Nil Pointer Dereference in Terraform Plan JSON Parser

[pxp928]

Description

Trivy crashes with a nil pointer dereference panic when parsing certain Terraform plan JSON files in the buildPlanBlocks function.

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x50 pc=0x10327ddd0]

goroutine 1 [running]:
github.com/aquasecurity/trivy/pkg/iac/scanners/terraformplan/tfjson/parser.buildPlanBlocks(...)
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraformplan/tfjson/parser/parser.go:68 +0x3e0

The panic occurs at parser.go:68 when attempting to access the After field of a nil ResourceChange pointer:

changes := getValues(r.Address, resourceChanges)  // Line 67
resource := decodeBlock(schema, changes.After)     // Line 68 - PANIC: changes is nil

func getValues(address string, resourceChange []ResourceChange) *ResourceChange {
	for _, r := range resourceChange {
		if r.Address == address {
			return &r
		}
	}
	return nil  // Returns nil if no match found
}

Desired Behavior

Does not error and skip as needed

Actual Behavior

panic: runtime error: invalid memory address or nil pointer dereference

Reproduction Steps

All I did was run `trivy repo --scanners misconfig --format json -o misconfig.json ./` on our internal monorepo

Target

Filesystem

Scanner

Misconfiguration

Output Format

JSON

Mode

Standalone

Debug Output

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x50 pc=0x103175dd0]

goroutine 1 [running]:
github.com/aquasecurity/trivy/pkg/iac/scanners/terraformplan/tfjson/parser.buildPlanBlocks({{0x13eaf91b8a00, 0x2, 0x2}, {0x0, 0x0, 0x0}, {0x0, 0x0}}, {0x10b5061c8, 0x0, ...}, ...)
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraformplan/tfjson/parser/parser.go:68 +0x3e0
github.com/aquasecurity/trivy/pkg/iac/scanners/terraformplan/tfjson/parser.(*PlanFile).ToFS(0x13eb14431938?)
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraformplan/tfjson/parser/parser.go:41 +0x6c
github.com/aquasecurity/trivy/pkg/iac/scanners/terraformplan/tfjson.(*Scanner).Scan(0x13eaf803e060, {0x10ae84d78, 0x13eb083a1350}, {0x10adf5260?, 0x13eaf2c85228?})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraformplan/tfjson/scanner.go:86 +0x44
github.com/aquasecurity/trivy/pkg/iac/scanners/terraformplan/tfjson.(*Scanner).ScanFile(0x13eaf803e060, {0x10ae84d78, 0x13eb083a1350}, {0x13eb0ed3fbd0, 0x45}, {0x10adf5c40, 0x13eb124bc150})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraformplan/tfjson/scanner.go:77 +0x1a0
github.com/aquasecurity/trivy/pkg/iac/scanners/terraformplan/tfjson.(*Scanner).ScanFS.func1({0x13eb0ed3fbd0, 0x45}, {0x10ae85c10?, 0x13eafcd3fae0?}, {0x0?, 0x0?})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraformplan/tfjson/scanner.go:40 +0x90
io/fs.walkDir({0x10adf5c40, 0x13eb124bc150}, {0x13eb0ed3fbd0, 0x45}, {0x10ae85c10, 0x13eafcd3fae0}, 0x13eb14432270)
	io/fs/walk.go:73 +0x5c
io/fs.walkDir({0x10adf5c40, 0x13eb124bc150}, {0x13eb11584540, 0x2e}, {0x10ae85c10, 0x13eb13e462a8}, 0x13eb14432270)
	io/fs/walk.go:95 +0x22c
io/fs.walkDir({0x10adf5c40, 0x13eb124bc150}, {0x13eb11584480, 0x25}, {0x10ae85c10, 0x13eb10ada0c8}, 0x13eb14432270)
	io/fs/walk.go:95 +0x22c
io/fs.walkDir({0x10adf5c40, 0x13eb124bc150}, {0x13eb10dcd360, 0x1f}, {0x10ae85c10, 0x13eb07221748}, 0x13eb14432270)
	io/fs/walk.go:95 +0x22c
io/fs.walkDir({0x10adf5c40, 0x13eb124bc150}, {0x13eaf8e85ab8, 0x15}, {0x10ae85c10, 0x13eb0b30a7a8}, 0x13eb14432270)
	io/fs/walk.go:95 +0x22c
io/fs.walkDir({0x10adf5c40, 0x13eb124bc150}, {0x13eafe90edf0, 0xe}, {0x10ae85c10, 0x13eaf9309428}, 0x13eb14432270)
	io/fs/walk.go:95 +0x22c
io/fs.walkDir({0x10adf5c40, 0x13eb124bc150}, {0x13eafe90ed08, 0x4}, {0x10ae85c10, 0x13eaffc477e8}, 0x13eb14432270)
	io/fs/walk.go:95 +0x22c
io/fs.walkDir({0x10adf5c40, 0x13eb124bc150}, {0x105ad1ed0, 0x1}, {0x10ae84fe0, 0x13eb157ff900}, 0x13eb14432270)
	io/fs/walk.go:95 +0x22c
io/fs.WalkDir({0x10adf5c40, 0x13eb124bc150}, {0x105ad1ed0, 0x1}, 0x13eb14432270)
	io/fs/walk.go:122 +0x84
github.com/aquasecurity/trivy/pkg/iac/scanners/terraformplan/tfjson.(*Scanner).ScanFS(0x10ae84d78?, {0x10ae84d78?, 0x13eb083a1350?}, {0x10adf5c40?, 0x13eb124bc150?}, {0x105ad1ed0?, 0x0?})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraformplan/tfjson/scanner.go:49 +0x6c
github.com/aquasecurity/trivy/pkg/misconf.(*Scanner).Scan(0x13eaf7d595c0, {0x10ae84e20, 0x13eaf1e51ce0}, {0x10adf5c40, 0x13eb0d17d0f8})
	github.com/aquasecurity/trivy/pkg/misconf/scanner.go:159 +0x208
github.com/aquasecurity/trivy/pkg/fanal/analyzer/config.(*Analyzer).PostAnalyze(0x13eaf7ff85e0, {0x10ae84e20?, 0x13eaf1e51ce0?}, {{0x10adf5c40, 0x13eb0d17d0f8}, {0x0, 0x0, 0x0}, {0x0, 0x0}})
	github.com/aquasecurity/trivy/pkg/fanal/analyzer/config/config.go:44 +0x44
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.postAnalyze({0x0, {0x0, 0x101, 0xa}, {0x10b5061c8, 0x0, 0x13eaf2b14618}, 0x100281b18, {0x0, 0x0}}, ...)
	github.com/aquasecurity/trivy/pkg/fanal/analyzer/analyzer.go:353 +0x50
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.PostAnalyze({0x13eaf7fdf800, {0x13eaf3574600, 0xd, 0x10}, {0x13eaf8040000, 0x18, 0x20}, 0x13eaf7ff3620, {0x104f2d11d, 0x7}}, ...)
	github.com/aquasecurity/trivy/pkg/fanal/analyzer/analyzer.go:574 +0x440
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect({{0x16fb8e2a8, 0x1}, 0x13eaf8042130, {0x139ef9198, 0x13eaf7fc7128}, {0x10adf5b80, 0x10b5061c8}, {0x13eaf7fdf800, {0x13eaf3574600, 0xd, ...}, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/fanal/artifact/local/fs.go:234 +0x768
github.com/aquasecurity/trivy/pkg/scan.Service.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0x13eaf1af74b0, 0x1, 0x1}, {0x13eaf1efc240, ...}, ...})
	github.com/aquasecurity/trivy/pkg/scan/service.go:52 +0xc4
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan(_, {_, _}, {{{0x104f48d64, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x0, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:704 +0x380
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x104f48d64, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x0, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:302 +0xc4
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanRepository(_, {_, _}, {{{0x104f48d64, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x0, ...}, ...})
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:266 +0x214
github.com/aquasecurity/trivy/pkg/commands/artifact.run({_, _}, {{{0x104f48d64, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x45d964b800, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:450 +0x69c
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x104f48d64, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x45d964b800, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:409 +0x1ec
github.com/aquasecurity/trivy/pkg/commands.NewRepositoryCommand.func2(0x13eaf1bd7808, {0x13eaf1f38f00, 0x1, 0x8})
	github.com/aquasecurity/trivy/pkg/commands/app.go:508 +0x1a4
github.com/spf13/cobra.(*Command).execute(0x13eaf1bd7808, {0x13eaf1f38e80, 0x8, 0x8})
	github.com/spf13/cobra@v1.10.2/command.go:1015 +0x814
github.com/spf13/cobra.(*Command).ExecuteC(0x13eaf1bd6608)
	github.com/spf13/cobra@v1.10.2/command.go:1148 +0x350
github.com/spf13/cobra.(*Command).Execute(...)
	github.com/spf13/cobra@v1.10.2/command.go:1071
github.com/spf13/cobra.(*Command).ExecuteContext(...)
	github.com/spf13/cobra@v1.10.2/command.go:1064
github.com/aquasecurity/trivy/pkg/commands.Run({0x10ae85168, 0x13eaf21000c0})
	github.com/aquasecurity/trivy/pkg/commands/run.go:23 +0x5c
main.run()
	github.com/aquasecurity/trivy/cmd/trivy/main.go:50 +0x150
main.main()
	github.com/aquasecurity/trivy/cmd/trivy/main.go:19 +0x20

Operating System

Linux (Wolfi) Architecture: x86_64

Version

Version: 0.69.3
Vulnerability DB:
  Version: 2
  UpdatedAt: 2026-01-21 00:35:52.153215775 +0000 UTC
  NextUpdate: 2026-01-22 00:35:52.153215525 +0000 UTC
  DownloadedAt: 2026-01-21 02:24:11.446732 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2025-10-03 00:54:46.583190895 +0000 UTC
  NextUpdate: 2025-10-06 00:54:46.583190765 +0000 UTC
  DownloadedAt: 2025-10-03 18:11:45.202485 +0000 UTC
Check Bundle:
  Digest: sha256:ff1f8aeb19a802446ed4125bd084f2d6f50ad6800328fee24a4bc2f5a03c23c1
  DownloadedAt: 2026-03-06 21:08:26.65966 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[simar7]

thanks for the info - I think we can handle this gracefully cc @nikpivkin

[nikpivkin]

Hi @pxp928 !

As far as I know, there is always an .After field for each resource from planned_values.*.resources. Did you modify the Plan in any way before scanning?

[nikpivkin]

I tested various cases, such as recreating a plan when the resource already exists, moving it, or using the -target flag, but the plan always contained changes for the resource. However, I created a PR with a fix anyway.

[nikpivkin]

Track #10399