Skip to content

Conversation

jaym
Copy link
Contributor

@jaym jaym commented Jul 18, 2025

I can get cnquery to panic with the following:

go run ./apps/cnspec/ run local -c "
lsblkDevice = parse.json(content: command('lsblk -a --json -s overlay').stdout).params
lsblkDevice['blockdevices'][0]['children'][0]['type'] == 'crypt' || lsblkDevice['blockdevices'][0]['type'] == 'crypt'
"
panic: runtime error: index out of range [0] with length 0

goroutine 93 [running]:
go.mondoo.com/cnquery/v11/llx.dictGetIndexV2(0x32c9590?, 0xc001b86180, 0x2cd4c13?, 0x2?)
	/home/jaym/workspace/mondoo/cnquery/llx/builtin_map.go:371 +0x64b
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runBoundFunction(0xc0004a9f10, 0xc001b86180, 0xc00181c280, 0x100000007)
	/home/jaym/workspace/mondoo/cnquery/llx/builtin.go:905 +0x16e
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runFunction(0xc0004a9f10, 0xc00181c280, 0x100000007)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:816 +0x173
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runChunk(0xc0004a9f10, 0xc0017d9058?, 0x100000007)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:833 +0x225
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runRef(0xc001a84b60?, 0x0?)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:858 +0xd9
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runChain(0xc0004a9f10, 0x40cae6?)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:890 +0x94
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).triggerChain(0xc0004a9f10, 0x100000004, 0xc001b860f0)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:962 +0x32e
go.mondoo.com/cnquery/v11/llx.runResourceFunction.func1({0x2886360, 0xc001b86060}, {0x0, 0x0})
	/home/jaym/workspace/mondoo/cnquery/llx/builtin.go:852 +0x209
go.mondoo.com/cnquery/v11/providers.(*Runtime).WatchAndUpdate(0xc000679780, {0x3269188, 0xc001908440}, {0xc0011bfd00, 0x6}, {0xc0012cc100, 0x31}, 0xc001902ea0)
	/home/jaym/workspace/mondoo/cnquery/providers/runtime.go:385 +0xe2
go.mondoo.com/cnquery/v11/llx.runResourceFunction(0xc0004a9f10, 0xc001902e40?, 0xc00181c0f0, 0x100000004)
	/home/jaym/workspace/mondoo/cnquery/llx/builtin.go:833 +0x2d7
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runBoundFunction(0xc0004a9f10, 0xc001902e40, 0xc00181c0f0, 0x100000004)
	/home/jaym/workspace/mondoo/cnquery/llx/builtin.go:899 +0x38a
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runFunction(0xc0004a9f10, 0xc00181c0f0, 0x100000004)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:816 +0x173
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runChunk(0xc0004a9f10, 0xc0017d9528?, 0x100000004)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:833 +0x225
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runRef(0xc001a84b60?, 0xc00056f6e0?)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:858 +0xd9
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runChain(0xc0004a9f10, 0x40cae6?)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:890 +0x94
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).triggerChain(0xc0004a9f10, 0x100000002, 0xc00056f710)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:962 +0x32e
go.mondoo.com/cnquery/v11/llx.runResourceFunction.func1({0x26848e0, 0xc00178e570}, {0x0, 0x0})
	/home/jaym/workspace/mondoo/cnquery/llx/builtin.go:852 +0x209
go.mondoo.com/cnquery/v11/providers.(*Runtime).WatchAndUpdate(0xc000679780, {0x3269188, 0xc000ac39e0}, {0xc0011bfcf8, 0x6}, {0xc0011c9f00, 0x31}, 0xc00182c3c0)
	/home/jaym/workspace/mondoo/cnquery/providers/runtime.go:385 +0xe2
go.mondoo.com/cnquery/v11/llx.runResourceFunction(0xc0004a9f10, 0xc00182c360?, 0xc000b0fef0, 0x100000002)
	/home/jaym/workspace/mondoo/cnquery/llx/builtin.go:833 +0x2d7
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runBoundFunction(0xc0004a9f10, 0xc00182c360, 0xc000b0fef0, 0x100000002)
	/home/jaym/workspace/mondoo/cnquery/llx/builtin.go:899 +0x38a
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runFunction(0xc0004a9f10, 0xc000b0fef0, 0x100000002)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:816 +0x173
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runChunk(0xc0004a9f10, 0xc00182b9f8?, 0x100000002)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:833 +0x225
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runRef(0xc001a84b60?, 0xc0000e7a70?)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:858 +0xd9
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runChain(0xc0004a9f10, 0x2cdb239?)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:890 +0x94
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).run(0xc0004a9f10)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:358 +0x317
go.mondoo.com/cnquery/v11/llx.(*MQLExecutorV2).Run(0xc000d0f140?)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:288 +0x53
go.mondoo.com/cnquery/v11/mql/internal.(*executionManager).executeCodeBundle(0xc000d0f440, 0xc0011e0be0, 0xc001a81c20, {0x0, 0x0})
	/home/jaym/workspace/mondoo/cnquery/mql/internal/execution_manager.go:170 +0x5b9
go.mondoo.com/cnquery/v11/mql/internal.(*executionManager).Start.func1()
	/home/jaym/workspace/mondoo/cnquery/mql/internal/execution_manager.go:88 +0x1cb
created by go.mondoo.com/cnquery/v11/mql/internal.(*executionManager).Start in goroutine 1
	/home/jaym/workspace/mondoo/cnquery/mql/internal/execution_manager.go:57 +0x65

I've made the index lookup behave like a regular typed array

I can get cnquery to panic with the following:
```
go run ./apps/cnspec/ run local -c "
lsblkDevice = parse.json(content: command('lsblk -a --json -s overlay').stdout).params
lsblkDevice['blockdevices'][0]['children'][0]['type'] == 'crypt' || lsblkDevice['blockdevices'][0]['type'] == 'crypt'
"
```

```
panic: runtime error: index out of range [0] with length 0

goroutine 93 [running]:
go.mondoo.com/cnquery/v11/llx.dictGetIndexV2(0x32c9590?, 0xc001b86180, 0x2cd4c13?, 0x2?)
	/home/jaym/workspace/mondoo/cnquery/llx/builtin_map.go:371 +0x64b
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runBoundFunction(0xc0004a9f10, 0xc001b86180, 0xc00181c280, 0x100000007)
	/home/jaym/workspace/mondoo/cnquery/llx/builtin.go:905 +0x16e
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runFunction(0xc0004a9f10, 0xc00181c280, 0x100000007)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:816 +0x173
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runChunk(0xc0004a9f10, 0xc0017d9058?, 0x100000007)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:833 +0x225
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runRef(0xc001a84b60?, 0x0?)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:858 +0xd9
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runChain(0xc0004a9f10, 0x40cae6?)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:890 +0x94
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).triggerChain(0xc0004a9f10, 0x100000004, 0xc001b860f0)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:962 +0x32e
go.mondoo.com/cnquery/v11/llx.runResourceFunction.func1({0x2886360, 0xc001b86060}, {0x0, 0x0})
	/home/jaym/workspace/mondoo/cnquery/llx/builtin.go:852 +0x209
go.mondoo.com/cnquery/v11/providers.(*Runtime).WatchAndUpdate(0xc000679780, {0x3269188, 0xc001908440}, {0xc0011bfd00, 0x6}, {0xc0012cc100, 0x31}, 0xc001902ea0)
	/home/jaym/workspace/mondoo/cnquery/providers/runtime.go:385 +0xe2
go.mondoo.com/cnquery/v11/llx.runResourceFunction(0xc0004a9f10, 0xc001902e40?, 0xc00181c0f0, 0x100000004)
	/home/jaym/workspace/mondoo/cnquery/llx/builtin.go:833 +0x2d7
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runBoundFunction(0xc0004a9f10, 0xc001902e40, 0xc00181c0f0, 0x100000004)
	/home/jaym/workspace/mondoo/cnquery/llx/builtin.go:899 +0x38a
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runFunction(0xc0004a9f10, 0xc00181c0f0, 0x100000004)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:816 +0x173
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runChunk(0xc0004a9f10, 0xc0017d9528?, 0x100000004)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:833 +0x225
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runRef(0xc001a84b60?, 0xc00056f6e0?)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:858 +0xd9
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runChain(0xc0004a9f10, 0x40cae6?)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:890 +0x94
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).triggerChain(0xc0004a9f10, 0x100000002, 0xc00056f710)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:962 +0x32e
go.mondoo.com/cnquery/v11/llx.runResourceFunction.func1({0x26848e0, 0xc00178e570}, {0x0, 0x0})
	/home/jaym/workspace/mondoo/cnquery/llx/builtin.go:852 +0x209
go.mondoo.com/cnquery/v11/providers.(*Runtime).WatchAndUpdate(0xc000679780, {0x3269188, 0xc000ac39e0}, {0xc0011bfcf8, 0x6}, {0xc0011c9f00, 0x31}, 0xc00182c3c0)
	/home/jaym/workspace/mondoo/cnquery/providers/runtime.go:385 +0xe2
go.mondoo.com/cnquery/v11/llx.runResourceFunction(0xc0004a9f10, 0xc00182c360?, 0xc000b0fef0, 0x100000002)
	/home/jaym/workspace/mondoo/cnquery/llx/builtin.go:833 +0x2d7
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runBoundFunction(0xc0004a9f10, 0xc00182c360, 0xc000b0fef0, 0x100000002)
	/home/jaym/workspace/mondoo/cnquery/llx/builtin.go:899 +0x38a
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runFunction(0xc0004a9f10, 0xc000b0fef0, 0x100000002)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:816 +0x173
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runChunk(0xc0004a9f10, 0xc00182b9f8?, 0x100000002)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:833 +0x225
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runRef(0xc001a84b60?, 0xc0000e7a70?)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:858 +0xd9
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).runChain(0xc0004a9f10, 0x2cdb239?)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:890 +0x94
go.mondoo.com/cnquery/v11/llx.(*blockExecutor).run(0xc0004a9f10)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:358 +0x317
go.mondoo.com/cnquery/v11/llx.(*MQLExecutorV2).Run(0xc000d0f140?)
	/home/jaym/workspace/mondoo/cnquery/llx/llx.go:288 +0x53
go.mondoo.com/cnquery/v11/mql/internal.(*executionManager).executeCodeBundle(0xc000d0f440, 0xc0011e0be0, 0xc001a81c20, {0x0, 0x0})
	/home/jaym/workspace/mondoo/cnquery/mql/internal/execution_manager.go:170 +0x5b9
go.mondoo.com/cnquery/v11/mql/internal.(*executionManager).Start.func1()
	/home/jaym/workspace/mondoo/cnquery/mql/internal/execution_manager.go:88 +0x1cb
created by go.mondoo.com/cnquery/v11/mql/internal.(*executionManager).Start in goroutine 1
	/home/jaym/workspace/mondoo/cnquery/mql/internal/execution_manager.go:57 +0x65
```

I've made the index lookup behave like a regular typed array
Copy link
Contributor

github-actions bot commented Jul 18, 2025

Test Results

4 350 tests  +5   4 346 ✅ +5   2m 11s ⏱️ -4s
  408 suites ±0       4 💤 ±0 
   30 files   ±0       0 ❌ ±0 

Results for commit c5baf3f. ± Comparison against base commit 981ea77.

♻️ This comment has been updated with latest results.

@jaym jaym force-pushed the jdm/dict-arr-panic branch from 49535d0 to c5baf3f Compare July 21, 2025 09:22
@preslavgerchev preslavgerchev merged commit 39ff14e into main Jul 21, 2025
17 checks passed
@preslavgerchev preslavgerchev deleted the jdm/dict-arr-panic branch July 21, 2025 14:35
@github-actions github-actions bot locked and limited conversation to collaborators Jul 21, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants