.transactionManager.sendQuery + .../krpc.go:321:31 + github.com/shiyanhui/dht.transactionManager.genIndexKey + #97: for function transactionManager.genIndexKeyByTrans + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:193:2 + github.com/shiyanhui/dht.transactionManager.run + .../krpc.go:310:4 + github.com/shiyanhui/dht.transactionManager.query + .../krpc.go:280:11 + github.com/shiyanhui/dht.transactionManager.insert + .../krpc.go:209:36 + github.com/shiyanhui/dht.transactionManager.genIndexKeyByTrans + #98: for function transactionManager.genTransID + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:270:10 + github.com/shiyanhui/dht.DHT.join + .../dht.go:207:34 + github.com/shiyanhui/dht.transactionManager.findNode + .../krpc.go:342:14 + github.com/shiyanhui/dht.transactionManager.sendQuery + .../krpc.go:326:33 + github.com/shiyanhui/dht.transactionManager.genTransID + #99: for function transactionManager.getByIndex + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:270:10 + github.com/shiyanhui/dht.DHT.join + .../dht.go:207:34 + github.com/shiyanhui/dht.transactionManager.findNode + .../krpc.go:342:14 + github.com/shiyanhui/dht.transactionManager.sendQuery + .../krpc.go:321:16 + github.com/shiyanhui/dht.transactionManager.getByIndex + #100: for function transactionManager.getPeers + module3.main + .../main.go:25:2 + module3.main$2 + .../main.go:28:21 + github.com/shiyanhui/dht.DHT.GetPeers + .../dht.go:260:34 + github.com/shiyanhui/dht.transactionManager.getPeers + #101: for function transactionManager.insert + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:193:2 + github.com/shiyanhui/dht.transactionManager.run + .../krpc.go:310:4 + github.com/shiyanhui/dht.transactionManager.query + .../krpc.go:280:11 + github.com/shiyanhui/dht.transactionManager.insert + #102: for function transactionManager.len + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:284:40 + github.com/shiyanhui/dht.transactionManager.len + #103: for function transactionManager.newTransaction + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:193:2 + github.com/shiyanhui/dht.transactionManager.run + .../krpc.go:310:4 + github.com/shiyanhui/dht.transactionManager.query + .../krpc.go:278:28 + github.com/shiyanhui/dht.transactionManager.newTransaction + #104: for function transactionManager.query + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:193:2 + github.com/shiyanhui/dht.transactionManager.run + .../krpc.go:310:4 + github.com/shiyanhui/dht.transactionManager.query + #105: for function transactionManager.run + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:268:10 + github.com/shiyanhui/dht.DHT.init + .../dht.go:193:2 + github.com/shiyanhui/dht.transactionManager.run + #106: for function transactionManager.sendQuery + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:270:10 + github.com/shiyanhui/dht.DHT.join + .../dht.go:207:34 + github.com/shiyanhui/dht.transactionManager.findNode + .../krpc.go:342:14 + github.com/shiyanhui/dht.transactionManager.sendQuery + #107: for function transactionManager.transaction + module3.main + .../main.go:42:7 + github.com/shiyanhui/dht.DHT.Run + .../dht.go:270:10 + github.com/shiyanhui/dht.DHT.join + .../dht.go:207:34 + github.com/shiyanhui/dht.transactionManager.findNode + .../krpc.go:342:14 + github.com/shiyanhui/dht.transactionManager.sendQuery + .../krpc.go:321:16 + github.com/shiyanhui/dht.transactionManager.getByIndex + .../krpc.go:257:23 + github.com/shiyanhui/dht.transactionManager.transaction + #108: for function xor + module3.main + .../main.go:25:2 + module3.main$2 + .../main.go:28:21 + github.com/shiyanhui/dht.DHT.GetPeers + .../dht.go:256:44 + github.com/shiyanhui/dht.routingTable.GetNeighbors + .../routingtable.go:426:22 + github.com/shiyanhui/dht.getTopK + .../routingtable.go:580:21 + github.com/shiyanhui/dht.bitmap.Xor + .../bitmap.go:129:5 + github.com/shiyanhui/dht.xor + There are 19 more call stacks available. + To see all of them, pass the -json flags. + + Found in: github.com/shiyanhui/dht@v0.0.0-20201219151056-5a20f3199263 + Fixed in: N/A + More info: https://pkg.go.dev/vuln/GO-2020-0040 +
diff --git a/cmd/govulncheck/testdata/vulndb/github.com/shiyanhui/dht.json b/cmd/govulncheck/testdata/vulndb/github.com/shiyanhui/dht.json new file mode 100644 index 0000000..93f069d --- /dev/null +++ b/cmd/govulncheck/testdata/vulndb/github.com/shiyanhui/dht.json
@@ -0,0 +1 @@ +[{"id":"GO-2020-0040","published":"2021-04-14T20:04:52Z","modified":"2022-08-29T16:50:59Z","aliases":["CVE-2020-36562"],"details":"Due to unchecked type assertions, maliciously crafted messages can\ncause panics, which may be used as a denial of service vector.\n","affected":[{"package":{"name":"github.com/shiyanhui/dht","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2020-0040"},"ecosystem_specific":{"imports":[{"path":"github.com/shiyanhui/dht"}]}}],"references":[{"type":"WEB","url":"https://github.com/shiyanhui/dht/issues/57"}]}]